yyqdbngt opened a new pull request, #3244: URL: https://github.com/apache/rocketmq-dashboard/pull/3244
## Summary Adds `ToolAccessPolicyTest`, a first unit test for `ToolAccessPolicy` (the guard deciding whether a request path is a tool execution and whether the current user may execute a given tool). `ToolCatalog` is mocked; the request principal is simulated through `AuthenticatedUserContext#setUser` and cleared after each test. Coverage: - path-shape recognition: only `/api/ai/tools/<name>/execute` paths qualify; - reader exposure: only low-risk (`L1`) read-only tools are reader-accessible, and the deny list still withholds `rmq.message.query`/`rmq.message.trace` from readers; - request-path resolution decodes the (possibly URL-encoded) tool name before catalog lookup; - authorization: non-admin users get `BusinessException` 403 for restricted tools, admins are always allowed, and readers may run tools they are allowed to touch. ## Why The policy gates every AI tool execution request; the exposure and authorization rules had no direct test. ## Testing `mvn -B test -Dtest=ToolAccessPolicyTest` — 7/7 pass; checkstyle (validate) clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
