zjncs opened a new pull request, #4113:
URL: https://github.com/apache/rocketmq-dashboard/pull/4113
### Motivation
`MybatisPlusAclRepository.toPlainAccessConfig` rebuilds each account's
plain-access config (`topicPerms` / `groupPerms` / default perms) by reusing
`ruleQuery(...)`, whose `principal` condition is a substring `LIKE` — that
helper exists for the rule **search** endpoint (`findRulePage`). Access keys
are free-form strings (`@NotBlank` only), so when one account's key contains
another's (`svc-a` vs `svc-a-v2`), each account's view absorbs the other's
rules.
The write path (`upsertPlainAccessRules`) already deletes rules with an
**exact** `eq("principal", accessKey)` match, so the read/write asymmetry is a
straight copy-paste reuse of the search helper:
```java
// read (LIKE '%accessKey%')
ruleMapper.selectList(ruleQuery(user.getAccessKey(), null, null, null, null))
// write (exact)
ruleMapper.delete(new QueryWrapper<RmqAclRule>()
.eq("principal", config.getAccessKey())
.eq("acl_version", "2.0"));
```
Concretely: `GET /api/acl/cluster-config` →
`AclService.examineBrokerClusterAclConfig` → `toPlainAccessConfig` returns
`svc-a`'s account with `svc-a-v2`'s rules included; the edit modal
(`web/src/pages/instance/acl.tsx` `openEditPlainModal`) seeds from that view
and `handlePlainSubmit` saves the polluted set back — persisting the wrong
rules under the wrong account.
### Modifications
- `toPlainAccessConfig` now queries rules with an exact `eq("principal",
accessKey)` match (plus the same deterministic ordering), mirroring the delete
in `upsertPlainAccessRules`.
### Verification
- New test `examineShouldNotAbsorbRulesOfAccountsWhoseAccessKeysOverlap` in
`MybatisPlusAclRepositoryTest`: the `ruleMapper.selectList` stub simulates SQL
semantics (a substring `LIKE` on the principal returns both accounts' rows, an
exact equality only the requested one).
- Before the fix: fails — the account reports `["orders=PUB",
"payments=SUB"]` (the other account's rule is absorbed).
- After the fix: passes — `["orders=PUB"]` only.
- Full test class: `mvn -f server/pom.xml test
-Dtest=MybatisPlusAclRepositoryTest` → **Tests run: 23, Failures: 0, Errors:
0**.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
