lizhimins commented on PR #4145: URL: https://github.com/apache/rocketmq-dashboard/pull/4145#issuecomment-5679162454
Thanks for looking at session invalidation on config hot-reload. We're closing this because the modified path is not reachable in production. `AuthService.databaseBacked()` (`AuthService.java:591-593`) returns `userMapper != null && sessionMapper != null`, and the only `@Autowired` constructor (`:95-101`) always injects both mappers as Spring beans. So `getAuthenticatedUser` (`:155`) always takes the `databaseUserForToken` branch; `inMemoryUserForToken` (`:407`) is only reached through the non-`@Autowired` constructors at `:103` and `:107`, which pass `null` mappers and are used by tests. The added `configuredUsers()` scan therefore never runs for a real request. Two smaller points: the commit subject is literally the `Signed-off-by:` trailer rather than a Conventional Commits summary, and there are no tests for the new behaviour. The underlying concern — sessions outliving a user's removal — is worth addressing on the database-backed path, where `databaseUserForToken` is the code that actually runs. A PR there would be welcome. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
