Frun1na opened a new issue, #4730:
URL: https://github.com/apache/rocketmq-dashboard/issues/4730
### Which Documentation
`README_zh.md` — the 登录保护 paragraph in 一键构建 & 运行.
### What Is Wrong
The Chinese README says `登录接口仅接受已配置用户` (the login endpoint only accepts the
users
configured through `STUDIO_AUTH_ADMIN_USERNAME` /
`STUDIO_AUTH_ADMIN_PASSWORD`). That stopped being
true when #2313 added persisted user management:
- `AuthService.ensureBootstrapUsers()` seeds the configured users only on
the first login against an
empty `rmq_studio_user` table; afterwards the database is the source of
truth for credentials and
account status.
- Accounts created on the user-management page log in as well, so the login
endpoint accepts more
than the configured users.
- `README.md` already describes the seed-then-database model, and the doc
template asks to keep the
two READMEs in sync.
### Suggested Change
Rewrite the paragraph to match `README.md`: configured credentials are a
bootstrap seed for an empty
database, the database is authoritative afterwards, administrators manage
accounts on the
user-management page, browsers authenticate with an `HttpOnly` session
cookie and API clients can
exchange for a bearer token.
Opened PR #4729 for this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
