Copilot commented on code in PR #4797:
URL:
https://github.com/apache/rocketmq-dashboard/pull/4797#discussion_r4067228216
##########
server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java:
##########
@@ -323,15 +323,21 @@ public PlainAccessConfigVO
createAndUpdatePlainAccessConfig(PlainAccessConfigVO
* The secret is stored base64-encoded in the database and decoded here.
*/
public AclUserVO getUserCredentials(String id, String instanceId) {
+ AclUserVO user;
if (isTencentInstance(instanceId)) {
- return tencentAclService.getUserCredentials(instanceId, id);
- }
- if (!StringUtils.hasText(id)) {
- throw new BusinessException(400, "ACL user id is required");
- }
- log.info("Revealing credentials for ACL user id={}", id);
- return aclRepository.findUserById(EntityIds.parseId(id))
- .orElseThrow(() -> new BusinessException(404, "ACL user not
found: " + id));
+ user = tencentAclService.getUserCredentials(instanceId, id);
+ } else {
+ if (!StringUtils.hasText(id)) {
+ throw new BusinessException(400, "ACL user id is required");
+ }
+ log.info("Revealing credentials for ACL user id={}", id);
+ user = aclRepository.findUserById(EntityIds.parseId(id))
+ .orElseThrow(() -> new BusinessException(404, "ACL user
not found: " + id));
+ }
+ // Both vendor paths reveal a secret, so both are audited; the detail
never carries it.
+ recordAudit("REVEAL_ACL_USER_CREDENTIALS", "ACL_USER",
String.valueOf(id), null,
+ "instanceId=" + instanceId);
Review Comment:
This adds `REVEAL_ACL_USER_CREDENTIALS`, but the audit UI has no
corresponding entry in `web/src/pages/ops/auditPresentation.ts` or
`web/src/i18n/translations.ts`. These records will therefore fall into the
generic `other` category and lose Chinese localization; please register the
operation in the frontend vocabulary alongside this backend change.
##########
server/src/main/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialService.java:
##########
@@ -167,8 +167,13 @@ public CloudCredentialVO reveal(Long id) {
if (id == null) {
throw new BusinessException(400, "Cloud credential id is
required");
}
- return credentialRepository.findById(id)
+ CloudCredentialVO credential = credentialRepository.findById(id)
.orElseThrow(() -> new BusinessException(404, "Cloud
credential not found: " + id));
+ // Reading the secret is the one operation on this resource that
leaves no other trace, so it
+ // is audited like the mutations: the detail names the credential but
never the secret.
+ recordAudit("REVEAL_CLOUD_CREDENTIAL", "CLOUD_CREDENTIAL",
String.valueOf(credential.getId()), null,
+ credentialAuditDetail(credential));
Review Comment:
This introduces a new audit operation code, but the audit UI has no
`REVEAL_CLOUD_CREDENTIAL` entry in `web/src/pages/ops/auditPresentation.ts` or
`web/src/i18n/translations.ts`. As a result, these records are rendered with
the generic `other` category and an English fallback instead of the localized
security label; please add the presentation and Chinese/English translation
entries (and matching UI tests) with this backend operation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
