messere1 opened a new pull request, #6727:
URL: https://github.com/apache/rocketmq-dashboard/pull/6727
### Brief Description
`pushAclToBroker` maps every stored rule to a broker resource through
`brokerResource`, and the final branch of that mapping returns the ANY resource
(`"*"`) for **any** rule whose `resourceType` is neither `Topic` nor `Group` —
including a rule with **no** resource type at all. A rule without a type does
not say whether its resource names a topic or a group, yet the push wrote it as
a cluster-wide entry: a stored `{resource: "topic-a", actions: [SUB], decision:
ALLOW}` row with a missing `resourceType` reached the broker as `SUB` on `"*"`
— the named grant was silently widened to the whole cluster.
The store can hold such rows: `createRule` validates only the principal and
the resource text, so an API caller (or a row written before the type column
existed) can omit `resourceType`; the console form always sends one, which is
why the widening never shows up in console-driven flows.
The same push is already careful about every other unrepresentable rule:
PREFIX patterns and actions outside PUB/SUB/GET come back as per-account
skipped reasons instead of failing the whole push. This change gives untyped
rules the same treatment — `brokerResource` now returns `null` for a
missing/unrecognized type and `buildPushPlan` records a skip reason — while the
intended cluster-scope path (`resourceType: "Cluster"` → `"*"`) is kept and now
pinned by a test.
### How Did You Test This Change?
-
`AclServiceTest#pushAclToBrokerSkipsRulesWithoutAResourceTypeInsteadOfWideningThemTest`
(new): an account with one typed Topic rule, one untyped rule for the same
resource, and one Cluster rule. **Red on unpatched tip** — the untyped rule was
pushed as a third policy entry with resource `"*"` (`policyCount` 3 vs 2).
**Green after the fix** — entries are exactly `["Topic:topic-a", "*"]` and the
skipped list carries the reason naming the untyped rule.
- Full `AclServiceTest` 84/84 and `AclControllerTest` 27/27 green; `mvn
checkstyle:check` clean (JDK 21).
- No API shape change; the skipped-reason list the ACL page already renders
is the only new output.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
