coder999o opened a new pull request, #6849: URL: https://github.com/apache/rocketmq-dashboard/pull/6849
## What is the purpose of the change An old-password login can finish password verification, overlap a completed password change, and then insert a session that the password change never revoked. This affects both administrator password resets and self-service password changes. ## Brief changelog - Keep login password verification and session insertion in one transaction, holding the account's row lock until session issuance completes. - Reuse the password change's existing user-row update and session revocation ordering: a change either revokes the issued session or finishes before login reads the replacement hash. - Add real-database concurrency regressions for administrator resets and self-service changes. Coordinate the race through H2 session blocking state, then verify the old bearer is rejected and the replacement password remains usable. No API or schema changes are required. Concurrent logins for the same account now serialize during password verification and session insertion. ## Verifying this change Using JDK 22 with the project's Java 21 target: - `cd server && mvn -o -B -ntp -Dtest=AuthServiceLoginConcurrencyIntegrationTest test` — before the fix, both cases fail because the old-password bearer still authenticates; after the fix, 2 passed. - `cd server && mvn -o -B -ntp -Dspring.profiles.active=dev '-Dtest=org.apache.rocketmq.studio.auth.**,*ArchitectureTest' test` — 154 authentication tests passed, 0 failures/errors/skips; compilation and the bound Checkstyle check passed. - `git diff --check` — passed. Integration verification used H2 in MySQL compatibility mode. A live MySQL deployment and the full repository test suite were not exercised. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
