iloveeyjafjalla opened a new pull request, #6865: URL: https://github.com/apache/rocketmq-dashboard/pull/6865
Fixes #6864 ## The defect The AI assistant settings tab offered save, test-connection and clear-key to every role, while the endpoints behind them are admin-only on both ends: `GET /api/llm/config` is an admin-only read (the tab's own load-error comment says a reader always lands there) and `POST /api/llm/config` falls through to the admin requirement in `AuthInterceptor`. A reader's click could only produce a 403 and an error toast. The general settings tab was given the guard for exactly this reason in #5849 — `canWriteSettings = !authUserId || authAdmin === true`, applied to its buttons and to every write handler — and the AI tab of the same page was left out. ## The fix `AiAssistantTab` derives the same role check and applies it the same way: the save, test-connection and clear-key buttons are disabled for a reader, and the three handlers return early. Nothing else changes; an admin's controls stay enabled. ## Tests `web/src/pages/settings/__tests__/AiAssistantTabReader.test.tsx`, modelled on the sibling `GeneralSettingsTabReader.test.tsx`: - `disables the admin-only save and test controls for readers` — red before the change (`Error: expect(element).toBeDisabled()` on Save), green after. - `keeps the save and test controls usable for an admin` — guards the other direction, so the fix cannot degrade into "disable everywhere". ``` Test Files 3 passed (3) Tests 14 passed (14) (new file + AiAssistantTab.test.tsx + GeneralSettingsTabReader.test.tsx) tsc -b exit 0 eslint exit 0 prettier --check All matched files use Prettier code style! ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
