zqr10159 commented on PR #4279: URL: https://github.com/apache/hertzbeat/pull/4279#issuecomment-5179618953
Addressed the review findings in commit `9ee8a65a27`. Changes: - bounded OAuth `state` input; - added per-source approval-secret failure throttling; - made authorization-code and refresh-token consumption atomic with token/replay-cache capacity checks, so transient capacity failures do not burn valid grants; - added an absolute refresh-token family lifetime and family-wide revocation when a rotated token is replayed; - kept replay-cache exhaustion fail-closed without consuming the current refresh token. Human validation: - `cargo fmt --check` - `cargo clippy --all-targets -- -D warnings` - `cargo test` (73 tests passed) The new-head MCP, backend, Maven E2E, license, and label checks are currently queued by GitHub and have not started yet. AI assistance: used for draft implementation and test iteration. Risk notes: source throttling depends on the trusted peer/source address exposed to this service; deployment-level edge rate limiting remains recommended. @Duansg, please re-review this head when convenient. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
