Sean-Walker0 opened a new pull request, #7571:
URL: https://github.com/apache/shenyu/pull/7571
## Modifications
The batch delete endpoint receives a namespace-scoped
`BatchNamespaceCommonDTO` (the same DTO carries `namespaceId` for the
enable/disable endpoints), but the controller forwarded **only the ids**:
`delete(ids)` loaded the relations with the unscoped `selectByIds` and deleted
wholesale, so a request for one namespace could delete **another namespace's
plugin relations** — and the `onDeleted` event cascade synchronously deletes
linked selectors/rules/conditions/resources, amplifying the blast radius.
The `namespaceId` is now threaded through the service signature and the
loaded relations are filtered to the request namespace before deleting,
mirroring the already-merged selector/rule enable scoping (#7524/#7525):
```java
List<NamespacePluginVO> namespacePluginVOS =
this.namespacePluginRelMapper.selectByIds(ids).stream()
.filter(vo -> Objects.equals(vo.getNamespaceId(), namespaceId))
.toList();
```
## Verifying this change
- [x] New `NamespacePluginServiceTest#testDeleteScopedToRequestNamespace` —
deletes one own (`ns-a`) and one foreign (`ns-b`) relation for `ns-a` and
asserts only the own id reaches `deleteByIds` and only the own VO is published
to `onDeleted`. Red on the pre-fix code (`Argument(s) are different` — both ids
were deleted), green after.
- [x] `./mvnw -pl shenyu-admin -am test -B
-Dtest='NamespacePluginServiceTest,NamespacePluginControllerTest'` — 11/11 +
1/1 green (pre-existing cases unchanged, controller test compiles against the
new signature), module checkstyle clean.
## Notes
- Behavior change: relations outside the request namespace are skipped
instead of deleted — matching what the endpoint's namespace-scoped DTO promises.
- The unrelated `POST /enabled` endpoint (plain `BatchCommonDTO`, no
namespace field) keeps the global semantics its DTO implies.
- Orthogonality: #7512 (open) touches other methods of
`NamespacePluginServiceImpl` (agent-gateway MCP tool aggregation); its diff was
compared earlier and does not touch `delete`. No other open PR modifies this
service.
Make sure that:
- [x] You have read the [contribution
guidelines](https://shenyu.apache.org/community/contributor-guide).
- [x] You submit test cases (unit or integration tests) that back your
changes.
- [x] Your local test passed `./mvnw clean install
-Dmaven.javadoc.skip=true` (module-scoped: `shenyu-admin` targeted test classes
+ checkstyle green; full-module suite left to CI as with the other admin PRs).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
