guanzhenxing opened a new pull request, #7877: URL: https://github.com/apache/shenyu/pull/7877
### Motivation Third-party systems that integrate with ShenYu admin currently manage app-auth credentials through the dashboard-oriented CRUD endpoints (`/appAuth/apply`, `updateSk`, `batchDelete`, ...). Those endpoints are designed for human operators and lack three properties machine callers need: 1. **Idempotency** — a retried create must return the same credentials, and a create racing with a delete must never resurrect a revoked credential; 2. **Whole-resource semantics** — path updates are partial patches, so "clear all paths" cannot be expressed unambiguously; 3. **Recoverable results** — a lost HTTP response must be answerable later without re-creating anything. This PR adds a parallel, opt-in lifecycle API under `/appAuth/lifecycle/*` with those properties, without touching the existing endpoints. ### What's inside - **4 endpoints** (`apply` / `result` / `revoke` / `replacePaths`), each guarded by a dedicated `system:authen:lifecycle*` permission — dashboard list permissions can never fetch credentials; - **`app_auth_request` table** with unique triple key `(caller_key, namespace_id, request_id)`: apply reserves the key first, then creates `app_auth` (fixed `open=true, enabled=false`) atomically in one transaction; same-key same-parameter replays return the same credentials, different parameters are rejected; - **revoke tombstone**: revocation marks the key `REVOKED` in the same transaction that deletes the auth and child rows, so a late `apply` can never resurrect revoked credentials; `batchDelete` now marks associated keys under the same unified lock order instead of silently dropping linkage; - **`replacePaths`** replaces the managed paths as a whole — an empty array really clears (a real de-authorization, not a no-op); - **`result`** is read-only and only returns credentials for `CREATED` records, so a lost response is recoverable by `requestId`; - **service-account whitelist** `shenyu.app-auth.lifecycle.service-user-ids` (immutable userIds) defaults to **deny-all** — the caller identity always derives from the authenticated session, never from request parameters. ### Relationship to the existing `/appAuth/apply` The existing `apply`/`applyCreate`/`applyUpdate` flow is kept untouched for dashboard usage. The lifecycle API is deliberately a separate contract rather than an extension: its invariants (reserve-then-create, tombstones, whole-replace) are transactional properties that cannot be layered onto the existing partial-update semantics without breaking current consumers. ### Tests - H2 (run in CI): access-policy deny matrix, controller access contract, `AppAuthServiceTest`/`ConfigsImportDuplicateTest` adjusted for the new constructor argument — `shenyu-admin` module suite green (2079 tests); - Real-MySQL series (opt-in via explicit `-Dshenyu.auth.test.jdbcUrl/username/password`, self-disabled otherwise — never silently connects to any default database; the catalog must match `shenyu_auth_test.*`): apply replay/conflict/rollback-event semantics, revoke tombstones, apply/revoke races at a two-thread barrier, replacePaths whole-replace, legacy-delete linkage. Verified against MySQL 8.0.36. ### DB changes `app_auth_request` DDL + four button resources added to: h2 schema, mysql/pg/oracle init scripts, and all five 2.7.2 upgrade dialects (following the 2.7.2 upgrade-script pattern). A `**/*.sha256` entry was added to the RAT excludes for the canonical-request digest fixture, which cannot carry a license header. ### Checklist - [x] Read the [contributor guide](https://shenyu.apache.org/community/contributor-guide) - [x] Tests included - [x] `./mvnw clean install -Dmaven.javadoc.skip=true` passes locally（checkstyle + RAT included） - [x] Commits signed off (DCO) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
