You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@rocketmq.apache.org by "X-LightYear (via GitHub)" <gi...@apache.org> on 2026/09/23 04:22:02 UTC

[PR] fix(studio): enforce consumer group detail ownership [rocketmq-dashboard]

X-LightYear opened a new pull request, #5011:
URL: https://github.com/apache/rocketmq-dashboard/pull/5011

   ## Summary
   
   - reject instance-scoped consumer-group detail reads when the group is not owned by the selected Studio instance
   - preserve live AdminClient details for owned groups
   - add deterministic negative and positive regression coverage
   
   ## Root cause / Motivation
   
   `GET /api/groups/{name}?instanceId=...` reached `MetadataService.getConsumerGroup`, which validated only the provider vendor and then called `AdminClient.getConsumerGroup` directly. The instance-scoped metadata list path was not consulted, so two Studio instances sharing a RocketMQ endpoint could return a same-named group registered under the other instance.
   
   ## Fix
   
   Before the live detail lookup, require an exact group name in the selected instance's existing metadata scope. Unowned groups now return the established `404 Consumer group not found` error and do not invoke the live AdminClient. Owned groups retain the existing live detail behavior.
   
   ## Testing
   
   - pre-fix deterministic regression: `MetadataServiceTest.consumerGroupDetailShouldRejectAGroupOutsideTheSelectedInstanceTest` failed because the current code did not throw
   - post-fix focused negative and positive tests — passed
   - `mvn -q -Dmaven.compiler.proc=full -Dtest=MetadataServiceTest` — passed
   - `mvn -q -Dmaven.compiler.proc=full -Dtest=MetadataServiceTest,ConsumerGroupControllerTest,RocketMQAdminClientImplTest,ApacheInstanceProviderTest` — passed
   - `mvn -q -Dmaven.compiler.proc=full -DskipTests checkstyle:check` — passed
   - server package compilation/repackaging with `-Dmaven.antrun.skip=true` — passed
   - the repository license gate could not run on this Windows host because neither `python3` nor a Python interpreter is installed; the normal package command therefore stops at `server/scripts/legal.py`
   
   Fixes #5010


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(studio): enforce consumer group detail ownership [rocketmq-dashboard]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] closed pull request #5011: fix(studio): enforce consumer group detail ownership
URL: https://github.com/apache/rocketmq-dashboard/pull/5011


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(studio): enforce consumer group detail ownership [rocketmq-dashboard]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on PR #5011:
URL: https://github.com/apache/rocketmq-dashboard/pull/5011#issuecomment-5922151645

   This pull request has been automatically closed because there has been no activity for 7 days. If you would like to continue working on this, please reopen the PR with updated changes.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org