You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/18 18:43:19 UTC
[I] fix(auth): prevent concurrent disabling of all administrators [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #2372:
URL: https://github.com/apache/rocketmq-dashboard/issues/2372
### Description
`AuthService.setUserEnabled` prevents disabling the last enabled administrator by counting enabled admins before updating the requested user. The count and update are separate database operations with no transaction or row lock.
When two enabled administrators are disabled concurrently, both requests can observe a count of 2, both pass the guard, and both updates succeed. Studio is then left with zero enabled administrators, so no administrator can log in to recover access through the user-management API.
### Reproduction
1. Enable two database-backed administrators, A and B.
2. Start two transactions concurrently.
3. In transaction 1, call the disable path for A and pause after `enabledAdminCount()` returns 2.
4. In transaction 2, call the disable path for B and pause after the same count returns 2.
5. Allow both updates to complete.
Both users become disabled. The existing single-request regression only covers a count of 1 and does not exercise this interleaving.
### Expected behavior
Disabling an enabled administrator should lock the current enabled-administrator set and perform the last-admin check and update in one transaction. With two concurrent disable requests, one may succeed, but the other must observe the remaining administrator and return conflict.
### Scope
This issue is limited to preserving the database-backed last-enabled-administrator invariant under concurrent requests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] fix(auth): prevent concurrent disabling of all administrators [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #2372: fix(auth): prevent concurrent disabling of all administrators
URL: https://github.com/apache/rocketmq-dashboard/issues/2372
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] fix(auth): prevent concurrent disabling of all administrators [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #2372:
URL: https://github.com/apache/rocketmq-dashboard/issues/2372#issuecomment-5737752791
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] fix(auth): prevent concurrent disabling of all administrators [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #2372:
URL: https://github.com/apache/rocketmq-dashboard/issues/2372#issuecomment-5332817900
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The reported issue is valid. `AuthService.setUserEnabled` counts enabled administrators and then updates the target user in separate operations with no transaction or row lock. Two concurrent disable requests can both observe a count >= 2, both pass the guard, and both succeed — leaving zero enabled administrators with no recovery path through the user-management API.
**Root Cause:** Classic TOCTOU race: `enabledAdminCount()` check and the subsequent update are not atomic.
**Impact:** Complete admin lockout — no administrator can log in to recover. This is a critical availability issue.
**Severity:** High
The proposed fix (lock the admin set and perform check + update in one transaction) is correct.
An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org