[I] [Studio][Bug] Ignore stale ACL diagnostic and credential responses [rocketmq-dashboard]

["Aias00 (via GitHub)" <gi...@apache.org>]

Aias00 opened a new issue, #2008:
URL: https://github.com/apache/rocketmq-dashboard/issues/2008

   ## Problem\n\nThe ACL page has two asynchronous ownership races:\n\n1. **Broker ACL config examination**: two rapid checks for different cluster IDs can complete out of order. The older response unconditionally replaces  and clears the shared loading state.\n2. **Credential reveal**: a user can reveal, hide, and reveal the same ACL user's credentials again while the first request is pending. If the newer request succeeds and the older request later fails, the stale failure hides the successfully revealed credentials and emits a misleading error.\n\nBoth paths allow an obsolete request to mutate state owned by a newer user action.\n\n## Reproduction\n\n### Broker config\n\n1. Start an examination for  and keep it pending.\n2. Change the input to  and start another examination.\n3. Resolve B first, then A.\n\nThe final UI can show A's config while the input contains B.\n\n### Credential reveal\n\n1. Reveal a user's credentials and keep the request pending.\n2. Hide and reveal the sa
 me user again.\n3. Resolve the second request successfully, then reject the first request.\n\nThe stale failure removes the reveal state produced by the successful request.\n\n## Expected behavior\n\n- Only the latest ACL config examination may update config, loading state, or notifications.\n- Credential requests must be owned per user and per reveal generation.\n- Hiding or starting a newer reveal must invalidate older completions.\n- Stale failures must not roll back newer successful UI state or display errors.\n\n## Scope\n\nACL page asynchronous request ownership and focused frontend regression tests only.\n\n## Track\n\nTrack 1 / AI-Native unified control plane.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Bug] Ignore stale ACL diagnostic and credential responses [rocketmq-dashboard]

["RockteMQ-AI (via GitHub)" <gi...@apache.org>]

RockteMQ-AI commented on issue #2008:
URL: https://github.com/apache/rocketmq-dashboard/issues/2008#issuecomment-5266587576

   **Issue Evaluation**
   
   Category: `bug` | Status: **Confirmed**
   
   Verified against `rocketmq-studio` branch: `web/src/pages/instance/acl.tsx` (lines 389-406 for cluster config examination, lines 284-297 for credential reveal).
   
   **Root Cause:**
   1. **Cluster ACL config examination** (`handleExamine`): Two rapid examinations for different cluster IDs can complete out of order. The later-started request may resolve first, and the earlier-started request then overwrites the state with stale data. No sequence counter or abort mechanism protects the `setClusterConfig` call.
   2. **Credential reveal**: Rapid reveal/hide/reveal cycles can cause an in-flight `getAclUserCredentials` response to re-expand a row the user has since collapsed. The `revealing` guard is checked before the `await` but the `setCredentialsByUser` after the `await` has no staleness check.
   
   **Impact:** ACL management page — operators may see credentials or config for the wrong cluster/user, or see collapsed rows re-open unexpectedly.
   
   **Severity:** Low-Medium — confusing UX with potential information display mismatch.
   
   An automated fix proposal will be generated. Reply `/approve` to proceed with PR generation.
   
   ---
   *Automated evaluation by github-manager-bot*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Bug] Ignore stale ACL diagnostic and credential responses [rocketmq-dashboard]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on issue #2008:
URL: https://github.com/apache/rocketmq-dashboard/issues/2008#issuecomment-5349550436

   This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Bug] Ignore stale ACL diagnostic and credential responses [rocketmq-dashboard]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] closed issue #2008: [Studio][Bug] Ignore stale ACL diagnostic and credential responses
URL: https://github.com/apache/rocketmq-dashboard/issues/2008


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org