[I] [Bug] Audit-log cleanup deletes audit evidence without recording the deletion [rocketmq-dashboard]

["unbridled-41 (via GitHub)" <gi...@apache.org>]

unbridled-41 opened a new issue, #5941:
URL: https://github.com/apache/rocketmq-dashboard/issues/5941

   ### Studio Version
   branch: `rocketmq-studio` @ `7e7aa344` (the revision verified; the branch is based on it)
   deployed as: not required to reproduce
   
   ### Runtime Environment
   
   Reproduced with the backend tests (`cd server && mvn -o -B -ntp test -Dtest='AuditServiceTest'`).
   
   ### Connected RocketMQ Cluster
   
   Not involved; the rows live in Studio's own `rmq_operation_audit` table.
   
   ### Describe the Bug
   
   `POST /audit-logs/cleanup` deletes up to 10 000 audit rows per call and leaves no trace of its own:
   
   ```java
   log.info("Cleaning up audit logs older than {} days", beforeDays);
   return auditRepository.deleteBefore(cutoff, CLEANUP_BATCH_SIZE, CLEANUP_MAX_BATCHES);
   ```
   
   The audit table is the one store whose own deletion is unaudited, so an administrator can erase older evidence of earlier operations and the trail cannot say who did it or how much was removed. Every sibling destructive operation records one: alert bulk delete, DLQ resend, cloud-credential delete, certificate delete, instance delete. The scheduled sweep that reuses this method inherits the gap.
   
   ### Steps to Reproduce
   
   1. `POST /api/audit-logs/cleanup {"beforeDays":30}` with rows older than the cutoff.
   2. The response reports the deleted count, and no audit row exists for the cleanup itself.
   
   ### What Did You Expect to See?
   
   The cleanup recorded in the trail it just pruned, with the actor, the retention window and the deleted count.
   
   ### What Did You See Instead?
   
   Nothing; the deletion is invisible in the audit log and its CSV export.
   
   ### Evidence
   
   - `server/.../ops/audit/AuditService.java` (`cleanupLogs`), `server/.../ops/audit/AuditController.java`, `web/src/pages/ops/audit.tsx`.
   - `cd server && mvn -o -B -ntp test -Dtest='AuditServiceTest#cleanupLogsRecordsWhatItDeletedTest'` - fails before the fix ("Wanted but not invoked: auditRepository.save").
   
   ### Impact
   
   Compliance evidence can be erased with no record of who erased it or how much; the audit trail's own integrity claim ("every mutating operation is recorded") does not hold for this endpoint.
   
   ### Acceptance Criteria
   
   - A cleanup that removed rows records `CLEANUP_AUDIT_LOGS` with the retention window and the count, while a no-op cleanup records nothing, with regression tests for both.
   
   **Corresponding PR:** #ISSUEPR#
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Audit-log cleanup deletes audit evidence without recording the deletion [rocketmq-dashboard]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on issue #5941:
URL: https://github.com/apache/rocketmq-dashboard/issues/5941#issuecomment-6305450705

   This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Audit-log cleanup deletes audit evidence without recording the deletion [rocketmq-dashboard]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] closed issue #5941: [Bug] Audit-log cleanup deletes audit evidence without recording the deletion
URL: https://github.com/apache/rocketmq-dashboard/issues/5941


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org