[I] [Bug] The remote ACL rule read lists brokers of every cluster behind the instance's NameServer [rocketmq-dashboard]

["Frun1na (via GitHub)" <gi...@apache.org>]

Frun1na opened a new issue, #6501:
URL: https://github.com/apache/rocketmq-dashboard/issues/6501

   ### Before Creating the Bug Report
   
   - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate.
   - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository.
   - [x] I can reproduce this on the current `rocketmq-studio` branch, or I have stated the exact version I am running below.
   
   ### Studio Version
   
   branch: `rocketmq-studio`
   git commit id: `779b8c0e`
   deployed as: reproduced by a unit test against that commit (the affected code is the backend service)
   
   ### Runtime Environment
   
   OS: Ubuntu on WSL2
   MySQL: not applicable — the defect is in the topology filtering of an ACL read; no database is involved
   browser: not applicable — reproduced in a JUnit 5 service test
   
   ### Connected RocketMQ Cluster
   
   RocketMQ version: not applicable — the NameServer topology is stubbed in the unit test; the read goes through the instance's managed admin client
   access mode: not applicable
   deployment: not applicable
   
   ### Describe the Bug
   
   `ApacheAclReadService.listRules` (`server/src/main/java/org/apache/rocketmq/studio/instance/acl/ApacheAclReadService.java:37`)
   walks every entry of `examineBrokerClusterInfo().getBrokerAddrTable()` and reads the ACL of each broker, without
   looking at the cluster the instance is configured with:
   
   - `RocketMQClusterProvider.discoverClusters`, `refreshClusterDetail` and `discoverBrokers` were narrowed to the
     configured cluster by #6196, and that commit's message names this file as one of the readers still seeing the
     whole cluster table.
   - The instance is the scope of the request (`GET /api/acl/remote/rules?instanceId=…`); the endpoint is admin-only.
   - On an instance configured for cluster A whose NameServer also serves cluster B,
     `runtimeAdminClientResolver.configuredClusterName(instanceId)` returns A, but the read still lists B's brokers.
   
   The result is a remote-rule view of the selected instance that mixes in another cluster's brokers — both in
   `policiesByBroker` and in `failuresByBroker`.
   
   ### Steps to Reproduce
   
   1. Register an Apache instance whose endpoint is a NameServer shared by cluster A and cluster B, configured with
      cluster A.
   2. `GET /api/acl/remote/rules?instanceId=<that instance>`.
   3. Without a running server, the same path is reached from a unit test: a stubbed `ClusterInfo` with
      `clusterAddrTable = {DefaultCluster: [broker-a], OtherCluster: [broker-b]}`, a stub returning
      `configuredClusterName("selected") = "DefaultCluster"`, then
      `new ApacheAclReadService(resolver).listRules("selected", null, null)`.
   
   ### What Did You Expect to See?
   
   Only the brokers of the configured cluster are read: `policiesByBroker` (and `failuresByBroker`) contain
   `10.0.0.11:10911` of `DefaultCluster` and no entry for `10.0.0.12:10911` of `OtherCluster`. An instance that
   names no cluster keeps reading every broker of the endpoint.
   
   ### What Did You See Instead?
   
   Both brokers are read. The test fails with:
   
   ```
   Expecting actual:
     {"10.0.0.11:10911"=[], "10.0.0.12:10911"=[]}
   to contain only following keys:
     ["10.0.0.11:10911"]
   ```
   
   A second case has no error path at all: when the topology carries brokers but no cluster table while the instance
   names a cluster, the read silently falls back to the whole broker table instead of reporting that the configured
   cluster's membership cannot be resolved.
   
   ### Additional Context
   
   A fix with a regression test follows in a pull request.
   
   ### Are You Willing to Submit a Pull Request?
   
   - [x] Yes, I am willing to submit a pull request.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] The remote ACL rule read lists brokers of every cluster behind the instance's NameServer [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins closed issue #6501: [Bug] The remote ACL rule read lists brokers of every cluster behind the instance's NameServer
URL: https://github.com/apache/rocketmq-dashboard/issues/6501


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] The remote ACL rule read lists brokers of every cluster behind the instance's NameServer [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins commented on issue #6501:
URL: https://github.com/apache/rocketmq-dashboard/issues/6501#issuecomment-6190210094

   Resolved by #6502 (merged into `rocketmq-studio` as [`cc97b1c83`](https://github.com/apache/rocketmq-dashboard/commit/cc97b1c83)). The merge target is not the default branch, so this issue does not auto-close.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org