[PR] fix(persistence): hide studio session token hash from toString [rocketmq-dashboard]

["yyqdbngt (via GitHub)" <gi...@apache.org>]

yyqdbngt opened a new pull request, #3352:
URL: https://github.com/apache/rocketmq-dashboard/pull/3352

   ## Summary
   
   Marks the persisted studio session row's `tokenHash` as `@ToString.Exclude` and adds `RmqStudioSessionTest` locking the contract.
   
   Coverage:
   - `toString` keeps the non-secret fields (`userId`) while omitting the `tokenHash` field name and value;
   - `@Data` equality/hashCode still cover the token hash, so a rotated hash is not equal.
   
   ## Why
   
   Even though only a hash is stored, leaking it through `toString` (used in session lifecycle logging) would aid offline session-token guessing; the row otherwise followed the same defensive convention as the credential entities.
   
   ## Testing
   
   `mvn -B test -Dtest=RmqStudioSessionTest` — 2/2 pass; checkstyle (validate) clean.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(persistence): hide studio session token hash from toString [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins closed pull request #3352: fix(persistence): hide studio session token hash from toString
URL: https://github.com/apache/rocketmq-dashboard/pull/3352


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org