apache / apache/rocketmq-dashboard
[Studio][Bug] Deleting a Tencent ACL rule deletes the role account
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 683
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 58
Description
## Description
Tencent Cloud RocketMQ roles are exposed in Studio as both ACL users and cluster-wide ACL rules. These are presented as separate resources with separate delete actions, but deleting a Tencent ACL rule currently calls the cloud `DeleteRole` API. This removes the underlying role account, including its access credentials, instead of only removing its read/write authorization.
## Steps to reproduce
1. Open the ACL page for a Tencent Cloud RocketMQ 5.x instance.
2. Create or select a role that has `PermRead` and/or `PermWrite` enabled.
3. Delete the role's entry from the ACL rules tab.
4. Refresh the ACL users tab or query the role in Tencent Cloud.
## Actual behavior
The role account is deleted because `TencentAclService.deleteRule` calls `DeleteRole`, the same API used by the explicit ACL user delete operation.
## Expected behavior
Deleting the ACL rule should revoke the role's cluster-wide read/write permissions while preserving the role account and its credentials. Only the ACL user delete action should call `DeleteRole`.
Roles whose `PermRead` and `PermWrite` values are both disabled should no longer appear in the ACL rule list, but should remain visible in the ACL user list.
## Code location
- `server/src/main/java/org/apache/rocketmq/studio/provider/tencent/TencentAclService.java`
## Proposed scope
- Change Tencent rule deletion to call `ModifyRole` with `PermRead=false` and `PermWrite=false`.
- Exclude roles with neither permission from `listRules`.
- Add regression tests proving rule deletion preserves the role and user deletion remains the destructive operation.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in server/src/main/java/org/apache/rocketmq/studio/provider/tencent/TencentAclService.java and inspect deleteRule, listRules, and the ACL user delete path. Compare the DeleteRole and ModifyRole behavior, then add regression tests showing that rule deletion preserves the role and credentials, removes both permissions from the rule list, and leaves user deletion destructive.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100