apache / apache/rocketmq-dashboard

[Studio][Bug] Deleting a Tencent ACL rule deletes the role account

Open
#4,161 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
683
Avg merge
2d 14h
Merged PRs (30d)
58

Description

## Description

Tencent Cloud RocketMQ roles are exposed in Studio as both ACL users and cluster-wide ACL rules. These are presented as separate resources with separate delete actions, but deleting a Tencent ACL rule currently calls the cloud `DeleteRole` API. This removes the underlying role account, including its access credentials, instead of only removing its read/write authorization.

## Steps to reproduce

1. Open the ACL page for a Tencent Cloud RocketMQ 5.x instance.
2. Create or select a role that has `PermRead` and/or `PermWrite` enabled.
3. Delete the role's entry from the ACL rules tab.
4. Refresh the ACL users tab or query the role in Tencent Cloud.

## Actual behavior

The role account is deleted because `TencentAclService.deleteRule` calls `DeleteRole`, the same API used by the explicit ACL user delete operation.

## Expected behavior

Deleting the ACL rule should revoke the role's cluster-wide read/write permissions while preserving the role account and its credentials. Only the ACL user delete action should call `DeleteRole`.

Roles whose `PermRead` and `PermWrite` values are both disabled should no longer appear in the ACL rule list, but should remain visible in the ACL user list.

## Code location

- `server/src/main/java/org/apache/rocketmq/studio/provider/tencent/TencentAclService.java`

## Proposed scope

- Change Tencent rule deletion to call `ModifyRole` with `PermRead=false` and `PermWrite=false`.
- Exclude roles with neither permission from `listRules`.
- Add regression tests proving rule deletion preserves the role and user deletion remains the destructive operation.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in server/src/main/java/org/apache/rocketmq/studio/provider/tencent/TencentAclService.java and inspect deleteRule, listRules, and the ACL user delete path. Compare the DeleteRole and ModifyRole behavior, then add regression tests showing that rule deletion preserves the role and credentials, removes both permissions from the rule list, and leaves user deletion destructive.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.