[BUG] Config import can create rows for a nonexistent namespace
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Current Behavior
Config import accepts any nonblank `namespace` request parameter and writes imported records with that value as `namespace_id`, even when the namespace does not exist.
`ConfigsExportImportController.importConfigs()` only checks that `namespace` is nonblank and that the file exists before calling `configsService.configsImport(namespace, ...)`.
Several import services then stamp the raw request value onto imported rows, for example:
- app auth import calls `appAuthDO.setNamespaceId(namespace)`
- metadata import calls `metaDataDTO.setNamespaceId(namespace)`
- discovery import calls `discoveryDTO.setNamespaceId(namespace)`
The affected tables store `namespace_id` as a plain column, so the database does not prevent orphaned rows.
### Expected Behavior
Config import should validate that the target namespace exists before importing namespace-scoped records.
### Steps to Reproduce
1. Prepare a valid config export file containing namespace-scoped data such as auth, metadata, or discovery records.
2. Call config import with a non-existing namespace id, for example:
```http
POST /configs/import?namespace=ghost-ns
```
3. The import can report success and create rows whose `namespace_id` is `ghost-ns`.
### Impact
Invalid imports can create orphaned records that are not attached to any existing namespace and may be hard to manage or clean up from the admin UI.
### Code Location
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ConfigsExportImportController.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/AppAuthServiceImpl.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryServiceImpl.java`
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ConfigsExportImportController.java and trace configsService.configsImport(namespace, ...), then inspect the AppAuthServiceImpl, MetaDataServiceImpl, and DiscoveryServiceImpl locations listed. Reproduce the import with namespace=ghost-ns; done means a nonexistent namespace is rejected before namespace-scoped records are written.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100