apache / apache/shenyu

[BUG] DataPermissionServiceImpl.createSelector is not transactional

Open Beginner friendly
#6,549 1 comment 0 reactions 0 assignees View on GitHub
admin: permission priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

## Description
`createSelector` inserts the SELECTOR permission row, then collects all rules for that selector and inserts RULE permission rows in a single `insertBatch`. The method has **no** `@Transactional`. If the batch insert throws (duplicate key, constraint, DB error), the selector permission row remains committed. The sibling methods `createRule` (line 227) and `deleteSelector` (line 139) are both `@Transactional(rollbackFor = Exception.class)`.

## Location
```
shenyu-admin/.../service/impl/DataPermissionServiceImpl.java:111-129
createRule at :227, deleteSelector at :139
```

## Impact
Orphan selector permission with no/partial rule permissions; a user appears to have selector access but no rule access.

## Suggested fix
Add `@Transactional(rollbackFor = Exception.class)` to `createSelector`.

## Related existing issue(s)
None

_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Open shenyu-admin/.../service/impl/DataPermissionServiceImpl.java and inspect createSelector at lines 111-129 alongside the @Transactional annotations on deleteSelector at line 139 and createRule at line 227. Add the matching transaction behavior to createSelector and verify that a failed rule batch does not leave the selector permission row committed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.