Skip to content

fix(message-history): scope result snapshots to operator - #3213

Open
btlqql wants to merge 1 commit into
apache:rocketmq-studiofrom
btlqql:codex/btl-query-history-owner
Open

fix(message-history): scope result snapshots to operator#3213
btlqql wants to merge 1 commit into
apache:rocketmq-studiofrom
btlqql:codex/btl-query-history-owner

Conversation

@btlqql

@btlqql btlqql commented Sep 5, 2026

Copy link
Copy Markdown

Summary

  • scope stored message-query result lookup to the authenticated operator
  • return the existing not-found response when a record belongs to another operator
  • add regression coverage for owned and cross-operator result access

Why

History list and summary queries already filter on queried_by, but the result snapshot endpoint previously loaded records by primary key alone. A signed-in user who learned another record ID could therefore retrieve that operator's stored message metadata.

Testing

  • mvn -Dmaven.repo.local=D:\taiyi-maven-cache -Dtest=QueryHistoryServiceTest test (passes)
  • Full server suite was attempted on Windows: 2037 tests ran; unrelated existing CLI-agent shell assumptions and AliyunInstanceProviderTest.getGroupProgressShouldMapLagRowsTest failed.

@RockteMQ-AI RockteMQ-AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

Fixes an authorization issue where any authenticated user could access another user's query result snapshots by ID. Now properly scopes getMessageQueryResults to the authenticated operator via queried_by filter.

Security fix with proper test coverage for both the authorized and unauthorized access paths.

LGTM.


Automated review by github-manager-bot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants