[ISSUE #4190] feat(audit): add resource operation timelines

[Aias00]

What is the purpose of the change

Add a read-only operation timeline for an exact audited resource so operators can inspect its history without relying on fuzzy global search.

Brief changelog

• Add exact target and missing-cluster filters to audit list and CSV export APIs.
• Make non-empty audit targets open a paginated timeline drawer with date filtering and export.
• Keep unscoped resources separate from cluster-scoped resources.
• Guard the drawer against stale asynchronous responses.
• Add backend, frontend, mock-service, localization, and API documentation coverage.

Verification

• Backend audit tests: 38 passed.
• Frontend focused tests: 34 passed.
• Frontend full suite: 952 passed.
• Frontend production build, ESLint, Prettier, Maven Checkstyle, and git diff checks passed.
• Desktop and 390x844 mobile viewport checks passed.

Fixes #4190

[RockteMQ-AI]

Summary

Adds a read-only resource operation timeline drawer to the audit page, allowing operators to inspect the history of a specific audited resource without relying on fuzzy global search. Backend gains target (exact match) and clusterIdMissing (null/empty cluster filter) query parameters; frontend adds a ResourceOperationTimelineDrawer component with date filtering, pagination, and CSV export.

The implementation is well-structured:

• Backend: Clean extension of the existing audit API with backward-compatible new parameters. The target filter uses equality matching (not LIKE), which is the correct semantic for resource-scoped timeline queries. The clusterIdMissing flag properly handles resources without cluster context.
• Frontend: The drawer uses a requestVersion ref to guard against stale async responses — good pattern for avoiding race conditions when users navigate quickly. The destroyOnHidden prop ensures clean state on re-open.
• Tests: Comprehensive coverage across backend (38 tests), frontend focused (34 tests), and full frontend suite (952 tests). API documentation is updated.

Suggestions

• [Info] The three LIKE-escape PRs (#4192, #4193, #4194) should be merged before or alongside this one, since this PR also applies escapeLike() to the audit search path. If this PR merges first, the audit search will still have the wildcard bug until the other PRs land.

• [Info] Consider extracting the escapeLike() utility into a shared helper class (e.g., LikeUtils) to avoid duplication across the four repository classes that now each have their own private copy.

No blocking issues. LGTM.

---

Automated review by github-manager-bot

[RockteMQ-AI]

⚠️ Merge conflict detected

This PR has conflicts with the main branch and cannot be merged. Please rebase or merge main into your branch and resolve the conflicts:

git fetch origin
git checkout feat/studio-audit-resource-timeline
git rebase origin/main
# resolve conflicts, then:
git push --force-with-lease

This is a one-time reminder. Feel free to @mention me for a re-review after conflicts are resolved.

---

Automated notification by github-manager-bot

[RockteMQ-AI]

Summary

Adds a read-only operation timeline feature for audited resources, allowing operators to inspect the history of specific resources without relying on global search. The implementation includes backend API enhancements (exact target filter, missing-cluster filter), a paginated timeline drawer with date filtering, and proper handling of stale async responses.

Strengths:

• Well-structured separation between cluster-scoped and unscoped resources
• Excellent stale response guard in the drawer component (prevents race conditions)
• Good test coverage (38 backend tests, 34 frontend focused tests, 952 full suite)
• Clean pagination and date filtering implementation
• Proper CSV export with new filters

Minor suggestions:

• Consider adding client-side validation for date range picker to prevent future dates
• Add Javadoc explaining the difference between search (fuzzy) and target (exact) parameters
• Consider making cluster-scoped resource types configurable

Overall, this is a solid feature addition that improves the audit capabilities of the dashboard. The code is well-structured, properly tested, and handles edge cases (stale responses, pagination) correctly.

---

Automated review by github-manager-bot

Additional notes (not anchored to a changed line)

• [INFO] src/main/java/apache/rocketmq/dashboard/audit/AuditLogController.java:112 — Good addition of target and clusterIdMissing filters. The target filter uses exact match which is appropriate for resource-specific timeline queries. Consider adding a brief Javadoc comment explaining the difference between search (fuzzy) and target (exact) parameters. (line outside diff)
• [INFO] web-ui/src/views/audit/AuditTimelineDrawer.vue:89 — Excellent use of stale response guard with requestToken. This prevents race conditions when users quickly switch between resources. The pattern of incrementing a token and checking it before applying async results is a solid approach. (line outside diff)
• [WARNING] web-ui/src/views/audit/AuditTimelineDrawer.vue:145 — The date range picker allows selecting future dates. While the backend may handle this gracefully, consider adding client-side validation to prevent selecting end dates beyond today, or at least show a warning. This improves UX by preventing empty result sets. (line outside diff)
• [INFO] src/main/java/apache/rocketmq/dashboard/audit/AuditLogService.java:234 — Good separation of cluster-scoped vs unscoped resources in getClusterScopedResourceTypes(). This makes the filtering logic clearer and easier to maintain. The hardcoded list is acceptable for now but consider making it configurable if new resource types are added frequently. (line outside diff)
• [INFO] web-ui/src/views/audit/AuditLogList.vue:67 — Clean implementation of the timeline drawer trigger. Opening the drawer only when auditTargets is non-empty is a good UX decision. The pagination reset (currentPage = 1) when opening a new resource's timeline prevents stale page numbers. (line outside diff)