From f2d345c54cae987e01e377294efafece1b33b804 Mon Sep 17 00:00:00 2001
From: liuhy <liuhongyu@apache.org>
Date: Sat, 25 Jul 2026 18:00:50 -0700
Subject: [PATCH] fix: validate cluster flush disk type

---
 .../studio/cluster/broker/ClusterService.java   | 10 +++++++++-
 .../cluster/broker/ClusterServiceTest.java      | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterService.java b/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterService.java
index 544e3c80..158bdfc5 100644
--- a/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterService.java
+++ b/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterService.java
@@ -65,7 +65,7 @@ public ClusterVO updateClusterConfig(UpdateConfigDTO command) {
         }
 
         if (command.getFlushDiskType() != null) {
-            config.setFlushDiskType(FlushDiskType.valueOf(command.getFlushDiskType()));
+            config.setFlushDiskType(parseFlushDiskType(command.getFlushDiskType()));
         }
         if (command.getAutoCreateTopicEnable() != null) {
             config.setAutoCreateTopicEnable(command.getAutoCreateTopicEnable());
@@ -95,6 +95,14 @@ public ClusterVO updateClusterConfig(UpdateConfigDTO command) {
         return cluster;
     }
 
+    private FlushDiskType parseFlushDiskType(String value) {
+        try {
+            return FlushDiskType.valueOf(value);
+        } catch (IllegalArgumentException ex) {
+            throw new BusinessException(400, "Invalid flushDiskType: " + value);
+        }
+    }
+
     public boolean restartBroker(String clusterId, String brokerName) {
         log.info("Restarting broker: {} in cluster: {}", brokerName, clusterId);
         clusterRepository.findById(clusterId)
diff --git a/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterServiceTest.java b/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterServiceTest.java
index a476f1a1..91336e8d 100644
--- a/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterServiceTest.java
+++ b/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterServiceTest.java
@@ -39,6 +39,7 @@
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -210,6 +211,22 @@ void updateConfigShouldThrowWhenClusterNotFound() {
                 .hasMessageContaining("Cluster not found: missing");
     }
 
+    @Test
+    void updateConfigShouldRejectInvalidFlushDiskType() {
+        when(clusterRepository.findById("cluster-1")).thenReturn(Optional.of(sampleCluster));
+
+        UpdateConfigDTO command = UpdateConfigDTO.builder()
+                .id("cluster-1")
+                .flushDiskType("INVALID_FLUSH")
+                .build();
+
+        assertThatThrownBy(() -> clusterService.updateClusterConfig(command))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("Invalid flushDiskType: INVALID_FLUSH")
+                .satisfies(ex -> assertThat(((BusinessException) ex).getCode()).isEqualTo(400));
+        verify(clusterRepository, never()).updateConfig(eq("cluster-1"), any(ClusterConfigVO.class));
+    }
+
     @Test
     void updateConfigShouldCreateConfigWhenNull() {
         ClusterVO clusterWithNullConfig = ClusterVO.builder()