[ISSUE #10825] feat(proxy): Implement the Proxy Admin gRPC management interface

.bazelignore

@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+rocketmq-apis

.github/workflows/bazel.yml

@@ -21,6 +21,8 @@ jobs:
         os: [ubuntu-latest]
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: true
       - name: Cache Bazel repository
         uses: actions/cache@v4
         with:

.github/workflows/codeql_analysis.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
+        with:
+          submodules: true
       - name: Cache Maven packages
         uses: actions/cache@v3
         with:
@@ -26,11 +28,19 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
       # Initializes the CodeQL tools for scanning.
+      - name: Set up JDK 8
+        uses: actions/setup-java@v4
+        with:
+          java-version: 8
+          distribution: "corretto"
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: java
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+      # Explicit build instead of autobuild: rocketmq-proto is generated from
+      # the rocketmq-apis submodule at compile time, which autobuild cannot
+      # handle reliably.
+      - name: Build with Maven
+        run: mvn -B compile -DskipTests -Dmaven.javadoc.skip=true
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3

.github/workflows/coverage.yml

@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@master
+        with:
+          submodules: true
       - name: Set up JDK 8
         uses: actions/setup-java@v4
         with:

.github/workflows/integration-test.yml

@@ -28,6 +28,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          submodules: true
 
       - name: Set up JDK ${{ matrix.jdk }}
         uses: actions/setup-java@v4

.github/workflows/maven.yaml

@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+        with:
+          submodules: true
       - name: Set up JDK ${{ matrix.jdk }}
         uses: actions/setup-java@v4
         with:

.gitmodules

@@ -0,0 +1,21 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+[submodule "rocketmq-apis"]
+	path = rocketmq-apis
+	url = https://github.com/apache/rocketmq-apis.git
+	branch = main

WORKSPACE

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 
 RULES_JVM_EXTERNAL_TAG = "4.2"
 
@@ -71,9 +71,9 @@ maven_install(
         "org.bouncycastle:bcpkix-jdk18on:1.83",
         "com.google.code.gson:gson:2.9.0",
         "com.googlecode.concurrentlinkedhashmap:concurrentlinkedhashmap-lru:1.4.2",
-        "org.apache.rocketmq:rocketmq-proto:2.1.2",
-        "com.google.protobuf:protobuf-java:3.20.1",
-        "com.google.protobuf:protobuf-java-util:3.20.1",
+        "com.google.protobuf:protobuf-java:3.24.4",
+        "com.google.protobuf:protobuf-java-util:3.24.4",
+        "javax.annotation:javax.annotation-api:1.3.2",
         "com.conversantmedia:disruptor:1.2.10",
         "org.apache.tomcat:annotations-api:6.0.53",
         "com.google.code.findbugs:jsr305:3.0.2",
@@ -82,13 +82,13 @@ maven_install(
         "org.openjdk.jmh:jmh-core:1.19",
         "org.openjdk.jmh:jmh-generator-annprocess:1.19",
         "com.github.ben-manes.caffeine:caffeine:2.9.3",
-        "io.grpc:grpc-services:1.47.0",
-        "io.grpc:grpc-netty-shaded:1.47.0",
-        "io.grpc:grpc-context:1.47.0",
-        "io.grpc:grpc-stub:1.47.0",
-        "io.grpc:grpc-api:1.47.0",
-        "io.grpc:grpc-protobuf:1.47.0",
-        "io.grpc:grpc-testing:1.47.0",
+        "io.grpc:grpc-services:1.50.0",
+        "io.grpc:grpc-netty-shaded:1.50.0",
+        "io.grpc:grpc-context:1.50.0",
+        "io.grpc:grpc-stub:1.50.0",
+        "io.grpc:grpc-api:1.50.0",
+        "io.grpc:grpc-protobuf:1.50.0",
+        "io.grpc:grpc-testing:1.50.0",
         "org.springframework:spring-core:5.3.27",
         "io.opentelemetry:opentelemetry-exporter-otlp:1.47.0",
         "io.opentelemetry:opentelemetry-exporter-prometheus:1.47.0-alpha",
@@ -125,6 +125,72 @@ maven_install(
     ],
 )
 
+# Well-known type protos (google/protobuf/{timestamp,duration}.proto). The
+# standalone protoc executable does not bundle them, so they have to be placed on
+# the include path explicitly.
+http_archive(
+    name = "com_google_protobuf_wkt",
+    build_file_content = """
+filegroup(
+    name = "wkt_protos",
+    srcs = glob(["*.proto"]),
+    visibility = ["//visibility:public"],
+)
+""",
+    sha256 = "616bb3536ac1fff3fb1a141450fa28b875e985712170ea7f1bfe5e5fc41e2cd8",
+    strip_prefix = "protobuf-24.4/src/google/protobuf",
+    urls = ["https://github.com/protocolbuffers/protobuf/archive/refs/tags/v24.4.tar.gz"],
+)
+
+# protoc / grpc codegen binaries. rules_jvm_external can only resolve jar
+# artifacts, so the prebuilt executables are fetched directly. Using prebuilt
+# binaries avoids the grpc-java Bazel toolchain, which would build protoc and
+# the grpc plugin from C++ sources.
+http_file(
+    name = "com_google_protobuf_protoc_linux_x86_64",
+    downloaded_file_path = "protoc",
+    executable = True,
+    sha256 = "59a70515db36977cf29ab09323b469dca51dd6572a5e08a731d741f22eef2b6c",
+    urls = ["https://repo1.maven.org/maven2/com/google/protobuf/protoc/3.24.4/protoc-3.24.4-linux-x86_64.exe"],
+)
+
+http_file(
+    name = "com_google_protobuf_protoc_osx_x86_64",
+    downloaded_file_path = "protoc",
+    executable = True,
+    sha256 = "8689519587d41b7af9e3b3f2e8c3d1335a23315857d157f61c26c10a1c61a9fa",
+    urls = ["https://repo1.maven.org/maven2/com/google/protobuf/protoc/3.24.4/protoc-3.24.4-osx-x86_64.exe"],
+)
+
+http_file(
+    name = "io_grpc_protoc_gen_grpc_java_linux_x86_64",
+    downloaded_file_path = "protoc-gen-grpc-java",
+    executable = True,
+    sha256 = "52dcbe738d3c920d7744780c67417309fe4ed990b380e9d1cf073c0654656191",
+    urls = ["https://repo1.maven.org/maven2/io/grpc/protoc-gen-grpc-java/1.53.0/protoc-gen-grpc-java-1.53.0-linux-x86_64.exe"],
+)
+
+http_file(
+    name = "io_grpc_protoc_gen_grpc_java_osx_x86_64",
+    downloaded_file_path = "protoc-gen-grpc-java",
+    executable = True,
+    sha256 = "97da9c1a408fb23391853273272a9c04f1b8ba6a2ce3c18ff95eab9cc91f0388",
+    urls = ["https://repo1.maven.org/maven2/io/grpc/protoc-gen-grpc-java/1.53.0/protoc-gen-grpc-java-1.53.0-osx-x86_64.exe"],
+)
+
+# The rocketmq-apis git submodule (apache main), which supplies
+# apache/rocketmq/v2/*.proto including the admin.proto.
+#
+# The submodule ships its own BUILD files, but they pull in toolchains this
+# workspace does not declare (graknlabs_bazel_distribution, googleapis), so the
+# directory is listed in .bazelignore (keeps `bazel build //...` from trying to
+# build it) and is surfaced here through a minimal build file instead.
+new_local_repository(
+    name = "rocketmq_apis",
+    build_file = "//bazel:rocketmq_apis.BUILD",
+    path = "rocketmq-apis",
+)
+
 http_archive(
     name = "io_buildbuddy_buildbuddy_toolchain",
     sha256 = "b12273608db627eb14051eb75f8a2134590172cd69392086d392e25f3954ea6e",

auth/BUILD.bazel

@@ -28,7 +28,7 @@ java_library(
         "@maven//:org_apache_commons_commons_lang3",
         "@maven//:commons_collections_commons_collections",
         "@maven//:com_alibaba_fastjson2_fastjson2",
-        "@maven//:org_apache_rocketmq_rocketmq_proto",
+        "//rocketmq-proto:rocketmq-proto",
         "@maven//:org_slf4j_slf4j_api",
         "@maven//:com_github_ben_manes_caffeine_caffeine",
         "@maven//:io_grpc_grpc_api",
@@ -55,7 +55,7 @@ java_library(
         "@maven//:org_apache_commons_commons_lang3",
         "@maven//:commons_collections_commons_collections",
         "@maven//:com_alibaba_fastjson2_fastjson2",
-        "@maven//:org_apache_rocketmq_rocketmq_proto",
+        "//rocketmq-proto:rocketmq-proto",
         "@maven//:org_slf4j_slf4j_api",
         "@maven//:com_github_ben_manes_caffeine_caffeine",
         "@maven//:io_grpc_grpc_api",

bazel/rocketmq_apis.BUILD

@@ -0,0 +1,33 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Build file for the rocketmq-apis git submodule.
+#
+# The submodule ships its own BUILD files (root + java/ + cpp/), but those pull
+# in toolchains this workspace does not declare (graknlabs_bazel_distribution,
+# googleapis). Rather than dragging all of that in, the directory is listed in
+# .bazelignore (so `bazel build //...` never tries to build it) and is exposed to
+# this workspace as the external repository @rocketmq_apis through a minimal
+# build file instead.
+#
+# The proto set is a glob over the whole v2 directory, so admin.proto is
+# included alongside definition.proto and service.proto.
+filegroup(
+    name = "v2_protos",
+    srcs = glob(["apache/rocketmq/v2/*.proto"]),
+    visibility = ["//visibility:public"],
+)

common/src/main/java/org/apache/rocketmq/common/constant/GrpcConstants.java

@@ -73,4 +73,12 @@ public class GrpcConstants {
 
     public static final Metadata.Key<String> CHANNEL_ID
         = Metadata.Key.of("x-mq-channel-id", Metadata.ASCII_STRING_MARSHALLER);
+
+    /**
+     * Loop-prevention marker for proxy admin RPCs: set to {@code "true"} by a proxy that forwards
+     * an admin call to the peer proxy owning the target client, so the peer never forwards it
+     * again.
+     */
+    public static final Metadata.Key<String> ADMIN_FORWARDED
+        = Metadata.Key.of("x-mq-admin-forwarded", Metadata.ASCII_STRING_MARSHALLER);
 }