ATLAS-5388: Add topic-scoped authorization for REST notification POST.

[UmeshPatil-1]

What changes were proposed in this pull request?

Problem

The rest-notification-webapp module (port 41000) exposes
POST /rest/api/atlas/v2/notification/topic/{topicName} as the REST ingress for hook messages to Kafka.

Authorization on this endpoint uses an admin-shaped check that ignores the URL topic:

verifyAccess(
    new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST),
    "post on rest notification service");

Area	Before (broken)
Request type	AtlasAdminAccessRequest
Privilege	SERVICE_NOTIFICATION_POST (service-notification-post)
Topic used in auth?	No — topicName ignored
Impact	Any user with notification permission could POST to any topic (ATLAS_HOOK.)
Hook scoping	Hook accounts could not be limited to one topic (e.g. hive-bridge → ATLAS_HOOK only)
Ranger	No notification-topic resource in Atlas service-def (follow-up: RANGER-5759)

Affected endpoint:

POST http://<host>:41000/rest/api/atlas/v2/notification/topic/{topicName}

topicName examples: ATLAS_HOOK,

---

Solution

This PR introduces topic-scoped authorization so the topicName path parameter participates in the allow/deny decision.

1. New request type and privilege (authorization module)

New file: authorization/src/main/java/org/apache/atlas/authorize/AtlasNotificationRequest.java

Carries topicName into the authorization layer (parallel to AtlasEntityAccessRequest, AtlasTypeAccessRequest).

New file: authorization/src/main/java/org/apache/atlas/authorize/AtlasAuthorizeConstants.java

Defines NOTIFICATION_TOPIC_RESOURCE_TYPE = "notification-topic" for Ranger alignment (RANGER-5759).

File: authorization/src/main/java/org/apache/atlas/authorize/AtlasPrivilege.java

Renamed privilege:

// Before
SERVICE_NOTIFICATION_POST("service-notification-post");

// After
POST_NOTIFICATION("post-notification");

File: authorization/src/main/java/org/apache/atlas/authorize/AtlasAuthorizer.java

Added authorizer contract (default deny):

default boolean isAccessAllowed(AtlasNotificationRequest request)
    throws AtlasAuthorizationException {
    return false;
}

Files: AtlasAuthorizationUtils.java, AtlasNoneAuthorizer.java

Added verifyAccess / isAccessAllowed for AtlasNotificationRequest.

---

2. Simple authorizer — topic-scoped policy model

File: authorization/src/main/java/org/apache/atlas/authorize/simple/AtlasSimpleAuthzPolicy.java

Added AtlasNotificationPermission with:

Field	Purpose
privileges	e.g. ["post-notification"] or [".*"]
topicNames	e.g. ["ATLAS_HOOK"] or [".*"]

File: authorization/src/main/java/org/apache/atlas/authorize/simple/AtlasSimpleAuthorizer.java

Matches both privilege and topic (wildcard/regex supported):

if (isMatch(action, permission.getPrivileges())
    && isMatch(topicName, permission.getTopicNames())) {
    ret = true;
}

Policy files updated:

File	Change
authorization/src/main/resources/atlas-simple-authz-policy.json	ROLE_ADMIN wildcard + HIVE_HOOK_SERVICE example role
authorization/src/test/resources/atlas-simple-authz-policy.json	Test policy with hivehook user
distro/src/conf/atlas-simple-authz-policy.json	Shipped default policy

Example — topic-scoped hook user:

"HIVE_HOOK_SERVICE": {
  "notificationPermissions": [
    {
      "privileges":  [ "post-notification" ],
      "topicNames":  [ "ATLAS_HOOK" ]
    }
  ]
}

---

3. REST ingress — topic-aware authorization

File: rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/rest/NotificationREST.java

Replaced admin-level check with topic-scoped request:

// Before
AtlasAuthorizationUtils.verifyAccess(
    new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST),
    "post on rest notification service");

// After
AtlasAuthorizationUtils.verifyAccess(
    new AtlasNotificationRequest(AtlasPrivilege.POST_NOTIFICATION, topicName),
    "post on notification topic ", topicName);

Effect: Authorization evaluates the specific topic from the URL. A user scoped to ATLAS_HOOK receives 403 when posting to ATLAS_ENTITIES.

---

4. Unit tests

File: authorization/src/test/java/org/apache/atlas/authorize/simple/AtlasSimpleAuthorizerTest.java

Added 4 tests for admin allow, data-scientist deny, hivehook topic allow, and hivehook cross-topic deny.

---

Build

mvn clean install -DskipITs=true
Result: BUILD SUCCESS. All modules.

Unit tests

Result: Tests run: Failures: 0, Errors: 0, Skipped: 0 — BUILD SUCCESS

Test	User	Topic	Expected	Result
testPostNotificationAllowedForAdminUser	admin	ATLAS_HOOK	ALLOW	Pass
testPostNotificationDeniedForDataScientistUser	dataScientist	ATLAS_HOOK	DENY	Pass
testPostNotificationAllowedForTopicSpecificRole	hivehook	ATLAS_HOOK	ALLOW	Pass
testPostNotificationDeniedForTopicSpecificRoleOnOtherTopic	hivehook	ATLAS_ENTITIES	DENY	Pass

---

Manual / integration tests (local)

Test users:

User	Password	Role
admin	admin	ROLE_ADMIN (wildcard notification access)
hivehook	hivehook	HIVE_HOOK_SERVICE (ATLAS_HOOK only)
rangertagsync	rangertagsync	DATA_SCIENTIST (no notification permissions)

Endpoint tested:

http://localhost:41000/rest/api/atlas/v2/notification/topic/{topicName}

---

Baseline test results (port 41000)

Test	Description	Expected	Actual	Pass?
T10.1	admin → POST /topic/ATLAS_HOOK	204	204	Pass
T10.2	admin (wrong password) → POST	401	401	Pass
T10.3	admin → POST invalid topic	400	400	Pass
T10.4	unauthenticated → POST	401	401	Pass

---

Core ATLAS-5388 test results (topic-scoped authorization)

Test	Description	Expected	Actual	Pass?
T11.1	rangertagsync → POST /topic/ATLAS_HOOK	403	403	Pass
T11.2	hivehook → POST /topic/ATLAS_HOOK	204	204	Pass
T11.3	hivehook → POST /topic/ATLAS_ENTITIES	403	403	Pass
T11.4	admin → POST /topic/ATLAS_ENTITIES	204	204	Pass

JIRA minimum acceptance criteria met:

• T11.2 = 204 — hivehook allowed on configured topic ATLAS_HOOK
• T11.3 = 403 — hivehook denied on non-configured topic ATLAS_ENTITIES

---

No UI changes in this PR.

---

Related

• JIRA: ATLAS-5388
• Follow-up: RANGER-5759
• Prerequisite (separate PR): ATLAS-5377 — remove duplicate notification endpoint from main webapp (port 21000)
• Security context: REST notification POST must authorize by Kafka topic, not admin privilege alone