Merge pull request #2266 from atlanhq/nb/1245

GOV-1245 Fix: member user deleting a collection

Author: nikhilbonte21

common/src/main/java/org/apache/atlas/repository/Constants.java

@@ -414,6 +414,7 @@ public enum SupportedFileExtensions { XLSX, XLS, CSV }
     public static final Set<String> SKIP_DELETE_AUTH_CHECK_TYPES = new HashSet<String>() {{
         add(README_ENTITY_TYPE);
         add(LINK_ENTITY_TYPE);
+        add(POLICY_ENTITY_TYPE);
     }};
 
     private Constants() {

repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/AuthPolicyPreProcessor.java

@@ -21,10 +21,13 @@
 import org.apache.atlas.AtlasErrorCode;
 import org.apache.atlas.RequestContext;
 import org.apache.atlas.authorize.AtlasAuthorizationUtils;
+import org.apache.atlas.authorize.AtlasEntityAccessRequest;
+import org.apache.atlas.authorize.AtlasPrivilege;
 import org.apache.atlas.exception.AtlasBaseException;
 import org.apache.atlas.featureflag.FeatureFlagStore;
 import org.apache.atlas.model.instance.AtlasEntity;
 import org.apache.atlas.model.instance.AtlasEntity.AtlasEntityWithExtInfo;
+import org.apache.atlas.model.instance.AtlasEntityHeader;
 import org.apache.atlas.model.instance.AtlasObjectId;
 import org.apache.atlas.model.instance.AtlasStruct;
 import org.apache.atlas.model.instance.EntityMutations.EntityOperation;
@@ -52,6 +55,7 @@
 import static org.apache.atlas.AtlasErrorCode.RESOURCE_NOT_FOUND;
 import static org.apache.atlas.AtlasErrorCode.UNAUTHORIZED_CONNECTION_ADMIN;
 import static org.apache.atlas.authorize.AtlasAuthorizationUtils.getCurrentUserName;
+import static org.apache.atlas.authorize.AtlasAuthorizationUtils.verifyAccess;
 import static org.apache.atlas.model.instance.EntityMutations.EntityOperation.CREATE;
 import static org.apache.atlas.model.instance.EntityMutations.EntityOperation.UPDATE;
 import static org.apache.atlas.repository.Constants.ATTR_ADMIN_ROLES;
@@ -223,6 +227,8 @@ public void processDelete(AtlasVertex vertex) throws AtlasBaseException {
         try {
             AtlasEntity policy = entityRetriever.toAtlasEntity(vertex);
 
+            authorizeDeleteAuthPolicy(policy);
+
             if(!policy.getStatus().equals(AtlasEntity.Status.ACTIVE)) {
                 LOG.info("Policy with guid {} is already deleted/purged", policy.getGuid());
                 return;
@@ -238,6 +244,16 @@ public void processDelete(AtlasVertex vertex) throws AtlasBaseException {
         }
     }
 
+    private void authorizeDeleteAuthPolicy(AtlasEntity policy) throws AtlasBaseException {
+        if (getPolicyCategory(policy).equals(POLICY_CATEGORY_BOOTSTRAP) && getPolicySubCategory(policy).equals(POLICY_SUB_CATEGORY_COLLECTION)) {
+            //skip auth check for collection bootstrap policies
+            //refer - https://linear.app/atlanproduct/issue/GOV-1245/collection-delete-is-failing-for-member-as-they-dont-have-authpolicy
+        } else {
+            AtlasEntityAccessRequest request = new AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_DELETE, new AtlasEntityHeader(policy));
+            verifyAccess(request, "delete entity: guid=" + policy.getGuid());
+        }
+    }
+
     private void validateConnectionAdmin(AtlasEntity policy) throws AtlasBaseException {
         String subCategory = getPolicySubCategory(policy);
         if (POLICY_SUB_CATEGORY_METADATA.equals(subCategory) || POLICY_SUB_CATEGORY_DATA.equals(subCategory)) {

repository/src/main/java/org/apache/atlas/repository/util/AccessControlUtils.java

@@ -100,6 +100,8 @@ public final class AccessControlUtils {
     public static final String POLICY_CATEGORY_PURPOSE  = "purpose";
     public static final String POLICY_CATEGORY_BOOTSTRAP  = "bootstrap";
 
+    public static final String POLICY_SUB_CATEGORY_COLLECTION = "collection";
+
     public static final String POLICY_RESOURCE_CATEGORY_PERSONA_CUSTOM  = "CUSTOM";
     public static final String POLICY_RESOURCE_CATEGORY_PERSONA_ENTITY  = "ENTITY";
     public static final String POLICY_RESOURCE_CATEGORY_PURPOSE  = "TAG";