(atlas) branch master updated: ATLAS-5380: Authorize bulk entity headers before returning classifications (#734)

[nixon]

This is an automated email from the ASF dual-hosted git repository.

nixonrodrigues pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/atlas.git


The following commit(s) were added to refs/heads/master by this push:
     new 1ba819c0c ATLAS-5380: Authorize bulk entity headers before returning 
classifications (#734)
1ba819c0c is described below

commit 1ba819c0ca411c8a17a1ef2e270f0a1f96f65f9e
Author: Vinayak Marraiya 
<72193307+vinayakmarraiya230...@users.noreply.github.com>
AuthorDate: Tue Sep 8 18:11:50 2026 +0530

    ATLAS-5380: Authorize bulk entity headers before returning classifications 
(#734)
    
    Apply per-entity ENTITY_READ checks in ClassificationAssociator.Retriever
    when building bulk headers response, matching getHeaderById behavior.
---
 .../atlas/repository/store/graph/v2/ClassificationAssociator.java | 8 +++++++-
 .../atlas/repository/store/graph/v2/EntityGraphRetriever.java     | 7 +++++++
 .../repository/store/graph/v2/ClassificationAssociatorTest.java   | 2 ++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git 
a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociator.java
 
b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociator.java
index f4038019c..96e57ca27 100644
--- 
a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociator.java
+++ 
b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociator.java
@@ -86,7 +86,13 @@ public class ClassificationAssociator {
 
         private AtlasEntityHeader getEntityHeaderByGuid(String guid) {
             try {
-                return 
entityRetriever.toAtlasEntityHeaderWithClassifications(guid);
+                AtlasEntityHeader entityHeader = 
entityRetriever.toAtlasEntityHeaderWithClassifications(guid);
+
+                if (entityHeader == null || 
!entityRetriever.isEntityReadAllowed(entityHeader)) {
+                    return null;
+                }
+
+                return entityHeader;
             } catch (AtlasBaseException e) {
                 LOG.error("Error fetching entity: {}", guid, e);
             }
diff --git 
a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/EntityGraphRetriever.java
 
b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/EntityGraphRetriever.java
index 606347793..b4eb43d5e 100644
--- 
a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/EntityGraphRetriever.java
+++ 
b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/EntityGraphRetriever.java
@@ -20,6 +20,9 @@ package org.apache.atlas.repository.store.graph.v2;
 import com.fasterxml.jackson.core.type.TypeReference;
 import org.apache.atlas.AtlasErrorCode;
 import org.apache.atlas.RequestContext;
+import org.apache.atlas.authorize.AtlasAuthorizationUtils;
+import org.apache.atlas.authorize.AtlasEntityAccessRequest;
+import org.apache.atlas.authorize.AtlasPrivilege;
 import org.apache.atlas.exception.AtlasBaseException;
 import org.apache.atlas.model.TimeBoundary;
 import org.apache.atlas.model.glossary.AtlasGlossaryCategory;
@@ -319,6 +322,10 @@ public class EntityGraphRetriever {
         return ret;
     }
 
+    public boolean isEntityReadAllowed(AtlasEntityHeader entityHeader) {
+        return AtlasAuthorizationUtils.isAccessAllowed(new 
AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_READ, 
entityHeader));
+    }
+
     public Map<String, Map<String, Object>> getBusinessMetadata(AtlasVertex 
entityVertex) throws AtlasBaseException {
         Map<String, Map<String, Object>>                 ret            = null;
         String                                           entityTypeName = 
getTypeName(entityVertex);
diff --git 
a/repository/src/test/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociatorTest.java
 
b/repository/src/test/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociatorTest.java
index c23c06a4b..eac6ad1bc 100644
--- 
a/repository/src/test/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociatorTest.java
+++ 
b/repository/src/test/java/org/apache/atlas/repository/store/graph/v2/ClassificationAssociatorTest.java
@@ -44,6 +44,7 @@ import static 
org.apache.atlas.repository.store.graph.v2.ClassificationAssociato
 import static 
org.apache.atlas.repository.store.graph.v2.ClassificationAssociator.Updater.PROCESS_UPDATE;
 import static 
org.apache.atlas.repository.store.graph.v2.ClassificationAssociator.Updater.STATUS_DONE;
 import static 
org.apache.atlas.repository.store.graph.v2.ClassificationAssociator.Updater.STATUS_SKIPPED;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.mock;
@@ -174,6 +175,7 @@ public class ClassificationAssociatorTest {
             EntityGraphRetriever entityGraphRetriever = 
mock(EntityGraphRetriever.class);
 
             
when(entityGraphRetriever.toAtlasEntityHeaderWithClassifications(TABLE_GUID)).thenReturn(entityHeaderWithClassification);
+            
when(entityGraphRetriever.isEntityReadAllowed(any())).thenReturn(true);
 
             ClassificationAssociator.Retriever retriever = new 
ClassificationAssociator.Retriever(entityGraphRetriever, auditRepository);