diff --git a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/AtlasEntityStoreV2.java b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/AtlasEntityStoreV2.java index a9419e2918..c620ad72d0 100644 --- a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/AtlasEntityStoreV2.java +++ b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/AtlasEntityStoreV2.java @@ -1580,21 +1580,23 @@ private EntityMutationResponse createOrUpdate(EntityStream entityStream, boolean // Check if authorized to update entities if (!reqContext.isImportInProgress()) { for (AtlasEntity entity : context.getUpdatedEntities()) { - AtlasEntityHeader entityHeaderWithClassifications = entityRetriever.toAtlasEntityHeaderWithClassifications(entity.getGuid()); - AtlasEntityHeader entityHeader = new AtlasEntityHeader(entity); + if(!PreProcessor.skipUpdateAuthCheckTypes.contains(entity.getTypeName())){ + AtlasEntityHeader entityHeaderWithClassifications = entityRetriever.toAtlasEntityHeaderWithClassifications(entity.getGuid()); + AtlasEntityHeader entityHeader = new AtlasEntityHeader(entity); - if(CollectionUtils.isNotEmpty(entityHeaderWithClassifications.getClassifications())) { - entityHeader.setClassifications(entityHeaderWithClassifications.getClassifications()); - } + if(CollectionUtils.isNotEmpty(entityHeaderWithClassifications.getClassifications())) { + entityHeader.setClassifications(entityHeaderWithClassifications.getClassifications()); + } - AtlasEntity diffEntity = reqContext.getDifferentialEntity(entity.getGuid()); - boolean skipAuthBaseConditions = diffEntity != null && MapUtils.isEmpty(diffEntity.getCustomAttributes()) && MapUtils.isEmpty(diffEntity.getBusinessAttributes()) && CollectionUtils.isEmpty(diffEntity.getClassifications()) && CollectionUtils.isEmpty(diffEntity.getLabels()); - boolean skipAuthMeaningsUpdate = diffEntity != null && MapUtils.isNotEmpty(diffEntity.getRelationshipAttributes()) && diffEntity.getRelationshipAttributes().containsKey("meanings") && diffEntity.getRelationshipAttributes().size() == 1 && MapUtils.isEmpty(diffEntity.getAttributes()); - boolean skipAuthStarredDetailsUpdate = diffEntity != null && MapUtils.isEmpty(diffEntity.getRelationshipAttributes()) && MapUtils.isNotEmpty(diffEntity.getAttributes()) && diffEntity.getAttributes().size() == 3 && diffEntity.getAttributes().containsKey(ATTR_STARRED_BY) && diffEntity.getAttributes().containsKey(ATTR_STARRED_COUNT) && diffEntity.getAttributes().containsKey(ATTR_STARRED_DETAILS_LIST); - if (skipAuthBaseConditions && (skipAuthMeaningsUpdate || skipAuthStarredDetailsUpdate)) { - //do nothing, only diff is relationshipAttributes.meanings or starred, allow update - } else { - AtlasAuthorizationUtils.verifyUpdateEntityAccess(typeRegistry, entityHeader,"update entity: type=" + entity.getTypeName()); + AtlasEntity diffEntity = reqContext.getDifferentialEntity(entity.getGuid()); + boolean skipAuthBaseConditions = diffEntity != null && MapUtils.isEmpty(diffEntity.getCustomAttributes()) && MapUtils.isEmpty(diffEntity.getBusinessAttributes()) && CollectionUtils.isEmpty(diffEntity.getClassifications()) && CollectionUtils.isEmpty(diffEntity.getLabels()); + boolean skipAuthMeaningsUpdate = diffEntity != null && MapUtils.isNotEmpty(diffEntity.getRelationshipAttributes()) && diffEntity.getRelationshipAttributes().containsKey("meanings") && diffEntity.getRelationshipAttributes().size() == 1 && MapUtils.isEmpty(diffEntity.getAttributes()); + boolean skipAuthStarredDetailsUpdate = diffEntity != null && MapUtils.isEmpty(diffEntity.getRelationshipAttributes()) && MapUtils.isNotEmpty(diffEntity.getAttributes()) && diffEntity.getAttributes().size() == 3 && diffEntity.getAttributes().containsKey(ATTR_STARRED_BY) && diffEntity.getAttributes().containsKey(ATTR_STARRED_COUNT) && diffEntity.getAttributes().containsKey(ATTR_STARRED_DETAILS_LIST); + if (skipAuthBaseConditions && (skipAuthMeaningsUpdate || skipAuthStarredDetailsUpdate)) { + //do nothing, only diff is relationshipAttributes.meanings or starred, allow update + } else { + AtlasAuthorizationUtils.verifyUpdateEntityAccess(typeRegistry, entityHeader,"update entity: type=" + entity.getTypeName()); + } } } } diff --git a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/PreProcessor.java b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/PreProcessor.java index 730ef086bf..f0544abad4 100644 --- a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/PreProcessor.java +++ b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/PreProcessor.java @@ -23,6 +23,11 @@ public interface PreProcessor { add(DATA_PRODUCT_ENTITY_TYPE); }}; + Set skipUpdateAuthCheckTypes = new HashSet() {{ + add(DATA_DOMAIN_ENTITY_TYPE); + add(DATA_PRODUCT_ENTITY_TYPE); + }}; + void processAttributes(AtlasStruct entity, EntityMutationContext context, EntityMutations.EntityOperation operation) throws AtlasBaseException; default void processDelete(AtlasVertex vertex) throws AtlasBaseException { diff --git a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataDomainPreProcessor.java b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataDomainPreProcessor.java index b4c44b7793..1fd1c162aa 100644 --- a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataDomainPreProcessor.java +++ b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataDomainPreProcessor.java @@ -189,6 +189,9 @@ private void processUpdateDomain(AtlasEntity entity, AtlasVertex vertex) throws entity.setAttribute(QUALIFIED_NAME, vertexQnName); } + // Check if authorized to update entities + AtlasAuthorizationUtils.verifyUpdateEntityAccess(typeRegistry, new AtlasEntityHeader(entity),"update entity: type=" + entity.getTypeName()); + RequestContext.get().endMetricRecord(metricRecorder); } @@ -425,18 +428,18 @@ public void processDelete(AtlasVertex vertex) throws AtlasBaseException { Iterator childrens = getActiveChildrenVertices(vertex, DOMAIN_PARENT_EDGE_LABEL, DATA_PRODUCT_EDGE_LABEL); if (childrens.hasNext()){ - throw new AtlasBaseException("Domain cannot be archived because some subdomains or products are active in this domain"); + throw new AtlasBaseException(AtlasErrorCode.OPERATION_NOT_SUPPORTED, "Domain cannot be archived because some subdomains or products are active in this domain"); } // active stakeholder exists? childrens = getActiveChildrenVertices(vertex, STAKEHOLDER_EDGE_LABEL); if (childrens.hasNext()){ - throw new AtlasBaseException("Domain cannot be archived because some stakeholders are active in this domain"); + throw new AtlasBaseException(AtlasErrorCode.OPERATION_NOT_SUPPORTED, "Domain cannot be archived because some stakeholders are active in this domain"); } // active stakeholder titles exists? if(verifyStakeholderTitleExists(vertex.getProperty(QUALIFIED_NAME, String.class))){ - throw new AtlasBaseException("Domain cannot be archived because some stakeholdersTitles are active in this domain"); + throw new AtlasBaseException(AtlasErrorCode.OPERATION_NOT_SUPPORTED, "Domain cannot be archived because some stakeholdersTitles are active in this domain"); } } diff --git a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataProductPreProcessor.java b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataProductPreProcessor.java index d00ee9887b..e91dccb9fe 100644 --- a/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataProductPreProcessor.java +++ b/repository/src/main/java/org/apache/atlas/repository/store/graph/v2/preprocessor/datamesh/DataProductPreProcessor.java @@ -178,6 +178,9 @@ private void processUpdateProduct(AtlasEntity entity, AtlasVertex vertex) throws entity.setAttribute(QUALIFIED_NAME, vertexQnName); } + // Check if authorized to update entities + AtlasAuthorizationUtils.verifyUpdateEntityAccess(typeRegistry, new AtlasEntityHeader(entity),"update entity: type=" + entity.getTypeName()); + if (isDaapVisibilityChanged) { updateDaapVisibilityPolicy(entity, storedProduct); }