[Authorization] Support UNSUBSCRIBE namespace op after enable auth

[yuruguo]

Motivation

Currently, we can unsubscribe the given subscription on all topics on a namespace through bin/pulsar-admin namespaces unsubscribe -s sub tn1/ns1. However, role(not super-user or administrator) with consume auth action for namespace cannot perform unsubscribe operation when enable auth.

The root of the problem is that PulsarAuthorizationProvider lacks support for namespace operation UNSUBSCRIBE when verifying the role's authorization, code as below:

pulsar/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java

Lines 1667 to 1669 in 8cae635

	protected void internalUnsubscribeNamespace(AsyncResponse asyncResponse, String subscription,
	boolean authoritative) {
	validateNamespaceOperation(namespaceName, NamespaceOperation.UNSUBSCRIBE);

pulsar/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java

Lines 522 to 536 in 8cae635

	public CompletableFuture<Boolean> allowNamespaceOperationAsync(NamespaceName namespaceName,
	String role,
	NamespaceOperation operation,
	AuthenticationDataSource authData) {
	CompletableFuture<Boolean> isAuthorizedFuture;
	switch (operation) {
	case PACKAGES:
	isAuthorizedFuture = allowTheSpecifiedActionOpsAsync(namespaceName, role, authData, AuthAction.packages);
	break;
	case GET_TOPICS:
	isAuthorizedFuture = allowConsumeOpsAsync(namespaceName, role, authData);
	break;
	default:
	isAuthorizedFuture = CompletableFuture.completedFuture(false);
	}

The purpose of this PR is to support that role with consume namespace authorization could unsubscribe subscriptions on a namespace.

Documentation

• no-need-doc

[eolivelli]

The change looks good

I believe that an integration test is too much heavyweight for this code.

Can we add a test somewhere in a simple unit test please ?

[yuruguo]

The change looks good

I believe that an integration test is too much heavyweight for this code.

Can we add a test somewhere in a simple unit test please ?

Okay :)
I have move the test of this PR and previous PR to pulsar-broker module, it wii be lighter.

[eolivelli]

Lgtm