[fix][security] Fix grant all permissions but can't list topic.

[Technoboy-]

Fixes #14191

Master Issue: #14191

Motivation

As #14191 described, users may get confused about the current permission.
First, we only define the below actions in the grant-permission interface:

produce,consume,sources,sinks,functions,packages

Though we grant all the actions to some roles like below (myuser is not admin, only a normal user):

$ pulsar-admin namespaces grant-permission public/default --role myuser --actions produce,consume,sources,sinks,functions,packages

But when we list topics under a namespace:

$ pulsar-admin --admin-url https://dev.pulsar.xyz.com:8081 --auth-plugin "org.apache.pulsar.client.impl.auth.AuthenticationToken" --auth-params "token:<token>" topics list public/default

We will get the below error message :

HTTP 403 : Unauthorized to validateNamespaceOperation for operation [GET_BUNDLE] on namespace [mytenant/np1]

Because when listing topics, we will search all the topics including non-persistent topics which will validate GET_BUNDLE operation, but we don't have this action in auth action, and it's not good to add to AuthAction, for it's duplicate with NamespaceOperation. So we'd better map this to consume operation to solve the problem.

Documentation

• no-need-doc
  (Please explain why)

[github-actions]

@Technoboy-:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

[nicoloboschi]

@Technoboy- the patch doesn't apply cleanly to 2.10. Would you mind to provide it in another pull?

[Technoboy-]

@Technoboy- the patch doesn't apply cleanly to 2.10. Would you mind to provide it in another pull?

Ok.

[BewareMyPower]

@Technoboy- Could you create another PR to migrate this PR to branch-2.8? The allowNamespaceOperationAsync method is very different in branch-2.8.

pulsar/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java

Lines 530 to 555 in bb8c945

	public CompletableFuture<Boolean> allowNamespaceOperationAsync(NamespaceName namespaceName,
	String role,
	NamespaceOperation operation,
	AuthenticationDataSource authData) {
	CompletableFuture<Boolean> isAuthorizedFuture;
	switch (operation) {
	case PACKAGES:
	isAuthorizedFuture = allowTheSpecifiedActionOpsAsync(namespaceName, role, authData, AuthAction.packages);
	break;
	case GET_TOPICS:
	case UNSUBSCRIBE:
	case CLEAR_BACKLOG:
	isAuthorizedFuture = allowTheSpecifiedActionOpsAsync(namespaceName, role, authData, AuthAction.consume);
	break;
	default:
	isAuthorizedFuture = CompletableFuture.completedFuture(false);
	}
	CompletableFuture<Boolean> isTenantAdminFuture = validateTenantAdminAccess(namespaceName.getTenant(), role, authData);
	return isTenantAdminFuture.thenCombine(isAuthorizedFuture, (isTenantAdmin, isAuthorized) -> {
	if (log.isDebugEnabled()) {
	log.debug("Verify if role {} is allowed to {} to topic {}: isTenantAdmin={}, isAuthorized={}",
	role, operation, namespaceName, isTenantAdmin, isAuthorized);
	}
	return isTenantAdmin || isAuthorized;
	});
	}