ATLAS-5365: Missing SERVICE_NOTIFICATION_POST authorization on rest-notification NotificationREST POST /topic/{topicName}.

[UmeshPatil-1]

What changes were proposed in this pull request?

Problem

The rest-notification-webapp module (introduced in ATLAS-5207) exposes
POST /api/atlas/v2/notification/topic/{topicName} on port 41000 as a headless REST side door for hook messages to Kafka.

The main webapp NotificationREST already enforces SERVICE_NOTIFICATION_POST via AtlasAuthorizationUtils.verifyAccess(), but the rest-notification copy did not. This allowed any authenticated read-only user (e.g. rangertagsync / DATA_SCIENTIST) to POST hook messages (including ENTITY_CREATE_V2) to ATLAS_HOOK, bypassing the authorization enforced on port 21000.

Additionally, when authorization or validation exceptions were thrown on the rest server, responses were returned as HTTP 500 HTML (Jetty default) instead of the structured JSON error bodies returned by the main webapp (e.g. ATLAS-403-00-001).

Solution

This PR addresses both issues:

1. CVE authorization fix (rest-notification)

File: rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/rest/NotificationREST.java

Added the same authorization check as the main webapp:

AtlasAuthorizationUtils.verifyAccess(
    new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST),
    "post on rest notification service");

Effect: Read-only users are denied before the message is published to Kafka. Admin users can still POST (HTTP 204).

---

2. Shared Jersey exception mappers (server-common)

Moved the following classes from webapp/src/main/java/org/apache/atlas/web/errors/ to
server-common/src/main/java/org/apache/atlas/server/common/errors/:

Class	Purpose
AtlasBaseExceptionMapper	Maps AtlasBaseException → JSON (403, 404, 400, etc.)
AllExceptionMapper	Catch-all for unexpected exceptions → HTTP 500
NotFoundExceptionMapper	JAX-RS path-not-found → HTTP 404
ExceptionMapperUtil	Shared response-building utilities

File: server-common/pom.xml

Added jersey-server dependency (in addition to existing jersey-core) so mapper classes compile in server-common — they implement javax.ws.rs.ext.ExceptionMapper from jersey-server.

File: webapp/src/test/java/org/apache/atlas/web/errors/*

Updated imports to reference org.apache.atlas.server.common.errors.*. Tests remain in webapp module (existing Atlas pattern). Added testUnauthorizedAccessResponse() in AtlasBaseExceptionMapperTest for ATLAS-403-00-001 coverage.

---

ExceptionMapperUtil methods changed from protected to public to allow cross-package test access from webapp tests.

How was this patch tested?

Build

mvn clean install -DskipITs=true
Result: BUILD SUCCESS. All modules including server-common, webapp, rest-notification-webapp.

Unit tests

Result: Exception mapper unit tests in webapp pass with updated imports from server-common.

---

Security test results (Tests A–G)

Test	Description	Expected	Actual	Pass?
A	Read-only → rest POST /notification/topic/ATLAS_HOOK	403 JSON	403 ATLAS-403-00-001	Pass
B	Admin → rest POST	204	204	Pass
C	Read-only → webapp POST	403 JSON	403 ATLAS-403-00-001	Pass
D	Entity absent after blocked POST (Test A)	404 JSON	404 ATLAS-404-00-009	Pass
E	Admin entity after allowed POST (Test B)	200 or 404	404 (consumer timing)	Pass
F	Unauthenticated → rest POST	401	401	Pass
G	Invalid topic → rest POST	400 JSON	400 ATLAS-400-00-101	Pass

---

Related

• JIRA: ATLAS-5207
• PR: ATLAS-5207: Atlas webapp module to support rest-notification endpoint #622 (rest-notification infrastructure)
• Security context: Nixon CVE — missing authorization on rest-notification notification POST endpoint

[pareshddevalia]

LGTM

[nixonrodrigues]

+1