ATLAS-5372: Prevent cross-user overwrite in saved search create API v…

[chaitalicod]

…ia caller-supplied guid

What changes were proposed in this pull request?

PreRequisites
Two authenticated users with permissions to use saved-search APIs (for example: userA, userB).

Steps
Login as userA and create a saved search using:

POST /api/atlas/v2/search/saved
capture the returned guid (call it G1).
Login as userB and send another create request to:

POST /api/atlas/v2/search/saved
include:
ownerName = userB
guid = G1
different name / searchParameters.

Fetch saved searches for both users:
GET /api/atlas/v2/search/saved?user=userB
GET /api/atlas/v2/search/saved?user=userA

Observed Result
The object with guid = G1 now appears under userB with updated content.
userA no longer has that saved search entry with G1.

Expected Result
Create API should not allow client-supplied guid to update an existing saved-search object owned by another user.
POST create should either reject non-empty guid or ignore it and always create a new object

How was this patch tested?

Ran tests
ATLAS="http://localhost:21000/api/atlas/v2/search"
U1="admin:admin"
U2="bob:bob123"
TS=$(date +%s)

ADMIN_NAME="admin-search-$TS"
BOB_NAME="bob-search-$TS"

ADMIN_CREATE=$(curl -sS -u "$U1" -H "Content-Type: application/json"
-X POST "$ATLAS/saved" --data @- <<EOF
{
"guid":"",
"name":"$ADMIN_NAME",
"ownerName":"admin",
"searchType":"BASIC",
"searchParameters":{"typeName":"hive_table","excludeDeletedEntities":true}
}
EOF
)

echo "$ADMIN_CREATE" | jq .
ADMIN_GUID=$(echo "$ADMIN_CREATE" | jq -r '.guid')
echo "ADMIN_GUID=$ADMIN_GUID"

BOB_OVERWRITE=$(curl -sS -u "$U2" -H "Content-Type: application/json"
-X POST "$ATLAS/saved" --data @- <<EOF
{
"guid":"$ADMIN_GUID",
"name":"$BOB_NAME",
"ownerName":"bob",
"searchType":"BASIC",
"searchParameters":{"typeName":"hive_table","excludeDeletedEntities":true}
}
EOF
)

echo "$BOB_OVERWRITE" | jq .
{
"guid": "6baabe6d-00c3-4e84-8481-4a67fa74f572",
"ownerName": "admin",
"name": "admin-search-1786438863",
"searchType": "BASIC",
"searchParameters": {
"typeName": "hive_table",
"excludeDeletedEntities": true,
"includeClassificationAttributes": false,
"includeSubTypes": true,
"includeSubClassifications": true,
"excludeHeaderAttributes": false,
"limit": 0,
"offset": 0
}
}
ADMIN_GUID=6baabe6d-00c3-4e84-8481-4a67fa74f572
{
"errorCode": "ATLAS-400-00-029",
"errorMessage": "invalid data"
}