ATLAS-5379 : Authorize lineage neighbor entities before returning headers

[VinayakMarraiya230920]

Apply per-entity ENTITY_READ checks when building lineage guidEntityMap. Skip unauthorized neighbors and omit relations when either endpoint is not readable.

What changes were proposed in this pull request?

Problem

The lineage API (GET /api/atlas/v2/lineage/{guid}) checks ENTITY_READ on the seed entity before building lineage, but neighbor entities discovered during graph traversal were added to the response without per-entity authorization.

In EntityLineageService.processEdge():

• Input/output vertex headers were always added to guidEntityMap
• LineageRelation entries were always added for each edge

So a user authorized to read entity A could see metadata for unauthorized neighbor B (and the relation between them) in the lineage response — an authorization bypass / information disclosure.

The seed entity was already protected here:

EntityLineageService.javaLines 197-200

private boolean validateEntityTypeAndCheckIfDataSet(String guid) throws AtlasBaseException {

AtlasEntityHeader entity = entityRetriever.toAtlasEntityHeaderWithClassifications(guid);

AtlasAuthorizationUtils.verifyAccess(..., ENTITY_READ, entity), "read entity lineage: guid=", guid);

Neighbors had no equivalent check.

Fix

Updated EntityLineageService.java:

1. addEntityHeaderIfAuthorized() — loads the header and adds it to guidEntityMap only if:
   AtlasAuthorizationUtils.isAccessAllowed(

   new AtlasEntityAccessRequest(atlasTypeRegistry, AtlasPrivilege.ENTITY_READ, entityHeader))
2. Relations gated on both endpoints — a LineageRelation is added only when both inGuid and outGuid are present in guidEntityMap (both readable).
3. processEdge() refactored — uses the helper for both vertices; unauthorized neighbors are skipped; edges involving unreadable entities are omitted.

Behavior after fix

Scenario | Before fix | After fix -- | -- | -- User can read seed entity | Lineage returned | Unchanged Neighbor entity — no ENTITY_READ | Header + relation leaked | Neighbor omitted; relation omitted Both endpoints readable | Full edge shown | Unchanged

Scope: 1 file changed (EntityLineageService.java), no REST contract change, no UI changes.

How was this patch tested?

Manual (primary)
With authorization enabled (Ranger/simple authorizer) and lineage between at least two entities (A → process → B):

Setup

User A — ENTITY_READ on seed entity only
User B — owns upstream/downstream entity B; User A has no read on B
Steps

As User A, fetch lineage on entity A:

curl -u userA:passA
"http://:21000/api/atlas/v2/lineage/{guidA}?direction=BOTH&depth=3"
Before fix: Response guidEntityMap included B; relations included A↔B edge.
After fix: B absent from guidEntityMap; A↔B relation not in relations.

As User A, direct read on B (sanity check):

curl -u userA:passA
"http://:21000/api/atlas/v2/entity/guid/{guidB}/header"
Expected: 403 Forbidden.

As User B (or admin with full read), same lineage call.
Expected: Both entities and relations returned (no regression).

Repeat with direction=INPUT and direction=OUTPUT to confirm filtering in both traversal directions.

Manual (regression)
Authorized user with read on all entities in a lineage chain still gets complete graph.
Seed entity without lineage access still gets 403 at entry (unchanged).
Invalid entity type / non-dataset behavior unchanged.
Unit tests
mvn -pl repository -Dtest=EntityLineageServiceTest test
Existing tests pass (mock-based; no new auth-specific test added in this PR).

Build
mvn -pl repository -am compile -DskipTests
Compiles successfully.