ATLAS-5377: Remove duplicate NotificationREST endpoint from webapp

[UmeshPatil-1]

What changes were proposed in this pull request?

This PR delivers ATLAS-5377 in two coordinated parts:

1. Consolidate hook REST notification ingress on rest-notification-webapp (:41000/rest) and remove the duplicate endpoint from the Atlas webapp (:21000).
2. Replace admin-level notification authorization with topic-scoped POST_NOTIFICATION authorization using AtlasNotificationRequest.

Background

Previously, hooks could POST notification messages to two URLs:

Endpoint	URL
webapp (duplicate)	POST http://<host>:21000/api/atlas/v2/notification/topic/{topicName}
REST notification server (canonical)	POST http://<host>:41000/rest/api/atlas/v2/notification/topic/{topicName}

This PR removes the duplicate ingress on port 21000 and ensures hook clients target 41000/rest only.

Authorization gap

The REST notification endpoint previously authorized POST using an admin-level privilege (SERVICE_NOTIFICATION_POST via AtlasAdminAccessRequest). The {topicName} path parameter was used for Kafka routing but not for authorization.

This PR introduces topic-scoped authorization:

Concept	Value
Resource type	notification-topic
Privilege	post-notification (POST_NOTIFICATION)
Request type	AtlasNotificationRequest(action, topicName)
Policy section	notificationPermissions in atlas-simple-authz-policy.json

Changes

Part A — ATLAS-5377: Single ingress + fail-fast client (4af1c26)

1. Remove duplicate endpoint from webapp

• Deleted webapp/src/main/java/org/apache/atlas/web/rest/NotificationREST.java
• Hook POST to :21000/api/atlas/v2/notification/topic/{topicName} is no longer served
• Canonical endpoint remains in rest-notification-webapp (unchanged)

2. RestNotification client fail-fast

• Modified notification/src/main/java/org/apache/atlas/notification/rest/RestNotification.java
• Removed silent fallbacks to:
  • atlas.rest.address (main webapp, port 21000)
  • DEFAULT_ATLAS_URL (http://localhost:31000/)
• If atlas.hook.rest.notification.address is not configured when REST notification is enabled, throws AtlasException at startup with an actionable message
• Uses AtlasConfiguration.NOTIFICATION_HOOK_REST_ADDRESS.getPropertyName() instead of a hardcoded property string

3. AtlasConstants

• Added DEFAULT_REST_NOTIFICATION_ADDRESS = "http://localhost:41000/rest" for error-message guidance
• Retained DEFAULT_ATLAS_REST_ADDRESS = "http://localhost:21000" for the main metadata REST API (unchanged purpose)

4. Unit tests

• Updated notification/src/test/java/org/apache/atlas/notification/RestNotificationTest.java
• Replaced fallback tests with fail-fast tests (missing address, blank address, only atlas.rest.address configured)
• Added test for exception message content

Part B — Topic-scoped notification authorization (3abee88)

5. New authorization request model

File	Change
authorization/.../AtlasNotificationRequest.java	New — carries POST_NOTIFICATION + topicName; resource type notification-topic
authorization/.../AtlasAuthorizeConstants.java	New — NOTIFICATION_TOPIC_RESOURCE_TYPE, legacy privilege constant for migration docs

6. Authorizer contract and implementations

File	Change
authorization/.../AtlasAuthorizer.java	Added isAccessAllowed(AtlasNotificationRequest) default method (deny-by-default)
authorization/.../AtlasNoneAuthorizer.java	Override returns true when auth is disabled
authorization/.../AtlasSimpleAuthorizer.java	Implements topic + privilege matching via notificationPermissions
authorization/.../AtlasAuthorizationUtils.java	Added verifyAccess / isAccessAllowed overloads for AtlasNotificationRequest

7. Privilege rename

File	Change
authorization/.../AtlasPrivilege.java	Replaced SERVICE_NOTIFICATION_POST → POST_NOTIFICATION (post-notification)

8. Simple authorizer policy model and JSON

File	Change
authorization/.../AtlasSimpleAuthzPolicy.java	Added notificationPermissions + AtlasNotificationPermission inner class
authorization/src/main/resources/atlas-simple-authz-policy.json	Added notificationPermissions, HIVE_HOOK_SERVICE role, hivehook user
authorization/src/test/resources/atlas-simple-authz-policy.json	Same policy updates for unit tests
distro/src/conf/atlas-simple-authz-policy.json	Same policy updates for shipped default config

9. REST notification endpoint enforcement

• Modified rest-notification-webapp/.../NotificationREST.java

• Authorization changed from:

  verifyAccess(new AtlasAdminAccessRequest(SERVICE_NOTIFICATION_POST), ...)

  to:

  verifyAccess(new AtlasNotificationRequest(POST_NOTIFICATION, topicName), ...)

10. Unit tests (authorization module)

• Updated authorization/.../AtlasSimpleAuthorizerTest.java
• Added 4 tests: resource type, admin wildcard, deny without permission, topic-scoped allow/deny (hivehook → ATLAS_HOOK yes, ATLAS_ENTITIES no)

---

Authorization behavior (after this PR)

User	Topic	HTTP	Reason
admin	ATLAS_HOOK	204	ROLE_ADMIN wildcard notificationPermissions
admin	ATLAS_ENTITIES	204	Admin wildcard
hivehook	ATLAS_HOOK	204	HIVE_HOOK_SERVICE scoped to ATLAS_HOOK
hivehook	ATLAS_ENTITIES	403	Role not permitted for this topic
rangertagsync	ATLAS_HOOK	403	No notificationPermissions on role
Wrong password	any	401	Spring Security
Invalid topic name	—	400	Topic validation (unchanged)

Ranger deployments (follow-up — not in this PR)

Ranger integration requires a separate notification-topic service definition and policies in the Ranger Atlas plugin repository. This PR prepares the Atlas-side API (AtlasNotificationRequest, POST_NOTIFICATION, resource type constant) but does not include Ranger policy or plugin changes.

Breaking change / migration

Operators using REST hook mode must configure:

atlas.hook.rest.notification.enabled=true
atlas.hook.rest.notification.address=http://<rest-host>:41000/rest
atlas.rest.basic.auth.username=<user>
atlas.rest.basic.auth.password=<password>

Hooks must not POST to :21000 — that endpoint is removed.

References

• ATLAS-4335, ATLAS-5207 (rest-notification-webapp infrastructure)

How was this patch tested?

Unit tests

mvn clean install -DskipITs=true -Dcheckstyle.skip=false -Drat.skip=true
mvn -pl common install -DskipTests -Drat.skip=true
mvn -pl notification test -Dtest=RestNotificationTest -Drat.skip=true

Result: Tests run, Failures: 0, Errors: 0, Skipped: 0 — BUILD SUCCESS

Manual tests (Local + Docker)

Test	Command / check	Expected	Result
Main Atlas health	GET .../21000/api/atlas/admin/version	HTTP 200	PASS
REST server health	GET .../41000/rest/api/atlas/admin/status	HTTP 200	PASS
Canonical ingress	POST .../41000/rest/.../ATLAS_HOOK (admin)	HTTP 204	PASS
Duplicate removed	POST .../21000/api/.../ATLAS_HOOK (admin)	HTTP 500 + NotFoundException in log	PASS
Auth enforced	Wrong password on :41000	HTTP 401	PASS
Least privilege	rangertagsync POST ATLAS_HOOK	HTTP 403	PASS
Topic-scoped allow	hivehook POST ATLAS_HOOK	HTTP 204	PASS
Topic-scoped deny	hivehook POST ATLAS_ENTITIES	HTTP 403	PASS
Admin wildcard	admin POST ATLAS_ENTITIES	HTTP 204	PASS

---

UI changes

None — no UI changes in this PR

---

References

• Related: ATLAS-4335, ATLAS-5207, ATLAS-5377 (rest-notification-webapp infrastructure)

---

[chaitalicod]

@UmeshPatil-1 Did you check this on docker ?

[UmeshPatil-1]

@UmeshPatil-1 Did you check this on docker ?

yes