Fixes #29835: make read authorization independent of the fields projection

[sonika-shah]

Describe your changes:

Fixes #29835

ResourceContext.resolveEntity() loaded the entity used for policy evaluation with the caller's fields query parameter. Any policy-relevant attribute the caller did not request read as absent, so a conditional Deny rule silently failed open — matchAnyTag returns false when tags were never loaded.

Measured on a table tagged PII.Sensitive with a DENY VIEW_ALL where matchAnyTag('PII.Sensitive') rule, as a non-admin user:

Request	Before	After
GET /v1/tables/{id}	200 — leaked	403
GET /v1/tables/{id}?fields=tags	403	403
GET /v1/tables/{id}?fields=owners	200 — leaked	403
GET /v1/tables/name/{fqn}	200 — leaked	403
untagged table, no fields	200	200

The authorization entity is now always resolved with the policy-relevant fields (owners, tags, domains, reviewers) rather than the caller-supplied projection. The response load is untouched, so response payloads are byte-identical.

Side effect: removing the projection makes the authorization read cache-eligible again — useRepositoryCache() returned false whenever requestedFields was set, so this path was previously uncached.

Scope

This closes the projection-dependence gap. It does not change column-level tag enforcement: column tags hydrate only when columns and tags are both loaded (TableRepository#setFields), which is unchanged here and tracked separately.

Type of change:

• Bug fix

High-level design:

N/A — removes a branch, no new components.

Tests:

Use cases covered

• A tag-based Deny rule is enforced on GET by id and by name regardless of the fields parameter.
• A projection that excludes tags (fields=owners) does not bypass the rule.
• An entity without the tag remains viewable — the rule does not over-block.

Unit tests

• Not applicable — covered by integration tests below.

Backend integration tests

• Added to openmetadata-integration-tests.
• File: QueryVisibilityPolicyIT#test_tagDenyPolicy_enforcedWhenFieldsParamOmitted (added to the existing tag-policy IT rather than a new file).

Ingestion integration tests

• Not applicable.

Playwright (UI) tests

• Not applicable — no UI changes.

Manual testing performed

1. Created a table tagged PII.Sensitive, a DENY VIEW_ALL policy conditioned on matchAnyTag, and a non-admin user carrying it.
2. Confirmed the table was returned without fields, and denied with fields=tags — the reported inconsistency.
3. Applied the change and confirmed all four request shapes above are denied, and an untagged table still returns 200.

UI screen recording / screenshots:

Not applicable.

Checklist:

• I have read the CONTRIBUTING document.
• My PR is linked to a GitHub issue via Fixes #29835.
• I have commented on my code, particularly in hard-to-understand areas.
• I have added tests and listed them above.

Greptile Summary

Authorization entity loading is now independent of the caller’s response projection.

• GET-by-ID and GET-by-name resource contexts no longer receive caller-requested fields.
• Policy evaluation consistently hydrates supported owners, tags, domains, and reviewers.
• Repository caching is enabled for non-mutating authorization reads.
• Integration coverage verifies tag-based deny rules with omitted, inclusive, and exclusive field projections while preserving access to untagged entities.

Confidence Score: 5/5

The PR appears safe to merge and closes the field-projection-dependent authorization gap.

Authorization now loads policy-relevant relationships independently from the response projection, while field-sensitive request caching remains isolated by field and relation keys and the response load remains separate.

Important Files Changed

Filename	Overview
openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/ResourceContext.java	Decouples authorization hydration from response fields and safely enables repository caching for GET policy resolution.
openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java	Updates GET-by-ID and GET-by-name paths to construct projection-independent authorization contexts.
openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/QueryVisibilityPolicyIT.java	Adds end-to-end coverage for tag-based deny enforcement across field projections and untagged controls.

Sequence Diagram

sequenceDiagram
  participant Client
  participant Resource as EntityResource
  participant Auth as Authorizer
  participant Context as ResourceContext
  participant Repo as EntityRepository
  Client->>Resource: "GET entity?fields=<projection>"
  Resource->>Auth: authorize(operation, resource context)
  Auth->>Context: resolve policy entity
  Context->>Repo: load owners/tags/domains/reviewers
  Repo-->>Context: policy-complete entity
  Context-->>Auth: authorization attributes
  Auth-->>Resource: allow or deny
  alt allowed
    Resource->>Repo: load requested response projection
    Repo-->>Client: projected entity
  else denied
    Resource-->>Client: 403 Forbidden
  end

Loading

_{Reviews (1): Last reviewed commit: "fix(security): make read authorization i..." | Re-trigger Greptile}

Context used:

• Knowledge Base — OpenMetadata Service Core: Entities, Resources, Repositories
• Knowledge Base — Auth and Security: Authentication, Authorization, Secrets, and SCIM

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• Issue REST API authorization bypasses tag-based Deny policies when entity metadata is not loaded #29835 is missing Shipping → Source.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

Makes read authorization independent of the caller's fields projection by resolving policy entities with all required attributes, preventing conditional deny rules from failing open. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar | Powered by Gitar — free for open source}

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud