HDDS-15853. Fix Ranger ACL validation for lifecycle requests

[priyeshkaratha]

What changes were proposed in this pull request?

Lifecycle configuration set and delete requests previously called checkAcls(...) with ACLType.ALL unconditionally whenever ACLs were enabled. This does not map correctly onto Ranger-based (non-native) authorization: Ranger policies are expressed in terms of the standard S3/Ozone access types, and demanding ALL on the bucket is both incorrect and stricter than intended for these operations.

This PR splits the permission check into a dedicated checkAclPermission(...) helper in both OMLifecycleConfigurationSetRequest and OMLifecycleConfigurationDeleteRequest:

• Native authorizer: enforce that the caller is either a cluster admin or the bucket owner. Otherwise, the request fails with PERMISSION_DENIED and a clear message ("Lifecycle configuration can only be set/deleted by bucket Admin or Owner").
• Non-native authorizer (e.g. Ranger): delegate to checkAcls(...) requiring ACLType.WRITE on the bucket, which is the appropriate access type for mutating bucket-level configuration and validates correctly against Ranger policies.

This keeps the two authorization models consistent with how the rest of the OM performs bucket-level permission checks and fixes Ranger ACL validation for lifecycle requests.

What is the link to the Apache JIRA

HDDS-15853

How was this patch tested?

Tested manually using ranger integation

[ChenSammi]

@priyeshkaratha , I will check it later. BTW, could you move the ACL check in OMLifecycleSetServiceStatusRequest to preExecute too in this patch?

[Copilot]

Pull request overview

Adjusts OM lifecycle configuration authorization to correctly validate permissions under non-native authorizers (eg. Ranger) while preserving the existing native-authorization behavior patterns used for other bucket-level mutations.

Changes:

• Replace unconditional ACLType.ALL bucket ACL checks with a dedicated checkAclPermission(...) helper for lifecycle set/delete.
• Native authorizer path: allow only cluster admin or bucket owner; non-native path: require ACLType.WRITE on the bucket.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationSetRequest.java	Switch lifecycle-set authorization to native admin/owner check vs non-native WRITE ACL check.
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationDeleteRequest.java	Switch lifecycle-delete authorization to native admin/owner check vs non-native WRITE ACL check.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ChenSammi]

Thanks @priyeshkaratha , LGTM.