[Authorization] Support GET_METADATA topic op after enable auth

[yuruguo]

Motivation

Currently, we can get the internal stats of a topic through bin/pulsar-admin topics stats-internal tn1/ns1/tp1 and also get ledger metadata by specifying flag --metadata.

However I found that PulsarAuthorizationProvider lacks support for topic operation GET_METADATA when verifying the role's authorization, code as below:

pulsar/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/PersistentTopicsBase.java

Lines 1162 to 1164 in 08a49c0

	if (metadata) {
	validateTopicOperation(topicName, TopicOperation.GET_METADATA);
	}

pulsar/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java

Lines 567 to 596 in 08a49c0

	switch (operation) {
	case LOOKUP:
	case GET_STATS:
	isAuthorizedFuture = canLookupAsync(topicName, role, authData);
	break;
	case PRODUCE:
	isAuthorizedFuture = canProduceAsync(topicName, role, authData);
	break;
	case GET_SUBSCRIPTIONS:
	case CONSUME:
	case SUBSCRIBE:
	case UNSUBSCRIBE:
	case SKIP:
	case EXPIRE_MESSAGES:
	case PEEK_MESSAGES:
	case RESET_CURSOR:
	case SET_REPLICATED_SUBSCRIPTION_STATUS:
	isAuthorizedFuture = canConsumeAsync(topicName, role, authData, authData.getSubscription());
	break;
	case TERMINATE:
	case COMPACT:
	case OFFLOAD:
	case UNLOAD:
	case ADD_BUNDLE_RANGE:
	case GET_BUNDLE_RANGE:
	case DELETE_BUNDLE_RANGE:
	return validateTenantAdminAccess(topicName.getTenant(), role, authData);
	default:
	return FutureUtil.failedFuture(
	new IllegalStateException("TopicOperation [" + operation.name() + "] is not supported."));

The purpose of this PR is to support role with lookup topic authorization to GET_METADATA of ledger.

Documentation

• no-need-doc

[codelipenghui]

@yuruguo Could you please help add a test? The change looks good to me.

[eolivelli]

LGTM

@michaeljmarshall please take a look as you are working on this topic during these days

[yuruguo]

@yuruguo Could you please help add a test? The change looks good to me.

Okay :)
Done, PTAL

[freeznet]

LGTM

[michaeljmarshall]

LGTM. My one additional thought is that the added test is more complex than necessary, and that complexity will increase the time required to run this pretty simple test. I think there is a test Authentication Provider that would make it easier to test authorization without needing to explicitly test authentication, but I could be wrong.