Fix NPE in matchAnyCertification when entity is null

[sonika-shah]

Describe your changes:

Fixes #26875

Summary

• matchAnyCertification in RuleEvaluator threw a NullPointerException when
  ResourceContext.getEntity() returned null (e.g. Settings, Team, or list operations).
  Optional.ofNullable(resourceContext.getEntity().getCertification()) NPE'd on the
  .getCertification() call before Optional.ofNullable could do anything — Java
  evaluates the argument first.
• Added a null guard for getEntity(), consistent with isReviewer() and hasDomain()
  in the same class which already have this check.

Test plan

• Unit tests: test_matchAnyCertification_nullEntity and
  test_matchAnyCertification_nullResourceContext in RuleEvaluatorTest
• Integration test: test_matchAnyCertification_noCertificationOnEntity in
  QueryVisibilityPolicyIT — creates a policy with matchAnyCertification condition,
  assigns it to a user, then GETs a table with no certification (the exact repro path)
• All 17 RuleEvaluatorTest tests pass

Type of change:

• Bug fix
• Improvement
• New feature
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation

Checklist:

• I have read the CONTRIBUTING document.
• My PR title is Fixes <issue-number>: <short explanation>
• I have commented on my code, particularly in hard-to-understand areas.
• For JSON Schema changes: I updated the migration scripts or explained why it is not needed.

[Copilot]

Pull request overview

Fixes a NullPointerException in backend policy evaluation when matchAnyCertification is evaluated with a ResourceContext whose getEntity() is null, and adds regression coverage to prevent recurrence.

Changes:

• Add an explicit null-guard for resourceContext.getEntity() in RuleEvaluator.matchAnyCertification.
• Add unit tests covering null entity and null resource context scenarios for matchAnyCertification.
• Add an integration test intended to reproduce the policy-evaluation NPE path.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
openmetadata-service/src/main/java/org/openmetadata/service/security/policyevaluator/RuleEvaluator.java	Adds a null check for resourceContext.getEntity() before accessing certification.
openmetadata-service/src/test/java/org/openmetadata/service/security/policyevaluator/RuleEvaluatorTest.java	Adds unit tests ensuring matchAnyCertification returns false when entity/context is null.
openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/QueryVisibilityPolicyIT.java	Adds an integration test for matchAnyCertification policy evaluation regression coverage.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[gitar-bot]

Code Review ✅ Approved

Fixes null pointer exception in matchAnyCertification when entity parameter is null. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Changes have been cherry-picked to the 1.12.5 branch.