Pulsar Function Authorization

After Pulsar Function Authentication is implemented, we also need to implement the authorization model for functions.

I propose we add the following methods to the AuthorizationProvider (https://github.com/apache/pulsar/blob/master/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationProvider.java) interface:

/**
* Allow all function operations with in this namespace
* @param namespaceName The namespace that the function operations can be executed in
* @param role The role to check
* @param authenticationData authentication data related to the role
* @return a boolean to determine whether authorized or not
*/
CompletableFuture<Boolean> allowFunctionOps(NamespaceName namespaceName, String role,
                                           AuthenticationDataSource authenticationData);

We should also add an action to AuthAction for functions:

public enum AuthAction {
   /** Permission to produce/publish messages */
   produce,

   /** Permission to consume messages */
   consume,
  
   /** Permissions for functions ops **/
   functions,
}

And admins and tenant admins can grant the permission “functions” to users for a namespace and they can perform all function operations(create, update, delete, get) within that namespace.

I also think if a user has the permissions to perform all function operations within a namespace, he or she should also be able to consume and produce to a any topic within that namespace

[jerrypeng]

@sijie I propose that if a user has the permissions to CRUD functions in a namespace, he or she should automatically also be able to consume and produce messages to any topic in that namespace as well.

[jerrypeng]

@rdhabalia would there be a problem storing the function authorization data in zk? It will be basically the same as the other authorization data right? I would rather not complicate the implementation and store the function specific authorization data somewhere else.