RANGER-5657: Limit getAllModuleNames() to sys-admin sessions in SessionMgr

[ramackri]

Summary

Backport of 0274a6a0 / #1036 to ranger-2.9.

Follow-up fix for RANGER-5627. RANGER-5627 changed SessionMgr.resetUserModulePermission() to grant all UI modules when isUserAdmin() || isKeyAdmin(). That incorrectly gives DB key-admin users the full module list (including Security Zone) via getAllModuleNames().

Fix: use getAllModuleNames() only when userSession.isUserAdmin(). Config super-users are unaffected (they already get full admin through superUser → isUserAdmin()).

Fixes RANGER-5657.

Test plan

• mvn test -pl security-admin -Dtest=TestSessionMgr,TestRangerSuperUserConfig -Drat.skip=true -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true
• Manual: DB key-admin should not see Security Zone in profile; zone GET returns 400
• Manual: sys admin and config super-users unchanged (all modules, zone GET 200)

Made with Cursor