Fix NPE on null user in RP code path

[DarshitChanpura]

Description

Resolves NPE thrown when user is null and RP code path is executed:

[2025-11-12T20:39:52,966][WARN ][r.suppressed             ][15e5649158172924e763e324589e0541] path: /_plugins/_ml/models/_register, params: {}
java.lang.NullPointerException: Cannot invoke "org.opensearch.commons.authuser.User.getName()" because "user" is null
    at org.opensearch.ml.helper.ModelAccessControlHelper.lambda$validateModelGroupAccess$4(ModelAccessControlHelper.java:184)
    at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)
    at org.opensearch.security.resources.ResourceAccessHandler.lambda$hasPermission$0(ResourceAccessHandler.java:185)
    at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)
    at org.opensearch.security.resources.ResourceSharingIndexHandler.lambda$fetchSharingInfo$24(ResourceSharingIndexHandler.java:579)
    at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)
    at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)
    at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)
    at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:298)
    at org.opensearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:284)
    at org.opensearch.security.transport.SecurityInterceptor$RestoringTransportResponseHandler.handleResponse(SecurityInterceptor.java:430)
    at org.opensearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1587)
    at org.opensearch.transport.TransportService$DirectResponseChannel.processResponse(TransportService.java:1680)
    at org.opensearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1660)
    at org.opensearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:72)
    at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:62)
    at org.opensearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:45)
    at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74)
    at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89)
    at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:984)
    at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
    at java.base/java.lang.Thread.run(Thread.java:1583)

We are updating migrate API such that all resources with no owners will now have a "default_owner" to be supplied upon calling migrate API.
(opensearch-project/security#5789)

These resources will not have public access by default. Instead will have to be shared publicly.

Related Issues

Check List

• New functionality includes testing.
• New functionality has been documented.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[brianf-aws]

Thank you for providing the fix! Do we need any backport labels?

Lets also monitor the CI.

[ylwu-amzn]

If user is null and model group is public, does the user have access or not ?

[DarshitChanpura]

no.. null users are not granted access..

if you are talking from anonymous user login perspective then yes since anonymous users can access resource in two ways:

1. Resource is shared with anonymous user or backend role (https://github.com/opensearch-project/security/blob/9e6047f99da4df3404e2d52f3afe4e49e508c3a5/src/main/java/org/opensearch/security/auth/BackendRegistry.java#L480)
2. Resource is marked as public by following the new convention (https://github.com/opensearch-project/security/blob/main/RESOURCE_SHARING_AND_ACCESS_CONTROL.md#example-publicly-shared-resource)