iceberg_catalog_rest/auth/
mod.rs

1// Licensed to the Apache Software Foundation (ASF) under one
2// or more contributor license agreements.  See the NOTICE file
3// distributed with this work for additional information
4// regarding copyright ownership.  The ASF licenses this file
5// to you under the Apache License, Version 2.0 (the
6// "License"); you may not use this file except in compliance
7// with the License.  You may obtain a copy of the License at
8//
9//   http://www.apache.org/licenses/LICENSE-2.0
10//
11// Unless required by applicable law or agreed to in writing,
12// software distributed under the License is distributed on an
13// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14// KIND, either express or implied.  See the License for the
15// specific language governing permissions and limitations
16// under the License.
17
18//! Pluggable authentication for the REST catalog, mirroring Iceberg Java's
19//! `AuthManager`/`AuthSession` API.
20
21mod oauth2;
22
23use std::collections::HashMap;
24use std::fmt::Debug;
25use std::sync::Arc;
26
27use async_trait::async_trait;
28use iceberg::Result;
29pub use oauth2::OAuth2Manager;
30
31use crate::client::HttpClient;
32use crate::request::HttpRequest;
33
34/// `rest.auth.type` value disabling authentication.
35pub const AUTH_TYPE_NONE: &str = "none";
36/// `rest.auth.type` value selecting OAuth2 token authentication.
37pub const AUTH_TYPE_OAUTH2: &str = "oauth2";
38
39/// Creates the [`AuthSession`]s used to authenticate REST catalog requests.
40///
41/// A manager is created once per catalog, either from the `rest.auth.type`
42/// property or injected through
43/// [`RestCatalogBuilder::with_auth_manager`](crate::RestCatalogBuilder::with_auth_manager) or
44/// [`RestSessionCatalogBuilder::with_auth_manager`](crate::RestSessionCatalogBuilder::with_auth_manager).
45/// It builds the sessions the catalog then keeps.
46///
47/// Both methods are handed the catalog's [`HttpClient`], which an
48/// implementation may reuse for its own requests (e.g. a token exchange) so
49/// that they share the catalog's connection pool and configuration.
50#[async_trait]
51pub trait AuthManager: Debug + Send + Sync {
52    /// Session used for the initial `/v1/config` handshake, given the
53    /// user-supplied properties.
54    ///
55    /// Returns a [`Box`]: an init session is used once and released, unlike
56    /// the shared [`AuthManager::catalog_session`].
57    async fn init_session(
58        &self,
59        client: &HttpClient,
60        props: &HashMap<String, String>,
61    ) -> Result<Box<dyn AuthSession>>;
62
63    /// Session used for all subsequent catalog requests, given the properties
64    /// merged from the user configuration and the server's config response.
65    ///
66    /// Returns an [`Arc`]: this session is shared by concurrent requests for
67    /// the rest of the catalog's lifetime. Implementations may carry state
68    /// (e.g. a cached token) over from the init session.
69    async fn catalog_session(
70        &self,
71        client: &HttpClient,
72        props: &HashMap<String, String>,
73    ) -> Result<Arc<dyn AuthSession>>;
74}
75
76/// Authenticates outgoing REST catalog requests.
77#[async_trait]
78pub trait AuthSession: Debug + Send + Sync {
79    /// Applies authentication to the request (adds headers, signs, ...).
80    async fn authenticate(&self, request: &mut HttpRequest) -> Result<()>;
81}
82
83/// [`AuthManager`] that performs no authentication.
84#[derive(Debug)]
85pub struct NoopAuthManager;
86
87/// [`AuthSession`] that performs no authentication.
88#[derive(Debug)]
89pub(crate) struct NoopSession;
90
91#[async_trait]
92impl AuthManager for NoopAuthManager {
93    async fn init_session(
94        &self,
95        _client: &HttpClient,
96        _props: &HashMap<String, String>,
97    ) -> Result<Box<dyn AuthSession>> {
98        Ok(Box::new(NoopSession))
99    }
100
101    async fn catalog_session(
102        &self,
103        _client: &HttpClient,
104        _props: &HashMap<String, String>,
105    ) -> Result<Arc<dyn AuthSession>> {
106        Ok(Arc::new(NoopSession))
107    }
108}
109
110#[async_trait]
111impl AuthSession for NoopSession {
112    async fn authenticate(&self, _request: &mut HttpRequest) -> Result<()> {
113        Ok(())
114    }
115}
iceberg_catalog_rest/auth/mod.rs

iceberg_catalog_rest/auth/
mod.rs
