iceberg_catalog_rest/auth/
mod.rs

1// Licensed to the Apache Software Foundation (ASF) under one
2// or more contributor license agreements.  See the NOTICE file
3// distributed with this work for additional information
4// regarding copyright ownership.  The ASF licenses this file
5// to you under the Apache License, Version 2.0 (the
6// "License"); you may not use this file except in compliance
7// with the License.  You may obtain a copy of the License at
8//
9//   http://www.apache.org/licenses/LICENSE-2.0
10//
11// Unless required by applicable law or agreed to in writing,
12// software distributed under the License is distributed on an
13// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14// KIND, either express or implied.  See the License for the
15// specific language governing permissions and limitations
16// under the License.
17
18//! Pluggable authentication for the REST catalog, mirroring Iceberg Java's
19//! `AuthManager`/`AuthSession` API.
20
21mod oauth2;
22
23use std::collections::HashMap;
24use std::fmt::Debug;
25use std::sync::Arc;
26
27use async_trait::async_trait;
28use iceberg::Result;
29pub use oauth2::OAuth2Manager;
30
31use crate::client::HttpClient;
32use crate::request::HttpRequest;
33
34/// `rest.auth.type` value disabling authentication.
35pub const AUTH_TYPE_NONE: &str = "none";
36/// `rest.auth.type` value selecting OAuth2 token authentication.
37pub const AUTH_TYPE_OAUTH2: &str = "oauth2";
38
39/// Creates the [`AuthSession`]s used to authenticate REST catalog requests.
40///
41/// A manager is exclusively scoped to one catalog and must not be reused by
42/// other catalogs. It is either created from the `rest.auth.type` property or
43/// injected through
44/// [`RestCatalogBuilder::with_auth_manager`](crate::RestCatalogBuilder::with_auth_manager) or
45/// [`RestSessionCatalogBuilder::with_auth_manager`](crate::RestSessionCatalogBuilder::with_auth_manager).
46/// Catalog initialization calls [`AuthManager::catalog_session`] exactly once;
47/// later sessions may rely on the state established by that call.
48///
49/// Both methods are handed the catalog's [`HttpClient`], which an
50/// implementation may reuse for its own requests (e.g. a token exchange) so
51/// that they share the catalog's connection pool and configuration.
52#[async_trait]
53pub trait AuthManager: Debug + Send + Sync {
54    /// Session used for the initial `/v1/config` handshake, given the
55    /// user-supplied properties.
56    ///
57    /// Returns a [`Box`]: an init session is used once and released, unlike
58    /// the shared [`AuthManager::catalog_session`].
59    async fn init_session(
60        &self,
61        client: &HttpClient,
62        props: &HashMap<String, String>,
63    ) -> Result<Box<dyn AuthSession>>;
64
65    /// Session used for all subsequent catalog requests, given the properties
66    /// merged from the user configuration and the server's config response.
67    ///
68    /// Returns an [`Arc`]: this session is shared by concurrent requests for
69    /// the rest of the catalog's lifetime. Implementations may carry state
70    /// (e.g. a cached token) over from the init session.
71    async fn catalog_session(
72        &self,
73        client: &HttpClient,
74        props: &HashMap<String, String>,
75    ) -> Result<Arc<dyn AuthSession>>;
76}
77
78/// Authenticates outgoing REST catalog requests.
79#[async_trait]
80pub trait AuthSession: Debug + Send + Sync {
81    /// Applies authentication to the request (adds headers, signs, ...).
82    async fn authenticate(&self, request: &mut HttpRequest) -> Result<()>;
83}
84
85/// [`AuthManager`] that performs no authentication.
86#[derive(Debug)]
87pub struct NoopAuthManager;
88
89/// [`AuthSession`] that performs no authentication.
90#[derive(Debug)]
91pub(crate) struct NoopSession;
92
93#[async_trait]
94impl AuthManager for NoopAuthManager {
95    async fn init_session(
96        &self,
97        _client: &HttpClient,
98        _props: &HashMap<String, String>,
99    ) -> Result<Box<dyn AuthSession>> {
100        Ok(Box::new(NoopSession))
101    }
102
103    async fn catalog_session(
104        &self,
105        _client: &HttpClient,
106        _props: &HashMap<String, String>,
107    ) -> Result<Arc<dyn AuthSession>> {
108        Ok(Arc::new(NoopSession))
109    }
110}
111
112#[async_trait]
113impl AuthSession for NoopSession {
114    async fn authenticate(&self, _request: &mut HttpRequest) -> Result<()> {
115        Ok(())
116    }
117}
iceberg_catalog_rest/auth/mod.rs

iceberg_catalog_rest/auth/
mod.rs
