Features/generic authentication authorization

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = ["beacon-api", "beacon-arrow-netcdf", "beacon-arrow-odv", "beacon-common", "beacon-config", "beacon-core", "beacon-functions", "beacon-query", "beacon-planner", "beacon-data-lake", "beacon-formats", "beacon-arrow-zarr", "beacon-binary-format", "beacon-object-storage", "beacon-nd-arrow", "beacon-datafusion-ext", "beacon-table", "beacon-nd-array", "beacon-statistics-index", "beacon-arrow-tiff", "beacon-arrow-atlas"]
+members = ["beacon-api", "beacon-arrow-netcdf", "beacon-arrow-odv", "beacon-auth", "beacon-common", "beacon-config", "beacon-core", "beacon-functions", "beacon-query", "beacon-planner", "beacon-data-lake", "beacon-formats", "beacon-arrow-zarr", "beacon-binary-format", "beacon-object-storage", "beacon-nd-arrow", "beacon-datafusion-ext", "beacon-table", "beacon-nd-array", "beacon-statistics-index", "beacon-arrow-tiff", "beacon-arrow-atlas"]
 exclude = ["beacon-binary-format-toolbox"]
 
 [workspace.dependencies]
@@ -30,6 +30,7 @@ tracing-appender = "0.2.4"
 tracing-test = { version = "0.2.5", features = ["no-env-filter"]}
 glob = "0.3.2"
 tempfile = "3.15.0"
+rusqlite = { version = "0.32.1", features = ["bundled"] }
 typetag = "0.2.19"
 indexmap = { version = "2.7.1", features = ["serde"]}
 chrono = { version = "0.4.41", features = ["serde"] }

beacon-api/Cargo.toml

@@ -38,4 +38,8 @@ prost = "0.13.1"
 
 # Local dependencies
 beacon-config = { path = "../beacon-config" }
-beacon-core = { path = "../beacon-core" }
+beacon-core = { path = "../beacon-core" }
+
+[dev-dependencies]
+# Enable beacon-core's test-only helpers (ephemeral in-memory auth runtime) for our tests.
+beacon-core = { path = "../beacon-core", features = ["test-util"] }

beacon-api/src/auth/mod.rs

@@ -1,29 +1,14 @@
 //! Shared authentication helpers used by both the HTTP and Flight SQL transports.
+//!
+//! Credential validation is delegated to the runtime's [`beacon_auth::AuthProvider`]; these helpers
+//! only parse the wire formats (HTTP Basic, Bearer).
 
 use base64::{engine::general_purpose, Engine as _};
 
 /// Marker error for invalid or malformed authentication credentials
 #[derive(Debug, Clone, Copy)]
 pub(crate) struct AuthError;
 
-/// Validates a complete HTTP basic authorization value against configured admin credentials
-pub(crate) fn verify_basic_auth_value(auth_str: &str) -> Result<(), AuthError> {
-    let (username, password) = parse_basic_auth_credentials(auth_str)?;
-
-    if validate_basic_auth_credentials(&username, &password) {
-        Ok(())
-    } else {
-        Err(AuthError)
-    }
-}
-
-/// Compares username and password pairs against the configured admin credentials
-pub(crate) fn validate_basic_auth_credentials(username: &str, password: &str) -> bool {
-    tracing::debug!("Validating basic auth credentials for user '{}'", username);
-    username == beacon_config::CONFIG.admin.username
-        && password == beacon_config::CONFIG.admin.password
-}
-
 /// Parses a `Basic ...` authorization header into username and password components
 pub(crate) fn parse_basic_auth_credentials(auth_str: &str) -> Result<(String, String), AuthError> {
     if !auth_str.starts_with("Basic ") {

beacon-api/src/axum/admin/mod.rs

@@ -20,14 +20,19 @@ mod file;
 #[openapi(modifiers(&SecurityAddon))]
 pub struct AdminApiDoc;
 
-/// Builds the admin router and attaches basic-auth middleware.
-pub(crate) fn setup_admin_router() -> (Router<Arc<Runtime>>, utoipa::openapi::OpenApi) {
+/// Builds the admin router and attaches super-user basic-auth middleware.
+pub(crate) fn setup_admin_router(
+    beacon_runtime: Arc<Runtime>,
+) -> (Router<Arc<Runtime>>, utoipa::openapi::OpenApi) {
     let (admin_router, admin_api) = OpenApiRouter::with_openapi(AdminApiDoc::openapi())
         .routes(routes!(file::upload_file))
         .routes(routes!(file::download_handler))
         .routes(routes!(file::delete_file))
         .routes(routes!(check::check))
-        .layer(::axum::middleware::from_fn(basic_auth))
+        .layer(::axum::middleware::from_fn_with_state(
+            beacon_runtime,
+            basic_auth,
+        ))
         .layer(DefaultBodyLimit::disable())
         .split_for_parts();