Authentication & role-based access control

[robinskil]

Summary

Adds authentication and role-based access control to Beacon: roles with grants on tables and dataset paths (globs), a single config-defined super-user, and pluggable authentication (local username/password + OIDC). All enforcement is opt-in and off by default, so existing deployments are unaffected until BEACON_AUTH_ENFORCE=true.

Built from scratch, modeled on the old #221 but adapted to the current codebase.

Model

• One super-user, config-only. Defined solely by BEACON_ADMIN_USERNAME / BEACON_ADMIN_PASSWORD, checked directly at auth time (constant-time, Basic-only). It is not a stored user or role, so it cannot be created, changed, duplicated, or spoofed (OIDC bearer is never super) through SQL.
• All SQL-created roles/users are read-only and never super. GRANT/DENY accept only SELECT; write + auth-management is reserved to the super-user.
• Roles hold grant/deny rules (Privilege × Table | Path-glob | All), evaluated deny-wins, default-deny, with segment-aware path globs (example/* ≠ example_2/..., ** crosses /).
• Beacon owns authorization; the IdP only supplies identity + role names.

What's included

• beacon-auth crate: role model, Credential/AuthProvider/UserDirectory traits, AuthContext/AuthIdentity, argon2 passwords, providers — BasicAuthProvider (in-memory), SqliteAuthProvider/SqliteStore (persistent), OidcAuthProvider (JWT/JWKS, configurable claims), CompositeAuthProvider (Basic→local, Bearer→OIDC).
• Runtime: run_query/explain_* take an AuthIdentity; read enforcement in statement_plan/authz.rs (walks TableScans → table/path targets, requires SELECT); writes/DDL keep the super-user gate.
• SQL surface: CREATE/DROP USER/ROLE, GRANT ROLE … TO USER, GRANT/DENY <priv> [ON TABLE t | ON PATH 'glob' | ON ALL] TO ROLE, REVOKE [DENY] … FROM ROLE (super-user only).
• Transports: resolve_identity HTTP middleware (Basic/Bearer → identity), super-user-gated admin routes; Flight SQL resolves identity via the runtime.
• Config: AuthConfig{anonymous_enabled, enforce}, OidcConfig. New pinned deps: rusqlite, jsonwebtoken, reqwest (rustls), argon2.

Config

BEACON_AUTH_ENFORCE=true            # enable read authorization (default false)
BEACON_AUTH_ANONYMOUS_ENABLED=true  # seed the anonymous (read-only) user
BEACON_OIDC_ENABLED=true            # + _ISSUER / _JWKS_URL / _AUDIENCE / _ROLES_CLAIM / _USERNAME_CLAIM

Example:

CREATE ROLE reader;
GRANT SELECT ON PATH 'argo/**/*.nc' TO ROLE reader;
DENY  SELECT ON PATH 'argo/restricted/*' TO ROLE reader;
CREATE USER alice WITH PASSWORD '…';
GRANT ROLE reader TO USER alice;

Tests

Full workspace suite green (671 passed, 0 failed). New coverage:

• beacon-auth unit tests — role eval, deny-wins, segment-aware globs, argon2, SQLite persist/reload, OIDC claim mapping, composite routing, super-user-is-config-only.
• beacon-core/tests/auth.rs — runtime end-to-end: authn (admin/anon/wrong-password/bearer), lifecycle via SQL, enforcement matrix with BEACON_AUTH_ENFORCE=true (table + path-glob grants, deny-wins, revoke, anonymous denial, super-user bypass, enforce-off compat, information_schema exemption), escalation/DDL gating, reserved super-user.
• beacon-api HTTP transport tests — admin gate (401/403/200), anonymous read vs write, enforcement over HTTP.

The path-glob tests caught (and fixed) a real gap: read_* scans (SuperListingTable) were bypassing path enforcement.

Notes

• OIDC validates bearer tokens (resource-server pattern); it does not perform the interactive login redirect. For Keycloak, point BEACON_OIDC_* at the realm (leave audience empty, roles claim realm_access.roles) and map admin users to roles you grant locally.

[codecov]

Codecov Report

❌ Patch coverage is 89.20455% with 209 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.30%. Comparing base (d972b8a) to head (5172775).

Files with missing lines	Patch %	Lines
beacon-auth/src/oidc.rs	53.71%	56 Missing ⚠️
beacon-auth/src/sqlite.rs	89.87%	33 Missing ⚠️
beacon-core/src/runtime.rs	83.63%	27 Missing ⚠️
beacon-core/src/parser/beacon_parser.rs	90.98%	21 Missing ⚠️
beacon-core/src/statement_plan/authz.rs	87.28%	15 Missing ⚠️
beacon-auth/src/context.rs	94.73%	13 Missing ⚠️
beacon-api/src/flight_sql/auth.rs	68.96%	9 Missing ⚠️
beacon-core/src/parser/statement.rs	80.00%	7 Missing ⚠️
beacon-auth/src/role.rs	97.74%	6 Missing ⚠️
beacon-auth/src/basic.rs	97.63%	3 Missing ⚠️
... and 7 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #321      +/-   ##
==========================================
+ Coverage   72.96%   74.30%   +1.33%     
==========================================
  Files         269      280      +11     
  Lines       34503    36298    +1795     
==========================================
+ Hits        25176    26972    +1796     
+ Misses       9327     9326       -1     

Files with missing lines	Coverage Δ
beacon-api/src/auth/mod.rs	95.00% <ø> (+0.40%)	⬆️
beacon-api/src/axum/admin/mod.rs	82.60% <ø> (+82.60%)	⬆️
beacon-api/src/axum/client/mod.rs	95.00% <ø> (ø)
beacon-api/src/axum/router.rs	74.44% <100.00%> (+74.44%)	⬆️
beacon-api/src/flight_sql/service.rs	76.51% <100.00%> (-0.16%)	⬇️
beacon-auth/src/composite.rs	100.00% <100.00%> (ø)
beacon-auth/src/credential.rs	100.00% <100.00%> (ø)
beacon-auth/src/password.rs	100.00% <100.00%> (ø)
beacon-common/src/super_table.rs	52.87% <100.00%> (+5.25%)	⬆️
beacon-config/src/lib.rs	82.97% <100.00%> (+0.82%)	⬆️
... and 19 more

... and 6 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.