Add support for authentication and authorization

Cargo.toml

@@ -32,6 +32,8 @@ delta_kernel = { package = "buoyant_kernel", version = "0.22.2" }
 deltalake = "0.32.4"
 dirs = "6.0.0"
 futures = "0.3.32"
+http = "1.4.0"
+http-body-util = "0.1.3"
 log = "0.4.29"
 object_store = "0.13.2"
 proptest = "1.11.0"
@@ -50,6 +52,7 @@ tokio = "1.52.2"
 tokio-stream = "0.1.18"
 toml = "1.1.2"
 tonic = "0.14.4"
+tower = "0.5.3"
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"
 url = "2.5.8"

crates/modelardb_auth/Cargo.toml

@@ -0,0 +1,27 @@
+# Copyright 2026 The ModelarDB Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[package]
+name = "modelardb_auth"
+version = "0.1.0"
+license = "Apache-2.0"
+edition = "2024"
+authors = ["Soeren Kejser Jensen <devel@kejserjensen.dk>"]
+
+[dependencies]
+async-trait.workspace = true
+tonic.workspace = true
+
+[features]
+testing = []

crates/modelardb_auth/src/authenticator/mock.rs

@@ -0,0 +1,69 @@
+/* Copyright 2026 The ModelarDB Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! A mock [`Authenticator`] for use in tests. Always grants access and records every permission
+//! that was requested so tests can assert which permission the auth layer required for a given
+//! request.
+
+use std::sync::Mutex;
+
+use async_trait::async_trait;
+use tonic::Status;
+use tonic::metadata::MetadataMap;
+
+use crate::Permission;
+use crate::authenticator::Authenticator;
+
+/// An [`Authenticator`] for use in tests that always grants access and records every
+/// [`Permission`] passed to [`authorize`](Authenticator::authorize).
+pub struct MockAuthenticator {
+    /// Every [`Permission`] passed to [`authorize`](Authenticator::authorize). A [`Mutex`] is used
+    /// because [`authorize`](Authenticator::authorize) records through `&self`, which requires
+    /// interior mutability.
+    permissions: Mutex<Vec<Permission>>,
+}
+
+impl MockAuthenticator {
+    pub fn new() -> Self {
+        Self {
+            permissions: Mutex::new(vec![]),
+        }
+    }
+
+    /// Return a copy of all permissions passed to [`authorize`](Authenticator::authorize)
+    /// in the order they were received.
+    pub fn permissions(&self) -> Vec<Permission> {
+        self.permissions.lock().unwrap().clone()
+    }
+}
+
+impl Default for MockAuthenticator {
+    // Trait implemented to silence clippy warning.
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl Authenticator for MockAuthenticator {
+    async fn authorize(
+        &self,
+        _metadata: &MetadataMap,
+        required_permission: Permission,
+    ) -> Result<(), Status> {
+        self.permissions.lock().unwrap().push(required_permission);
+        Ok(())
+    }
+}

crates/modelardb_auth/src/authenticator/mod.rs

@@ -0,0 +1,44 @@
+/* Copyright 2026 The ModelarDB Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! Defines the [`Authenticator`] trait for validating credentials and authorizing access to
+//! ModelarDB.
+
+#[cfg(feature = "testing")]
+pub mod mock;
+
+use async_trait::async_trait;
+use tonic::Status;
+use tonic::metadata::MetadataMap;
+
+use crate::Permission;
+
+/// Validates the credentials in `metadata` and checks that the caller has the `required_permission`.
+/// Implementations must return:
+///
+/// - `Ok(())` if authorized.
+/// - `Err(Status::unauthenticated(...))` if credentials are missing or invalid.
+/// - `Err(Status::permission_denied(...))` if credentials are valid but the caller lacks the
+///   required permission.
+///
+/// Error messages must not reveal the specific reason for rejection to prevent information leakage.
+#[async_trait]
+pub trait Authenticator: Send + Sync {
+    async fn authorize(
+        &self,
+        metadata: &MetadataMap,
+        required_permission: Permission,
+    ) -> Result<(), Status>;
+}

crates/modelardb_auth/src/lib.rs

@@ -0,0 +1,171 @@
+/* Copyright 2026 The ModelarDB Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! Types to support authentication and authorization in ModelarDB.
+
+use tonic::metadata::AsciiMetadataValue;
+use tonic::service::Interceptor;
+use tonic::{Request, Status};
+
+pub mod authenticator;
+
+/// The permission required to perform an operation in a ModelarDB server.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Permission {
+    Read,
+    Write,
+    Admin,
+}
+
+impl Permission {
+    /// Return [`true`] if `granted` satisfies this required permission using the hierarchy
+    /// Admin ⊇ Write ⊇ Read, otherwise [`false`] is returned.
+    #[allow(clippy::match_like_matches_macro)]
+    pub fn is_satisfied_by(&self, granted: &Permission) -> bool {
+        match (self, granted) {
+            (Permission::Read, _) => true,
+            (Permission::Write, Permission::Write | Permission::Admin) => true,
+            (Permission::Admin, Permission::Admin) => true,
+            _ => false,
+        }
+    }
+}
+
+/// Tonic interceptor that attaches a bearer token to every outgoing request when one is present.
+#[derive(Clone)]
+pub struct BearerInterceptor {
+    /// The value of the `authorization` header. This is either `Bearer <token>` or [`None`] if no
+    /// token has been provided. The header is only attached to an outgoing request if this is not
+    /// [`None`].
+    pub maybe_authorization: Option<AsciiMetadataValue>,
+}
+
+impl BearerInterceptor {
+    /// Create a new [`BearerInterceptor`] that attaches the bearer token in `maybe_token` to every
+    /// outgoing request if `maybe_token` is not [`None`]. If `maybe_token` is [`Some`] but the
+    /// token is not ASCII, [`Status`] is returned.
+    pub fn try_new(maybe_token: Option<&str>) -> Result<Self, Status> {
+        let maybe_authorization = maybe_token
+            .map(|token| {
+                format!("Bearer {token}")
+                    .parse::<AsciiMetadataValue>()
+                    .map_err(|error| Status::invalid_argument(format!("Token is not ASCII: {error}.")))
+            })
+            .transpose()?;
+
+        Ok(Self {
+            maybe_authorization,
+        })
+    }
+}
+
+impl Interceptor for BearerInterceptor {
+    fn call(&mut self, mut request: Request<()>) -> Result<Request<()>, Status> {
+        if let Some(authorization) = &self.maybe_authorization {
+            request
+                .metadata_mut()
+                .insert("authorization", authorization.clone());
+        }
+
+        Ok(request)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Tests for Permission.
+    #[test]
+    fn test_read_satisfied_by_read() {
+        assert!(Permission::Read.is_satisfied_by(&Permission::Read));
+    }
+
+    #[test]
+    fn test_read_satisfied_by_write() {
+        assert!(Permission::Read.is_satisfied_by(&Permission::Write));
+    }
+
+    #[test]
+    fn test_read_satisfied_by_admin() {
+        assert!(Permission::Read.is_satisfied_by(&Permission::Admin));
+    }
+
+    #[test]
+    fn test_write_not_satisfied_by_read() {
+        assert!(!Permission::Write.is_satisfied_by(&Permission::Read));
+    }
+
+    #[test]
+    fn test_write_satisfied_by_write() {
+        assert!(Permission::Write.is_satisfied_by(&Permission::Write));
+    }
+
+    #[test]
+    fn test_write_satisfied_by_admin() {
+        assert!(Permission::Write.is_satisfied_by(&Permission::Admin));
+    }
+
+    #[test]
+    fn test_admin_not_satisfied_by_read() {
+        assert!(!Permission::Admin.is_satisfied_by(&Permission::Read));
+    }
+
+    #[test]
+    fn test_admin_not_satisfied_by_write() {
+        assert!(!Permission::Admin.is_satisfied_by(&Permission::Write));
+    }
+
+    #[test]
+    fn test_admin_satisfied_by_admin() {
+        assert!(Permission::Admin.is_satisfied_by(&Permission::Admin));
+    }
+
+    // Tests for BearerInterceptor.
+    #[test]
+    fn test_try_new_bearer_interceptor_with_invalid_token() {
+        let result = BearerInterceptor::try_new(Some("sec\nret"));
+
+        assert_eq!(
+            result.err().unwrap().to_string(),
+            "code: 'Client specified an invalid argument', \
+            message: \"Token is not ASCII: failed to parse metadata value.\""
+        );
+    }
+
+    #[test]
+    fn test_bearer_interceptor_call_attaches_authorization_header() {
+        let mut interceptor = BearerInterceptor::try_new(Some("secret")).unwrap();
+        let request = interceptor.call(Request::new(())).unwrap();
+
+        assert_eq!(
+            request
+                .metadata()
+                .get("authorization")
+                .unwrap()
+                .to_str()
+                .unwrap(),
+            "Bearer secret"
+        );
+    }
+
+    #[test]
+    fn test_bearer_interceptor_call_without_token_attaches_nothing() {
+        let mut interceptor = BearerInterceptor::try_new(None).unwrap();
+        let request = interceptor.call(Request::new(())).unwrap();
+
+        assert!(request.metadata().get("authorization").is_none());
+    }
+}

crates/modelardb_client/Cargo.toml

@@ -29,6 +29,7 @@ arrow = { workspace = true, features = ["prettyprint"] }
 bytes.workspace = true
 clap.workspace = true
 dirs.workspace = true
+modelardb_auth = { path = "../modelardb_auth" }
 rustyline.workspace = true
 tokio.workspace = true
 tonic.workspace = true