feat: add restcatalog authentication api

Author: shuxu.li

src/iceberg/catalog/rest/auth/auth_manager.cc

@@ -32,15 +32,15 @@ Result<std::shared_ptr<AuthSession>> AuthManager::InitSession(
 
 Result<std::shared_ptr<AuthSession>> AuthManager::ContextualSession(
     [[maybe_unused]] const std::unordered_map<std::string, std::string>& context,
-    const std::shared_ptr<AuthSession>& parent) {
+    std::shared_ptr<AuthSession> parent) {
   // By default, return the parent session as-is
   return parent;
 }
 
 Result<std::shared_ptr<AuthSession>> AuthManager::TableSession(
     [[maybe_unused]] const TableIdentifier& table,
     [[maybe_unused]] const std::unordered_map<std::string, std::string>& properties,
-    const std::shared_ptr<AuthSession>& parent) {
+    std::shared_ptr<AuthSession> parent) {
   // By default, return the parent session as-is
   return parent;
 }

src/iceberg/catalog/rest/auth/auth_manager.h

@@ -76,7 +76,7 @@ class ICEBERG_REST_EXPORT AuthManager {
   /// session is needed, or an error if session creation fails.
   virtual Result<std::shared_ptr<AuthSession>> ContextualSession(
       const std::unordered_map<std::string, std::string>& context,
-      const std::shared_ptr<AuthSession>& parent);
+      std::shared_ptr<AuthSession> parent);
 
   /// \brief Create or reuse a session scoped to a single table/view.
   ///
@@ -91,7 +91,7 @@ class ICEBERG_REST_EXPORT AuthManager {
   virtual Result<std::shared_ptr<AuthSession>> TableSession(
       const TableIdentifier& table,
       const std::unordered_map<std::string, std::string>& properties,
-      const std::shared_ptr<AuthSession>& parent);
+      std::shared_ptr<AuthSession> parent);
 
   /// \brief Release resources held by the manager.
   ///

src/iceberg/catalog/rest/auth/auth_managers.cc

@@ -33,13 +33,7 @@ namespace {
 using AuthManagerRegistry =
     std::unordered_map<std::string, AuthManagerFactory, StringHash, StringEqual>;
 
-/// \brief Infer the authentication type from properties.
-///
-/// If no explicit auth type is set, this function tries to infer it from
-/// other properties. If "credential" or "token" is present, it implies
-/// OAuth2 authentication. Otherwise, defaults to no authentication.
-///
-/// This behavior is consistent with Java Iceberg's AuthManagers.
+// Infer the authentication type from properties.
 std::string InferAuthType(
     const std::unordered_map<std::string, std::string>& properties) {
   auto it = properties.find(AuthProperties::kAuthType);
@@ -54,11 +48,10 @@ std::string InferAuthType(
     return AuthProperties::kAuthTypeOAuth2;
   }
 
-  // Default to no authentication
   return AuthProperties::kAuthTypeNone;
 }
 
-/// \brief Get the global registry of auth manager factories.
+// Get the global registry of auth manager factories.
 AuthManagerRegistry& GetRegistry() {
   static AuthManagerRegistry registry;
   return registry;

src/iceberg/catalog/rest/auth/auth_managers.h

@@ -57,6 +57,9 @@ class ICEBERG_REST_EXPORT AuthManagers {
 
   /// \brief Register or override the factory for a given auth type.
   ///
+  /// This method is not thread-safe. All registrations should be done during
+  /// application startup before any concurrent access to Load().
+  ///
   /// \param auth_type Case-insensitive type identifier (e.g., "basic").
   /// \param factory Factory function that produces the manager.
   static void Register(std::string_view auth_type, AuthManagerFactory factory);

src/iceberg/catalog/rest/auth/auth_session.cc

@@ -44,7 +44,7 @@ class DefaultAuthSession : public AuthSession {
 
 }  // namespace
 
-std::shared_ptr<AuthSession> AuthSession::Make(
+std::shared_ptr<AuthSession> AuthSession::MakeDefault(
     std::unordered_map<std::string, std::string> headers) {
   return std::make_shared<DefaultAuthSession>(std::move(headers));
 }

src/iceberg/catalog/rest/auth/auth_session.h

@@ -60,15 +60,15 @@ class ICEBERG_REST_EXPORT AuthSession {
   /// \return Status indicating success or failure of closing the session.
   virtual Status Close() { return {}; }
 
-  /// \brief Create a session with static headers.
+  /// \brief Create a default session with static headers.
   ///
   /// This factory method creates a session that adds a fixed set of headers to each
   /// request. It is suitable for authentication methods that use static credentials,
   /// such as Basic auth or static bearer tokens.
   ///
   /// \param headers The headers to add to each request for authentication.
   /// \return A new session that adds the given headers to requests.
-  static std::shared_ptr<AuthSession> Make(
+  static std::shared_ptr<AuthSession> MakeDefault(
       std::unordered_map<std::string, std::string> headers);
 };