Add initial AuthManager support

crates/catalog/rest/Cargo.toml

@@ -30,6 +30,7 @@ repository = { workspace = true }
 
 [dependencies]
 async-trait = { workspace = true }
+base64 = { workspace = true }
 chrono = { workspace = true }
 http = { workspace = true }
 iceberg = { workspace = true }
@@ -44,6 +45,7 @@ typed-builder = { workspace = true }
 uuid = { workspace = true, features = ["v4"] }
 
 [dev-dependencies]
+base64 = { workspace = true }
 ctor = { workspace = true }
 iceberg_test_utils = { path = "../../test_utils", features = ["tests"] }
 mockito = { workspace = true }

crates/catalog/rest/src/auth/mod.rs

@@ -0,0 +1,60 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+use async_trait::async_trait;
+use base64::Engine;
+use base64::engine::general_purpose;
+
+/// Trait for authentication managers that supply authorization headers.
+#[async_trait]
+pub trait AuthManager: Send + Sync + std::fmt::Debug {
+    /// Return the Authorization header value, or None if not applicable.
+    async fn auth_header(&self) -> Option<String>;
+}
+
+/// An `AuthManager` that performs no authentication.
+#[derive(Debug, Default)]
+pub struct NoopAuthManager;
+
+#[async_trait]
+impl AuthManager for NoopAuthManager {
+    async fn auth_header(&self) -> Option<String> {
+        None
+    }
+}
+
+/// An `AuthManager` for basic authentication.
+#[derive(Debug)]
+pub struct BasicAuthManager {
+    token: String,
+}
+
+impl BasicAuthManager {
+    /// Create a new `BasicAuthManager`.
+    pub fn new(username: &str, password: &str) -> Self {
+        let credentials = format!("{}:{}", username, password);
+        let token = general_purpose::STANDARD.encode(credentials.as_bytes());
+        BasicAuthManager { token }
+    }
+}
+
+#[async_trait]
+impl AuthManager for BasicAuthManager {
+    async fn auth_header(&self) -> Option<String> {
+        Some(format!("Basic {}", self.token))
+    }
+}

crates/catalog/rest/src/lib.rs

@@ -19,6 +19,8 @@
 
 #![deny(missing_docs)]
 
+/// Authentication for the REST catalog.
+pub mod auth;
 mod catalog;
 mod client;
 mod types;

crates/catalog/rest/tests/auth.rs

@@ -0,0 +1,38 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+use base64::Engine;
+use iceberg_catalog_rest::auth::{AuthManager, BasicAuthManager, NoopAuthManager};
+
+#[tokio::test]
+async fn test_noop_auth_manager() {
+    let auth_manager = NoopAuthManager;
+    let header = auth_manager.auth_header().await;
+    assert!(header.is_none());
+}
+
+#[tokio::test]
+async fn test_basic_auth_manager() {
+    let username = "testuser";
+    let password = "testpassword";
+    let auth_manager = BasicAuthManager::new(username, password);
+    let header = auth_manager.auth_header().await;
+    assert!(header.is_some());
+    let expected_token = base64::engine::general_purpose::STANDARD
+        .encode(format!("{}:{}", username, password).as_bytes());
+    assert_eq!(header.unwrap(), format!("Basic {}", expected_token));
+}