refactor: auth crate (#2148)

* chore: move user_info to auth crate

* chore: temp commit before resolving tests compile error

* chore: fix compile issue

* chore: minor fix

* chore: tmp save

* chore: change user_info to trait

* chore: minor change & use auth result user info in pg session setup

* chore: add as_any to user_info

* chore: rename user_info

* chore: remove ice file

* chore: add permission checker

* chore: add grpc permission check

* chore: add session spawn user_info to query_ctx

* chore: minor update

* chore: add permission checker to sql handler & temp save

* chore: add permission checker to prometheus handler

* chore: add permission checker to opentsdb handler

* chore: add permission checker to other handlers

* chore: add test

* chore: add user_info setting on http entrance

* chore: fix toml

* chore: remove box in permission req

* chore: cr issue

* chore: cr issue

src/auth/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "auth"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[features]
+default = []
+testing = []
+
+[dependencies]
+api.workspace = true
+async-trait.workspace = true
+common-error.workspace = true
+digest = "0.10"
+hex = { version = "0.4" }
+secrecy = { version = "0.8", features = ["serde", "alloc"] }
+sha1 = "0.10"
+snafu.workspace = true
+sql.workspace = true
+tokio.workspace = true
+
+[dev-dependencies]
+common-test-util.workspace = true

src/auth/src/common.rs

@@ -0,0 +1,68 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::sync::Arc;
+
+use secrecy::SecretString;
+use snafu::OptionExt;
+
+use crate::error::{InvalidConfigSnafu, Result};
+use crate::user_info::DefaultUserInfo;
+use crate::user_provider::static_user_provider::{StaticUserProvider, STATIC_USER_PROVIDER};
+use crate::{UserInfoRef, UserProviderRef};
+
+pub(crate) const DEFAULT_USERNAME: &str = "greptime";
+
+/// construct a [`UserInfo`] impl with name
+/// use default username `greptime` if None is provided
+pub fn userinfo_by_name(username: Option<String>) -> UserInfoRef {
+    DefaultUserInfo::with_name(username.unwrap_or_else(|| DEFAULT_USERNAME.to_string()))
+}
+
+pub fn user_provider_from_option(opt: &String) -> Result<UserProviderRef> {
+    let (name, content) = opt.split_once(':').context(InvalidConfigSnafu {
+        value: opt.to_string(),
+        msg: "UserProviderOption must be in format `<option>:<value>`",
+    })?;
+    match name {
+        STATIC_USER_PROVIDER => {
+            let provider =
+                StaticUserProvider::try_from(content).map(|p| Arc::new(p) as UserProviderRef)?;
+            Ok(provider)
+        }
+        _ => InvalidConfigSnafu {
+            value: name.to_string(),
+            msg: "Invalid UserProviderOption",
+        }
+        .fail(),
+    }
+}
+
+type Username<'a> = &'a str;
+type HostOrIp<'a> = &'a str;
+
+#[derive(Debug, Clone)]
+pub enum Identity<'a> {
+    UserId(Username<'a>, Option<HostOrIp<'a>>),
+}
+
+pub type HashedPassword<'a> = &'a [u8];
+pub type Salt<'a> = &'a [u8];
+
+/// Authentication information sent by the client.
+pub enum Password<'a> {
+    PlainText(SecretString),
+    MysqlNativePassword(HashedPassword<'a>, Salt<'a>),
+    PgMD5(HashedPassword<'a>, Salt<'a>),
+}

src/auth/src/error.rs

@@ -0,0 +1,86 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use common_error::ext::{BoxedError, ErrorExt};
+use common_error::status_code::StatusCode;
+use snafu::{Location, Snafu};
+
+#[derive(Debug, Snafu)]
+#[snafu(visibility(pub))]
+pub enum Error {
+    #[snafu(display("Invalid config value: {}, {}", value, msg))]
+    InvalidConfig { value: String, msg: String },
+
+    #[snafu(display("Illegal param: {}", msg))]
+    IllegalParam { msg: String },
+
+    #[snafu(display("Internal state error: {}", msg))]
+    InternalState { msg: String },
+
+    #[snafu(display("IO error, source: {}", source))]
+    Io {
+        source: std::io::Error,
+        location: Location,
+    },
+
+    #[snafu(display("Auth failed, source: {}", source))]
+    AuthBackend {
+        location: Location,
+        source: BoxedError,
+    },
+
+    #[snafu(display("User not found, username: {}", username))]
+    UserNotFound { username: String },
+
+    #[snafu(display("Unsupported password type: {}", password_type))]
+    UnsupportedPasswordType { password_type: String },
+
+    #[snafu(display("Username and password does not match, username: {}", username))]
+    UserPasswordMismatch { username: String },
+
+    #[snafu(display(
+        "Access denied for user '{}' to database '{}-{}'",
+        username,
+        catalog,
+        schema
+    ))]
+    AccessDenied {
+        catalog: String,
+        schema: String,
+        username: String,
+    },
+}
+
+impl ErrorExt for Error {
+    fn status_code(&self) -> StatusCode {
+        match self {
+            Error::InvalidConfig { .. } => StatusCode::InvalidArguments,
+            Error::IllegalParam { .. } => StatusCode::InvalidArguments,
+            Error::InternalState { .. } => StatusCode::Unexpected,
+            Error::Io { .. } => StatusCode::Internal,
+            Error::AuthBackend { .. } => StatusCode::Internal,
+
+            Error::UserNotFound { .. } => StatusCode::UserNotFound,
+            Error::UnsupportedPasswordType { .. } => StatusCode::UnsupportedPasswordType,
+            Error::UserPasswordMismatch { .. } => StatusCode::UserPasswordMismatch,
+            Error::AccessDenied { .. } => StatusCode::AccessDenied,
+        }
+    }
+
+    fn as_any(&self) -> &dyn std::any::Any {
+        self
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

src/auth/src/lib.rs

@@ -0,0 +1,33 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+mod common;
+mod error;
+mod permission;
+mod user_info;
+mod user_provider;
+
+#[cfg(feature = "testing")]
+pub mod tests;
+
+pub use common::{user_provider_from_option, userinfo_by_name, HashedPassword, Identity, Password};
+pub use error::{Error, Result};
+pub use permission::{PermissionChecker, PermissionReq, PermissionResp};
+pub use user_info::UserInfo;
+pub use user_provider::UserProvider;
+
+/// pub type alias
+pub type UserInfoRef = std::sync::Arc<dyn UserInfo>;
+pub type UserProviderRef = std::sync::Arc<dyn UserProvider>;
+pub type PermissionCheckerRef = std::sync::Arc<dyn PermissionChecker>;

src/auth/src/permission.rs

@@ -0,0 +1,60 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::fmt::Debug;
+
+use api::v1::greptime_request::Request;
+use sql::statements::statement::Statement;
+
+use crate::error::Result;
+use crate::{PermissionCheckerRef, UserInfoRef};
+
+#[derive(Debug, Clone)]
+pub enum PermissionReq<'a> {
+    GrpcRequest(&'a Request),
+    SqlStatement(&'a Statement),
+    PromQuery,
+    Opentsdb,
+    LineProtocol,
+    PromStoreWrite,
+    PromStoreRead,
+    Otlp,
+}
+
+#[derive(Debug)]
+pub enum PermissionResp {
+    Allow,
+    Reject,
+}
+
+pub trait PermissionChecker: Send + Sync {
+    fn check_permission(
+        &self,
+        user_info: Option<UserInfoRef>,
+        req: PermissionReq,
+    ) -> Result<PermissionResp>;
+}
+
+impl PermissionChecker for Option<&PermissionCheckerRef> {
+    fn check_permission(
+        &self,
+        user_info: Option<UserInfoRef>,
+        req: PermissionReq,
+    ) -> Result<PermissionResp> {
+        match self {
+            Some(checker) => checker.check_permission(user_info, req),
+            None => Ok(PermissionResp::Allow),
+        }
+    }
+}

src/auth/src/tests.rs

@@ -0,0 +1,194 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+use secrecy::ExposeSecret;
+
+use crate::error::{
+    AccessDeniedSnafu, Result, UnsupportedPasswordTypeSnafu, UserNotFoundSnafu,
+    UserPasswordMismatchSnafu,
+};
+use crate::user_info::DefaultUserInfo;
+use crate::user_provider::static_user_provider::auth_mysql;
+#[allow(unused_imports)]
+use crate::Error;
+use crate::{Identity, Password, UserInfoRef, UserProvider};
+
+pub struct DatabaseAuthInfo<'a> {
+    pub catalog: &'a str,
+    pub schema: &'a str,
+    pub username: &'a str,
+}
+
+pub struct MockUserProvider {
+    pub catalog: String,
+    pub schema: String,
+    pub username: String,
+}
+
+impl Default for MockUserProvider {
+    fn default() -> Self {
+        MockUserProvider {
+            catalog: "greptime".to_owned(),
+            schema: "public".to_owned(),
+            username: "greptime".to_owned(),
+        }
+    }
+}
+
+impl MockUserProvider {
+    pub fn set_authorization_info(&mut self, info: DatabaseAuthInfo) {
+        self.catalog = info.catalog.to_owned();
+        self.schema = info.schema.to_owned();
+        self.username = info.username.to_owned();
+    }
+}
+
+#[async_trait::async_trait]
+impl UserProvider for MockUserProvider {
+    fn name(&self) -> &str {
+        "mock_user_provider"
+    }
+
+    async fn authenticate(&self, id: Identity<'_>, password: Password<'_>) -> Result<UserInfoRef> {
+        match id {
+            Identity::UserId(username, _host) => match password {
+                Password::PlainText(password) => {
+                    if username == "greptime" {
+                        if password.expose_secret() == "greptime" {
+                            Ok(DefaultUserInfo::with_name("greptime"))
+                        } else {
+                            UserPasswordMismatchSnafu {
+                                username: username.to_string(),
+                            }
+                            .fail()
+                        }
+                    } else {
+                        UserNotFoundSnafu {
+                            username: username.to_string(),
+                        }
+                        .fail()
+                    }
+                }
+                Password::MysqlNativePassword(auth_data, salt) => {
+                    auth_mysql(auth_data, salt, username, "greptime".as_bytes())
+                        .map(|_| DefaultUserInfo::with_name(username))
+                }
+                _ => UnsupportedPasswordTypeSnafu {
+                    password_type: "mysql_native_password",
+                }
+                .fail(),
+            },
+        }
+    }
+
+    async fn authorize(&self, catalog: &str, schema: &str, user_info: &UserInfoRef) -> Result<()> {
+        if catalog == self.catalog && schema == self.schema && user_info.username() == self.username
+        {
+            Ok(())
+        } else {
+            AccessDeniedSnafu {
+                catalog: catalog.to_string(),
+                schema: schema.to_string(),
+                username: user_info.username().to_string(),
+            }
+            .fail()
+        }
+    }
+}
+
+#[tokio::test]
+async fn test_auth_by_plain_text() {
+    let user_provider = MockUserProvider::default();
+    assert_eq!("mock_user_provider", user_provider.name());
+
+    // auth success
+    let auth_result = user_provider
+        .authenticate(
+            Identity::UserId("greptime", None),
+            Password::PlainText("greptime".to_string().into()),
+        )
+        .await
+        .unwrap();
+    assert_eq!("greptime", auth_result.username());
+
+    // auth failed, unsupported password type
+    let auth_result = user_provider
+        .authenticate(
+            Identity::UserId("greptime", None),
+            Password::PgMD5(b"hashed_value", b"salt"),
+        )
+        .await;
+    assert!(auth_result.is_err());
+    assert!(matches!(
+        auth_result.err().unwrap(),
+        Error::UnsupportedPasswordType { .. }
+    ));
+
+    // auth failed, err: user not exist.
+    let auth_result = user_provider
+        .authenticate(
+            Identity::UserId("not_exist_username", None),
+            Password::PlainText("greptime".to_string().into()),
+        )
+        .await;
+    assert!(auth_result.is_err());
+    assert!(matches!(
+        auth_result.err().unwrap(),
+        Error::UserNotFound { .. }
+    ));
+
+    // auth failed, err: wrong password
+    let auth_result = user_provider
+        .authenticate(
+            Identity::UserId("greptime", None),
+            Password::PlainText("wrong_password".to_string().into()),
+        )
+        .await;
+    assert!(auth_result.is_err());
+    assert!(matches!(
+        auth_result.err().unwrap(),
+        Error::UserPasswordMismatch { .. }
+    ))
+}
+
+#[tokio::test]
+async fn test_schema_validate() {
+    let mut validator = MockUserProvider::default();
+    validator.set_authorization_info(DatabaseAuthInfo {
+        catalog: "greptime",
+        schema: "public",
+        username: "test_user",
+    });
+
+    let right_user = DefaultUserInfo::with_name("test_user");
+    let wrong_user = DefaultUserInfo::with_name("greptime");
+
+    // check catalog
+    let re = validator
+        .authorize("greptime_wrong", "public", &right_user)
+        .await;
+    assert!(re.is_err());
+    // check schema
+    let re = validator
+        .authorize("greptime", "public_wrong", &right_user)
+        .await;
+    assert!(re.is_err());
+    // check username
+    let re = validator.authorize("greptime", "public", &wrong_user).await;
+    assert!(re.is_err());
+    // check ok
+    validator
+        .authorize("greptime", "public", &right_user)
+        .await
+        .unwrap();
+}

src/auth/src/user_info.rs

@@ -0,0 +1,47 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::any::Any;
+use std::fmt::Debug;
+use std::sync::Arc;
+
+use crate::UserInfoRef;
+
+pub trait UserInfo: Debug + Sync + Send {
+    fn as_any(&self) -> &dyn Any;
+    fn username(&self) -> &str;
+}
+
+#[derive(Debug)]
+pub(crate) struct DefaultUserInfo {
+    username: String,
+}
+
+impl DefaultUserInfo {
+    pub(crate) fn with_name(username: impl Into<String>) -> UserInfoRef {
+        Arc::new(Self {
+            username: username.into(),
+        })
+    }
+}
+
+impl UserInfo for DefaultUserInfo {
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+
+    fn username(&self) -> &str {
+        self.username.as_str()
+    }
+}

src/auth/src/user_provider.rs

@@ -0,0 +1,46 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub(crate) mod static_user_provider;
+
+use crate::common::{Identity, Password};
+use crate::error::Result;
+use crate::UserInfoRef;
+
+#[async_trait::async_trait]
+pub trait UserProvider: Send + Sync {
+    fn name(&self) -> &str;
+
+    /// [`authenticate`] checks whether a user is valid and allowed to access the database.
+    async fn authenticate(&self, id: Identity<'_>, password: Password<'_>) -> Result<UserInfoRef>;
+
+    /// [`authorize`] checks whether a connection request
+    /// from a certain user to a certain catalog/schema is legal.
+    /// This method should be called after [`authenticate`].
+    async fn authorize(&self, catalog: &str, schema: &str, user_info: &UserInfoRef) -> Result<()>;
+
+    /// [`auth`] is a combination of [`authenticate`] and [`authorize`].
+    /// In most cases it's preferred for both convenience and performance.
+    async fn auth(
+        &self,
+        id: Identity<'_>,
+        password: Password<'_>,
+        catalog: &str,
+        schema: &str,
+    ) -> Result<UserInfoRef> {
+        let user_info = self.authenticate(id, password).await?;
+        self.authorize(catalog, schema, &user_info).await?;
+        Ok(user_info)
+    }
+}

src/auth/src/user_provider/static_user_provider.rs

@@ -0,0 +1,298 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::collections::HashMap;
+use std::fs::File;
+use std::io;
+use std::io::BufRead;
+use std::path::Path;
+
+use async_trait::async_trait;
+use digest::Digest;
+use secrecy::ExposeSecret;
+use sha1::Sha1;
+use snafu::{ensure, OptionExt, ResultExt};
+
+use crate::common::Salt;
+use crate::error::{
+    Error, IllegalParamSnafu, InvalidConfigSnafu, IoSnafu, Result, UnsupportedPasswordTypeSnafu,
+    UserNotFoundSnafu, UserPasswordMismatchSnafu,
+};
+use crate::user_info::DefaultUserInfo;
+use crate::{HashedPassword, Identity, Password, UserInfoRef, UserProvider};
+
+pub(crate) const STATIC_USER_PROVIDER: &str = "static_user_provider";
+
+impl TryFrom<&str> for StaticUserProvider {
+    type Error = Error;
+
+    fn try_from(value: &str) -> Result<Self> {
+        let (mode, content) = value.split_once(':').context(InvalidConfigSnafu {
+            value: value.to_string(),
+            msg: "StaticUserProviderOption must be in format `<option>:<value>`",
+        })?;
+        return match mode {
+            "file" => {
+                // check valid path
+                let path = Path::new(content);
+                ensure!(path.exists() && path.is_file(), InvalidConfigSnafu {
+                    value: content.to_string(),
+                    msg: "StaticUserProviderOption file must be a valid file path",
+                });
+
+                let file = File::open(path).context(IoSnafu)?;
+                let credential = io::BufReader::new(file)
+                    .lines()
+                    .map_while(std::result::Result::ok)
+                    .filter_map(|line| {
+                        if let Some((k, v)) = line.split_once('=') {
+                            Some((k.to_string(), v.as_bytes().to_vec()))
+                        } else {
+                            None
+                        }
+                    })
+                    .collect::<HashMap<String, Vec<u8>>>();
+
+                ensure!(!credential.is_empty(), InvalidConfigSnafu {
+                    value: content.to_string(),
+                    msg: "StaticUserProviderOption file must contains at least one valid credential",
+                });
+
+                Ok(StaticUserProvider { users: credential, })
+            }
+            "cmd" => content
+                .split(',')
+                .map(|kv| {
+                    let (k, v) = kv.split_once('=').context(InvalidConfigSnafu {
+                        value: kv.to_string(),
+                        msg: "StaticUserProviderOption cmd values must be in format `user=pwd[,user=pwd]`",
+                    })?;
+                    Ok((k.to_string(), v.as_bytes().to_vec()))
+                })
+                .collect::<Result<HashMap<String, Vec<u8>>>>()
+                .map(|users| StaticUserProvider { users }),
+            _ => InvalidConfigSnafu {
+                value: mode.to_string(),
+                msg: "StaticUserProviderOption must be in format `file:<path>` or `cmd:<values>`",
+            }
+            .fail(),
+        };
+    }
+}
+
+pub(crate) struct StaticUserProvider {
+    users: HashMap<String, Vec<u8>>,
+}
+
+#[async_trait]
+impl UserProvider for StaticUserProvider {
+    fn name(&self) -> &str {
+        STATIC_USER_PROVIDER
+    }
+
+    async fn authenticate(
+        &self,
+        input_id: Identity<'_>,
+        input_pwd: Password<'_>,
+    ) -> Result<UserInfoRef> {
+        match input_id {
+            Identity::UserId(username, _) => {
+                ensure!(
+                    !username.is_empty(),
+                    IllegalParamSnafu {
+                        msg: "blank username"
+                    }
+                );
+                let save_pwd = self.users.get(username).context(UserNotFoundSnafu {
+                    username: username.to_string(),
+                })?;
+
+                match input_pwd {
+                    Password::PlainText(pwd) => {
+                        ensure!(
+                            !pwd.expose_secret().is_empty(),
+                            IllegalParamSnafu {
+                                msg: "blank password"
+                            }
+                        );
+                        return if save_pwd == pwd.expose_secret().as_bytes() {
+                            Ok(DefaultUserInfo::with_name(username))
+                        } else {
+                            UserPasswordMismatchSnafu {
+                                username: username.to_string(),
+                            }
+                            .fail()
+                        };
+                    }
+                    Password::MysqlNativePassword(auth_data, salt) => {
+                        ensure!(
+                            auth_data.len() == 20,
+                            IllegalParamSnafu {
+                                msg: "Illegal MySQL native password format, length != 20"
+                            }
+                        );
+                        auth_mysql(auth_data, salt, username, save_pwd)
+                            .map(|_| DefaultUserInfo::with_name(username))
+                    }
+                    Password::PgMD5(_, _) => UnsupportedPasswordTypeSnafu {
+                        password_type: "pg_md5",
+                    }
+                    .fail(),
+                }
+            }
+        }
+    }
+
+    async fn authorize(
+        &self,
+        _catalog: &str,
+        _schema: &str,
+        _user_info: &UserInfoRef,
+    ) -> Result<()> {
+        // default allow all
+        Ok(())
+    }
+}
+
+pub fn auth_mysql(
+    auth_data: HashedPassword,
+    salt: Salt,
+    username: &str,
+    save_pwd: &[u8],
+) -> Result<()> {
+    // ref: https://github.com/mysql/mysql-server/blob/a246bad76b9271cb4333634e954040a970222e0a/sql/auth/password.cc#L62
+    let hash_stage_2 = double_sha1(save_pwd);
+    let tmp = sha1_two(salt, &hash_stage_2);
+    // xor auth_data and tmp
+    let mut xor_result = [0u8; 20];
+    for i in 0..20 {
+        xor_result[i] = auth_data[i] ^ tmp[i];
+    }
+    let candidate_stage_2 = sha1_one(&xor_result);
+    if candidate_stage_2 == hash_stage_2 {
+        Ok(())
+    } else {
+        UserPasswordMismatchSnafu {
+            username: username.to_string(),
+        }
+        .fail()
+    }
+}
+
+fn sha1_two(input_1: &[u8], input_2: &[u8]) -> Vec<u8> {
+    let mut hasher = Sha1::new();
+    hasher.update(input_1);
+    hasher.update(input_2);
+    hasher.finalize().to_vec()
+}
+
+fn sha1_one(data: &[u8]) -> Vec<u8> {
+    let mut hasher = Sha1::new();
+    hasher.update(data);
+    hasher.finalize().to_vec()
+}
+
+fn double_sha1(data: &[u8]) -> Vec<u8> {
+    sha1_one(&sha1_one(data))
+}
+
+#[cfg(test)]
+pub mod test {
+    use std::fs::File;
+    use std::io::{LineWriter, Write};
+
+    use common_test_util::temp_dir::create_temp_dir;
+
+    use crate::user_info::DefaultUserInfo;
+    use crate::user_provider::static_user_provider::{
+        double_sha1, sha1_one, sha1_two, StaticUserProvider,
+    };
+    use crate::user_provider::{Identity, Password};
+    use crate::UserProvider;
+
+    #[test]
+    fn test_sha() {
+        let sha_1_answer: Vec<u8> = vec![
+            124, 74, 141, 9, 202, 55, 98, 175, 97, 229, 149, 32, 148, 61, 194, 100, 148, 248, 148,
+            27,
+        ];
+        let sha_1 = sha1_one("123456".as_bytes());
+        assert_eq!(sha_1, sha_1_answer);
+
+        let double_sha1_answer: Vec<u8> = vec![
+            107, 180, 131, 126, 183, 67, 41, 16, 94, 228, 86, 141, 218, 125, 198, 126, 210, 202,
+            42, 217,
+        ];
+        let double_sha1 = double_sha1("123456".as_bytes());
+        assert_eq!(double_sha1, double_sha1_answer);
+
+        let sha1_2_answer: Vec<u8> = vec![
+            132, 115, 215, 211, 99, 186, 164, 206, 168, 152, 217, 192, 117, 47, 240, 252, 142, 244,
+            37, 204,
+        ];
+        let sha1_2 = sha1_two("123456".as_bytes(), "654321".as_bytes());
+        assert_eq!(sha1_2, sha1_2_answer);
+    }
+
+    async fn test_authenticate(provider: &dyn UserProvider, username: &str, password: &str) {
+        let re = provider
+            .authenticate(
+                Identity::UserId(username, None),
+                Password::PlainText(password.to_string().into()),
+            )
+            .await;
+        let _ = re.unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_authorize() {
+        let user_info = DefaultUserInfo::with_name("root");
+        let provider = StaticUserProvider::try_from("cmd:root=123456,admin=654321").unwrap();
+        provider
+            .authorize("catalog", "schema", &user_info)
+            .await
+            .unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_inline_provider() {
+        let provider = StaticUserProvider::try_from("cmd:root=123456,admin=654321").unwrap();
+        test_authenticate(&provider, "root", "123456").await;
+        test_authenticate(&provider, "admin", "654321").await;
+    }
+
+    #[tokio::test]
+    async fn test_file_provider() {
+        let dir = create_temp_dir("test_file_provider");
+        let file_path = format!("{}/test_file_provider", dir.path().to_str().unwrap());
+        {
+            // write a tmp file
+            let file = File::create(&file_path);
+            let file = file.unwrap();
+            let mut lw = LineWriter::new(file);
+            assert!(lw
+                .write_all(
+                    b"root=123456
+admin=654321",
+                )
+                .is_ok());
+            lw.flush().unwrap();
+        }
+
+        let param = format!("file:{file_path}");
+        let provider = StaticUserProvider::try_from(param.as_str()).unwrap();
+        test_authenticate(&provider, "root", "123456").await;
+        test_authenticate(&provider, "admin", "654321").await;
+    }
+}

src/auth/tests/mod.rs

@@ -0,0 +1,61 @@
+// Copyright 2023 Greptime Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#![feature(assert_matches)]
+use std::assert_matches::assert_matches;
+use std::sync::Arc;
+
+use api::v1::greptime_request::Request;
+use auth::Error::InternalState;
+use auth::{PermissionChecker, PermissionCheckerRef, PermissionReq, PermissionResp, UserInfoRef};
+use sql::statements::show::{ShowDatabases, ShowKind};
+use sql::statements::statement::Statement;
+
+struct DummyPermissionChecker;
+
+impl PermissionChecker for DummyPermissionChecker {
+    fn check_permission(
+        &self,
+        _user_info: Option<UserInfoRef>,
+        req: PermissionReq,
+    ) -> auth::Result<PermissionResp> {
+        match req {
+            PermissionReq::GrpcRequest(_) => Ok(PermissionResp::Allow),
+            PermissionReq::SqlStatement(_) => Ok(PermissionResp::Reject),
+            _ => Err(InternalState {
+                msg: "testing".to_string(),
+            }),
+        }
+    }
+}
+
+#[test]
+fn test_permission_checker() {
+    let checker: PermissionCheckerRef = Arc::new(DummyPermissionChecker);
+
+    let grpc_result = checker.check_permission(
+        None,
+        PermissionReq::GrpcRequest(&Request::Query(Default::default())),
+    );
+    assert_matches!(grpc_result, Ok(PermissionResp::Allow));
+
+    let sql_result = checker.check_permission(
+        None,
+        PermissionReq::SqlStatement(&Statement::ShowDatabases(ShowDatabases::new(ShowKind::All))),
+    );
+    assert_matches!(sql_result, Ok(PermissionResp::Reject));
+
+    let err_result = checker.check_permission(None, PermissionReq::Opentsdb);
+    assert_matches!(err_result, Err(InternalState { msg }) if msg == "testing");
+}