feat: Implement OAuth2 authentication for REST catalog

Author: shuxu.li

src/iceberg/catalog/rest/auth/auth_manager.cc

@@ -26,7 +26,6 @@
 #include "iceberg/catalog/rest/auth/auth_session.h"
 #include "iceberg/catalog/rest/auth/oauth2_util.h"
 #include "iceberg/catalog/rest/catalog_properties.h"
-#include "iceberg/catalog/rest/http_client.h"
 #include "iceberg/util/macros.h"
 #include "iceberg/util/transform_util.h"
 
@@ -127,7 +126,6 @@ class OAuth2AuthManager : public AuthManager {
   Result<std::shared_ptr<AuthSession>> CatalogSession(
       HttpClient& client,
       const std::unordered_map<std::string, std::string>& properties) override {
-    // Reuse the token fetched during InitSession.
     if (init_token_response_.has_value()) {
       auto token_response = std::move(*init_token_response_);
       init_token_response_.reset();
@@ -136,7 +134,7 @@ class OAuth2AuthManager : public AuthManager {
                                      ctx.client_secret, ctx.scope, client);
     }
 
-    // If both token and credential are provided, prefer the token.
+    // If token is provided, use it directly.
     auto token_it = properties.find(AuthProperties::kOAuth2Token);
     if (token_it != properties.end() && !token_it->second.empty()) {
       return AuthSession::MakeDefault({{"Authorization", "Bearer " + token_it->second}});

src/iceberg/catalog/rest/auth/auth_session.cc

@@ -55,12 +55,7 @@ std::shared_ptr<AuthSession> AuthSession::MakeOAuth2(
     const OAuthTokenResponse& initial_token, const std::string& /*token_endpoint*/,
     const std::string& /*client_id*/, const std::string& /*client_secret*/,
     const std::string& /*scope*/, HttpClient& /*client*/) {
-  // TODO(lishuxu): Replace with OAuth2AuthSession that:
-  //   - Stores access_token, refresh_token, expires_in, and token_endpoint
-  //   - Checks token expiration in Authenticate() and transparently refreshes
-  //     using RefreshToken() (or re-fetches via client_credentials if no
-  //     refresh_token is available)
-  // For now, fall back to a static session with the initial token.
+  // TODO(lishuxu): Create OAuth2AuthSession with auto-refresh support.
   return MakeDefault({{"Authorization", "Bearer " + initial_token.access_token}});
 }
 

src/iceberg/catalog/rest/auth/oauth2_util.cc

@@ -78,13 +78,13 @@ Result<OAuthTokenResponse> FetchToken(HttpClient& client,
                                       const std::string& client_id,
                                       const std::string& client_secret,
                                       const std::string& scope, AuthSession& session) {
-  std::unordered_map<std::string, std::string> form_data = {
+  std::unordered_map<std::string, std::string> form_data{
       {std::string(kGrantType), std::string(kClientCredentials)},
       {std::string(kClientId), client_id},
       {std::string(kClientSecret), client_secret},
   };
   if (!scope.empty()) {
-    form_data[std::string(kScope)] = scope;
+    form_data.emplace(std::string(kScope), scope);
   }
 
   ICEBERG_ASSIGN_OR_RAISE(auto response,

src/iceberg/catalog/rest/auth/oauth2_util.h

@@ -69,38 +69,11 @@ ICEBERG_REST_EXPORT Result<OAuthTokenResponse> FetchToken(
     const std::string& client_secret, const std::string& scope, AuthSession& session);
 
 /// \brief Refresh an expired access token using a refresh_token grant.
-///
-/// Sends a POST request with form-encoded body to the token endpoint:
-///   grant_type=refresh_token&refresh_token=...&client_id=...&scope=...
-///
-/// \param client HTTP client to use for the request.
-/// \param token_endpoint Full URL of the OAuth2 token endpoint.
-/// \param client_id OAuth2 client ID (may be empty if not required by server).
-/// \param refresh_token The refresh token from a previous token response.
-/// \param scope OAuth2 scope to request.
-/// \param session Auth session for the request.
-/// \return A new token response with a fresh access_token, or an error.
 ICEBERG_REST_EXPORT Result<OAuthTokenResponse> RefreshToken(
     HttpClient& client, const std::string& token_endpoint, const std::string& client_id,
     const std::string& refresh_token, const std::string& scope, AuthSession& session);
 
 /// \brief Exchange a token for a scoped token using RFC 8693 Token Exchange.
-///
-/// Sends a POST request with form-encoded body to the token endpoint:
-///   grant_type=urn:ietf:params:oauth:grant-type:token-exchange
-///   &subject_token=...&subject_token_type=...&scope=...
-///
-/// Used by TableSession and ContextualSession to obtain table/context-specific
-/// tokens from a parent session's access token.
-///
-/// \param client HTTP client to use for the request.
-/// \param token_endpoint Full URL of the OAuth2 token endpoint.
-/// \param subject_token The access token to exchange.
-/// \param subject_token_type Token type URI (typically
-///        "urn:ietf:params:oauth:token-type:access_token").
-/// \param scope OAuth2 scope to request for the exchanged token.
-/// \param session Auth session for the request.
-/// \return A new token response with a scoped access_token, or an error.
 ICEBERG_REST_EXPORT Result<OAuthTokenResponse> ExchangeToken(
     HttpClient& client, const std::string& token_endpoint,
     const std::string& subject_token, const std::string& subject_token_type,