Ability to read root credentials from file when bootstrapping

extension/persistence/eclipselink/src/main/java/org/apache/polaris/extension/persistence/impl/eclipselink/EclipseLinkPolarisMetaStoreManagerFactory.java

@@ -29,9 +29,9 @@
 import org.apache.polaris.core.PolarisDiagnostics;
 import org.apache.polaris.core.context.RealmContext;
 import org.apache.polaris.core.persistence.LocalPolarisMetaStoreManagerFactory;
-import org.apache.polaris.core.persistence.PolarisCredentialsBootstrap;
 import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
 import org.apache.polaris.core.persistence.PolarisMetaStoreSession;
+import org.apache.polaris.core.persistence.bootstrap.RootCredentialsSet;
 import org.apache.polaris.core.storage.PolarisStorageIntegrationProvider;
 
 /**
@@ -72,15 +72,15 @@ protected PolarisEclipseLinkStore createBackingStore(@Nonnull PolarisDiagnostics
   protected PolarisMetaStoreSession createMetaStoreSession(
       @Nonnull PolarisEclipseLinkStore store,
       @Nonnull RealmContext realmContext,
-      @Nullable PolarisCredentialsBootstrap credentialsBootstrap,
+      @Nullable RootCredentialsSet rootCredentialsSet,
       @Nonnull PolarisDiagnostics diagnostics) {
     return new PolarisEclipseLinkMetaStoreSessionImpl(
         store,
         storageIntegrationProvider,
         realmContext,
         configurationFile(),
         persistenceUnitName(),
-        secretsGenerator(realmContext, credentialsBootstrap),
+        secretsGenerator(realmContext, rootCredentialsSet),
         diagnostics);
   }
 

polaris-core/build.gradle.kts

@@ -44,6 +44,9 @@ dependencies {
   compileOnly(libs.jetbrains.annotations)
   compileOnly(libs.spotbugs.annotations)
 
+  compileOnly(project(":polaris-immutables"))
+  annotationProcessor(project(":polaris-immutables", configuration = "processor"))
+
   constraints {
     implementation("org.xerial.snappy:snappy-java:1.1.10.7") {
       because("Vulnerability detected in 1.1.8.2")

polaris-core/src/main/java/org/apache/polaris/core/persistence/LocalPolarisMetaStoreManagerFactory.java

@@ -34,6 +34,7 @@
 import org.apache.polaris.core.entity.PolarisEntitySubType;
 import org.apache.polaris.core.entity.PolarisEntityType;
 import org.apache.polaris.core.entity.PolarisPrincipalSecrets;
+import org.apache.polaris.core.persistence.bootstrap.RootCredentialsSet;
 import org.apache.polaris.core.persistence.cache.EntityCache;
 import org.apache.polaris.core.storage.cache.StorageCredentialCache;
 import org.slf4j.Logger;
@@ -71,26 +72,25 @@ protected LocalPolarisMetaStoreManagerFactory(
   protected abstract PolarisMetaStoreSession createMetaStoreSession(
       @Nonnull StoreType store,
       @Nonnull RealmContext realmContext,
-      @Nullable PolarisCredentialsBootstrap credentialsBootstrap,
+      @Nullable RootCredentialsSet rootCredentialsSet,
       @Nonnull PolarisDiagnostics diagnostics);
 
   protected PrincipalSecretsGenerator secretsGenerator(
-      RealmContext realmContext, @Nullable PolarisCredentialsBootstrap credentialsBootstrap) {
-    if (credentialsBootstrap != null) {
+      RealmContext realmContext, @Nullable RootCredentialsSet rootCredentialsSet) {
+    if (rootCredentialsSet != null) {
       return PrincipalSecretsGenerator.bootstrap(
-          realmContext.getRealmIdentifier(), credentialsBootstrap);
+          realmContext.getRealmIdentifier(), rootCredentialsSet);
     } else {
       return PrincipalSecretsGenerator.RANDOM_SECRETS;
     }
   }
 
   private void initializeForRealm(
-      RealmContext realmContext, PolarisCredentialsBootstrap credentialsBootstrap) {
+      RealmContext realmContext, RootCredentialsSet rootCredentialsSet) {
     final StoreType backingStore = createBackingStore(diagnostics);
     sessionSupplierMap.put(
         realmContext.getRealmIdentifier(),
-        () ->
-            createMetaStoreSession(backingStore, realmContext, credentialsBootstrap, diagnostics));
+        () -> createMetaStoreSession(backingStore, realmContext, rootCredentialsSet, diagnostics));
 
     PolarisMetaStoreManager metaStoreManager =
         new PolarisMetaStoreManagerImpl(realmContext, diagnostics, configurationStore, clock);
@@ -99,13 +99,13 @@ private void initializeForRealm(
 
   @Override
   public synchronized Map<String, PrincipalSecretsResult> bootstrapRealms(
-      List<String> realms, PolarisCredentialsBootstrap credentialsBootstrap) {
+      List<String> realms, RootCredentialsSet rootCredentialsSet) {
     Map<String, PrincipalSecretsResult> results = new HashMap<>();
 
     for (String realm : realms) {
       RealmContext realmContext = () -> realm;
       if (!metaStoreManagerMap.containsKey(realmContext.getRealmIdentifier())) {
-        initializeForRealm(realmContext, credentialsBootstrap);
+        initializeForRealm(realmContext, rootCredentialsSet);
         PrincipalSecretsResult secretsResult =
             bootstrapServiceAndCreatePolarisPrincipalForRealm(
                 realmContext, metaStoreManagerMap.get(realmContext.getRealmIdentifier()));

polaris-core/src/main/java/org/apache/polaris/core/persistence/MetaStoreManagerFactory.java

@@ -23,6 +23,7 @@
 import java.util.function.Supplier;
 import org.apache.polaris.core.auth.PolarisSecretsManager.PrincipalSecretsResult;
 import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.core.persistence.bootstrap.RootCredentialsSet;
 import org.apache.polaris.core.persistence.cache.EntityCache;
 import org.apache.polaris.core.storage.cache.StorageCredentialCache;
 
@@ -38,7 +39,7 @@ public interface MetaStoreManagerFactory {
   EntityCache getOrCreateEntityCache(RealmContext realmContext);
 
   Map<String, PrincipalSecretsResult> bootstrapRealms(
-      List<String> realms, PolarisCredentialsBootstrap credentialsBootstrap);
+      List<String> realms, RootCredentialsSet rootCredentialsSet);
 
   /** Purge all metadata for the realms provided */
   void purgeRealms(List<String> realms);

polaris-core/src/main/java/org/apache/polaris/core/persistence/PrincipalSecretsGenerator.java

@@ -21,7 +21,9 @@
 import jakarta.annotation.Nonnull;
 import jakarta.annotation.Nullable;
 import java.util.Optional;
+import org.apache.polaris.core.entity.PolarisEntityConstants;
 import org.apache.polaris.core.entity.PolarisPrincipalSecrets;
+import org.apache.polaris.core.persistence.bootstrap.RootCredentialsSet;
 
 /**
  * An interface for generating principal secrets. It enables detaching the secret generation logic
@@ -31,8 +33,8 @@
  * ID and secret overrides via system properties or environment variables, which can be useful for
  * bootstrapping new realms.
  *
- * <p>See {@link PolarisCredentialsBootstrap} for more information on the expected environment
- * variable name, and the format of the bootstrap credentials.
+ * <p>See {@link RootCredentialsSet} for more information on the expected environment variable name,
+ * and the format of the bootstrap credentials.
  */
 @FunctionalInterface
 public interface PrincipalSecretsGenerator {
@@ -56,14 +58,37 @@ public interface PrincipalSecretsGenerator {
   PolarisPrincipalSecrets produceSecrets(@Nonnull String principalName, long principalId);
 
   static PrincipalSecretsGenerator bootstrap(String realmName) {
-    return bootstrap(realmName, PolarisCredentialsBootstrap.fromEnvironment());
+    return bootstrap(realmName, RootCredentialsSet.fromEnvironment());
   }
 
   static PrincipalSecretsGenerator bootstrap(
-      String realmName, @Nullable PolarisCredentialsBootstrap credentialsSupplier) {
+      String realmName, @Nullable RootCredentialsSet rootCredentialsSet) {
     return (principalName, principalId) ->
-        Optional.ofNullable(credentialsSupplier)
-            .flatMap(credentials -> credentials.getSecrets(realmName, principalId, principalName))
+        Optional.ofNullable(rootCredentialsSet)
+            .flatMap(
+                credentialsSet -> getSecrets(realmName, principalName, principalId, credentialsSet))
             .orElseGet(() -> RANDOM_SECRETS.produceSecrets(principalName, principalId));
   }
+
+  /**
+   * Get the secrets for the specified principal in the specified realm, if available among the
+   * credentials that were supplied for bootstrap. Only credentials for the root principal are
+   * supported.
+   */
+  private static Optional<PolarisPrincipalSecrets> getSecrets(
+      String realmName,
+      String principalName,
+      long principalId,
+      RootCredentialsSet rootCredentialsSet) {
+    if (principalName.equals(PolarisEntityConstants.getRootPrincipalName())) {
+      return Optional.ofNullable(rootCredentialsSet.credentials().get(realmName))
+          .map(
+              credentials -> {
+                String clientId = credentials.clientId();
+                String secret = credentials.clientSecret();
+                return new PolarisPrincipalSecrets(principalId, clientId, secret, secret);
+              });
+    }
+    return Optional.empty();
+  }
 }

polaris-core/src/main/java/org/apache/polaris/core/persistence/bootstrap/RootCredentials.java

@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.core.persistence.bootstrap;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import org.apache.polaris.immutables.PolarisImmutable;
+import org.immutables.value.Value;
+
+@PolarisImmutable
+@JsonSerialize(as = ImmutableRootCredentials.class)
+@JsonDeserialize(as = ImmutableRootCredentials.class)
+public interface RootCredentials {
+
+  @Value.Parameter(order = 1)
+  @JsonProperty("client-id")
+  String clientId();
+
+  @Value.Parameter(order = 2)
+  @Value.Redacted
+  @JsonProperty("client-secret")
+  String clientSecret();
+
+  @Value.Check
+  default void check() {
+    if (clientId().isEmpty()) {
+      throw new IllegalArgumentException("clientId cannot be empty");
+    }
+    if (clientSecret().isEmpty()) {
+      throw new IllegalArgumentException("clientSecret cannot be empty");
+    }
+  }
+}