feat(authentication): [DRAFT] Refactor Authentication and add Facebook Login

[Neilk1021]

What changes were proposed in this PR?

Refactors authentication to decouple identity from credentials: all auth material moves out of the "user" table into a dedicated auth_provider table, external-provider login (Google, Facebook) is unified behind a single provisioning path, and Facebook OAuth is added as a new login option.

1. Schema split — new auth_provider table. The "user" table drops password, google_id, google_avatar, and the old ck_nulltest CHECK, and gains a provider-neutral avatar column. A new provider_type_enum ('LOCAL','GOOGLE','FACEBOOK') and auth_provider (uid, provider_type, provider_id, password, created_at) table are added, with PRIMARY KEY (uid, provider_type), an FK to "user"(uid) ON DELETE CASCADE, uq_provider_identity UNIQUE (provider_type, provider_id), and ck_provider_credential (LOCAL ⇒ password set / provider_id null; non-LOCAL ⇒ provider_id set / password null) replacing ck_nulltest. Liquibase migration sql/updates/29.sql (registered in sql/changelog.xml) creates the enum + table and backfills LOCAL rows from user.password and GOOGLE rows from user.google_id. The jOOQ AuthProvider table/dao/pojo and ProviderTypeEnum are regenerated from the new DDL.

2. Shared ExternalAuthProvisioner abstraction. New object ExternalAuthProvisioner that both Google and Facebook login route through. Given an ExternalProfile(providerType, providerId, name, email, avatar: Option[String]), loginOrProvision runs a single transaction that resolves the user by provider identity → else by email → else creates an INACTIVE user, then upserts the provider row (guarding the (uid, provider_type) PK against collision) and refreshes name/email/avatar. avatar is optional so a Facebook login (no avatar) never clobbers an avatar set by Google.

3. Facebook OAuth (new). FacebookAuthResource at /auth/facebook (GET /clientid, POST /login) verifies the access token via the Graph API debug_token + /me endpoints, falling back to {id}@facebook.local when Facebook returns no email. Config gains facebook.clientId / facebook.appSecret (envs USER_SYS_FACEBOOK_CLIENT_ID / USER_SYS_FACEBOOK_APP_SECRET) with matching UserSystemConfig accessors.

4. Google + local login retargeted to the new schema. GoogleAuthResource drops its inline DAO logic and delegates to ExternalAuthProvisioner. Local login (AuthResource) now joins auth_provider on PROVIDER_TYPE = LOCAL and checks the hashed password there; registration and admin bootstrap write the user row + a LOCAL provider row atomically via a new private InsertUser. AdminUserResource/UserResource and related resources rebind avatar onto user.

5. JWT claims simplified. JwtAuth.jwtClaims emits a single avatar claim instead of googleId/googleAvatar; JwtParser and SessionUser are updated to match (SessionUser.getGoogleId removed), constructing User via setters rather than the old positional constructor.

6. Frontend. New consolidated login page (texera-login.component) with tabbed local sign-in/sign-up plus Google and Facebook buttons; new FacebookAuthService; the User type and auth.service JWT decode swap googleId/googleAvatar for avatar; app.module registers a FacebookLoginProvider alongside Google, resolving both client ids in parallel.

7. Tests. New: ExternalAuthProvisionerSpec (embedded-Postgres integration over the full provisioning matrix), facebook-auth.service.spec.ts, texera-login.component.spec.ts. Updated: JwtAuth/JwtParser/SessionUser/UserAuthenticator specs for the avatar-claim change, plus a repo-wide sweep dropping user.setPassword(...) from existing specs to match the new schema.

Any related issues, documentation, discussions?

Closes #6718. The design rationale and coupling points that drove this split (the jwtClaims provider fields, the ck_nulltest CHECK, the DAO-per-resource pattern, and the frontend User shape) are documented in auth-split-notes.md. No other tracked issues.

How was this PR tested?

Auth-specific suites were run and are green:

• Backend (sbt, ScalaTest): ExternalAuthProvisionerSpec runs against embedded Postgres (MockTexeraDB loads the real sql/texera_ddl.sql, so the auth_provider constraints are live) — 7/7, covering new-identity provisioning, returning-identity idempotency, profile refresh, the Facebook-avatar-not-clobbered case, email-match linking, and provider-id upsert. JwtAuthSpec — 5/5, including the new avatar claim.
• Frontend (ng test / Vitest): facebook-auth.service.spec.ts + texera-login.component.spec.ts — 22/22, covering local login/register validation and navigation, social sign-in routing (Google vs Facebook), the confirm-password validator, and error paths.

Commands:

sbt "Auth/testOnly org.apache.texera.auth.JwtAuthSpec" \
    "WorkflowExecutionService/testOnly org.apache.texera.web.resource.auth.ExternalAuthProvisionerSpec"
npx ng test --watch=false \
  --include="src/app/common/service/user/facebook-auth.service.spec.ts" \
  --include="src/app/hub/component/login/texera-login.component.spec.ts"

A full sbt clean compile test + complete frontend suite run is still recommended before merge (the schema-matching spec sweep touches many modules).

Was this PR authored or co-authored using generative AI tooling?

Yes. This PR was co-authored with Claude Opus 4.8. The overall architecture and design decisions were the author's; Claude assisted with implementing much of the code and the accompanying tests.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @Yicong-Huang, @Ma77Ball, @jaeyun0503
  You can notify them by mentioning @Yicong-Huang, @Ma77Ball, @jaeyun0503 in a comment.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 61.76471% with 117 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.66%. Comparing base (0467c76) to head (a06f570).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...che/texera/web/resource/FacebookAuthResource.scala	0.00%	39 Missing ⚠️
...pp/hub/component/login/texera-login.component.html	79.01%	15 Missing and 2 partials ⚠️
...apache/texera/web/resource/auth/AuthResource.scala	0.00%	13 Missing ⚠️
...ource/dashboard/admin/user/AdminUserResource.scala	0.00%	11 Missing ⚠️
.../app/hub/component/login/texera-login.component.ts	87.67%	4 Missing and 5 partials ⚠️
.../texera/web/resource/auth/GoogleAuthResource.scala	0.00%	8 Missing ⚠️
...ra/web/resource/auth/ExternalAuthProvisioner.scala	83.87%	3 Missing and 2 partials ⚠️
...era/web/resource/dashboard/user/UserResource.scala	0.00%	4 Missing ⚠️
...g/apache/texera/web/ServletAwareConfigurator.scala	0.00%	2 Missing ⚠️
...ontend/src/app/common/service/user/user.service.ts	0.00%	2 Missing ⚠️
... and 7 more

Additional details and impacted files

@@            Coverage Diff             @@
##               main    #6720    +/-   ##
==========================================
  Coverage     74.65%   74.66%            
+ Complexity     3438     3434     -4     
==========================================
  Files          1160     1165     +5     
  Lines         45793    45979   +186     
  Branches       5069     5085    +16     
==========================================
+ Hits          34189    34328   +139     
- Misses         9953     9988    +35     
- Partials       1651     1663    +12     

Flag	Coverage Δ		*Carryforward flag
access-control-service	70.00% <ø> (ø)
agent-service	76.76% <ø> (ø)		Carriedforward from b68ad93
amber	66.77% <33.33%> (-0.04%)	⬇️	Carriedforward from b68ad93
computing-unit-managing-service	18.00% <0.00%> (ø)
config-service	66.66% <ø> (ø)
file-service	66.80% <ø> (ø)
frontend	78.58% <82.12%> (+0.01%)	⬆️
notebook-migration-service	78.94% <ø> (ø)
pyamber	91.99% <ø> (ø)		Carriedforward from b68ad93
workflow-compiling-service	55.14% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Benchmark changes need a look

🟢 0 better · 🔴 15 worse · ⚪ 0 noise (<±5%) · 0 without baseline

CI benchmark results are noisy; treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	393	0.24	23,854/33,467/33,467 us	🔴 +100.7% / 🔴 +111.6%
🔴	bs=100 sw=10 sl=64	792	0.483	127,499/153,267/153,267 us	🔴 +56.6% / 🔴 +46.0%
🔴	bs=1000 sw=10 sl=64	916	0.559	1,099,026/1,123,124/1,123,124 us	🔴 +22.8% / 🔴 +14.0%

Baseline details

Latest main 0467c76 from 2026-07-21T13:20:34.790Z

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	393 tuples/sec	802.41 tuples/sec	769.76 tuples/sec	-51.0%	-48.9%
bs=10 sw=10 sl=64	MB/s	0.24 MB/s	0.49 MB/s	0.47 MB/s	-51.0%	-48.9%
bs=10 sw=10 sl=64	p50	23,854 us	11,884 us	12,663 us	+100.7%	+88.4%
bs=10 sw=10 sl=64	p95	33,467 us	16,737 us	15,813 us	+100.0%	+111.6%
bs=10 sw=10 sl=64	p99	33,467 us	17,893 us	19,001 us	+87.0%	+76.1%
bs=100 sw=10 sl=64	throughput	792 tuples/sec	1,086 tuples/sec	1,009 tuples/sec	-27.0%	-21.5%
bs=100 sw=10 sl=64	MB/s	0.483 MB/s	0.663 MB/s	0.616 MB/s	-27.1%	-21.6%
bs=100 sw=10 sl=64	p50	127,499 us	91,919 us	99,444 us	+38.7%	+28.2%
bs=100 sw=10 sl=64	p95	153,267 us	97,845 us	105,012 us	+56.6%	+46.0%
bs=100 sw=10 sl=64	p99	153,267 us	105,973 us	116,467 us	+44.6%	+31.6%
bs=1000 sw=10 sl=64	throughput	916 tuples/sec	1,112 tuples/sec	1,044 tuples/sec	-17.6%	-12.3%
bs=1000 sw=10 sl=64	MB/s	0.559 MB/s	0.679 MB/s	0.637 MB/s	-17.6%	-12.3%
bs=1000 sw=10 sl=64	p50	1,099,026 us	894,788 us	964,034 us	+22.8%	+14.0%
bs=1000 sw=10 sl=64	p95	1,123,124 us	953,590 us	1,007,497 us	+17.8%	+11.5%
bs=1000 sw=10 sl=64	p99	1,123,124 us	988,019 us	1,040,936 us	+13.7%	+7.9%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,508.29,200,128000,393,0.240,23854.01,33466.88,33466.88
1,100,10,64,20,2525.22,2000,1280000,792,0.483,127499.01,153266.59,153266.59
2,1000,10,64,20,21832.22,20000,12800000,916,0.559,1099026.01,1123124.23,1123124.23

[aglinxinyuan]

Please separate the consolidated login page, the authentication refactor, and the Facebook Login implementation into three separate PRs. These changes are independent and can be developed and reviewed separately without any dependencies on one another.