feat(authentication): [DRAFT] Refactor Authentication and add Facebook Login

[Neilk1021]

What changes were proposed in this PR?

Refactors authentication to decouple identity from credentials: all auth material moves out of the "user" table into a dedicated auth_provider table, external-provider login (Google, Facebook) is unified behind a single provisioning path, and Facebook OAuth is added as a new login option.

1. Schema split — new auth_provider table. The "user" table drops password, google_id, google_avatar, and the old ck_nulltest CHECK, and gains a provider-neutral avatar column. A new provider_type_enum ('LOCAL','GOOGLE','FACEBOOK') and auth_provider (uid, provider_type, provider_id, password, created_at) table are added, with PRIMARY KEY (uid, provider_type), an FK to "user"(uid) ON DELETE CASCADE, uq_provider_identity UNIQUE (provider_type, provider_id), and ck_provider_credential (LOCAL ⇒ password set / provider_id null; non-LOCAL ⇒ provider_id set / password null) replacing ck_nulltest. Liquibase migration sql/updates/29.sql (registered in sql/changelog.xml) creates the enum + table and backfills LOCAL rows from user.password and GOOGLE rows from user.google_id. The jOOQ AuthProvider table/dao/pojo and ProviderTypeEnum are regenerated from the new DDL.

2. Shared ExternalAuthProvisioner abstraction. New object ExternalAuthProvisioner that both Google and Facebook login route through. Given an ExternalProfile(providerType, providerId, name, email, avatar: Option[String]), loginOrProvision runs a single transaction that resolves the user by provider identity → else by email → else creates an INACTIVE user, then upserts the provider row (guarding the (uid, provider_type) PK against collision) and refreshes name/email/avatar. avatar is optional so a Facebook login (no avatar) never clobbers an avatar set by Google.

3. Facebook OAuth (new). FacebookAuthResource at /auth/facebook (GET /clientid, POST /login) verifies the access token via the Graph API debug_token + /me endpoints, falling back to {id}@facebook.local when Facebook returns no email. Config gains facebook.clientId / facebook.appSecret (envs USER_SYS_FACEBOOK_CLIENT_ID / USER_SYS_FACEBOOK_APP_SECRET) with matching UserSystemConfig accessors.

4. Google + local login retargeted to the new schema. GoogleAuthResource drops its inline DAO logic and delegates to ExternalAuthProvisioner. Local login (AuthResource) now joins auth_provider on PROVIDER_TYPE = LOCAL and checks the hashed password there; registration and admin bootstrap write the user row + a LOCAL provider row atomically via a new private InsertUser. AdminUserResource/UserResource and related resources rebind avatar onto user.

5. JWT claims simplified. JwtAuth.jwtClaims emits a single avatar claim instead of googleId/googleAvatar; JwtParser and SessionUser are updated to match (SessionUser.getGoogleId removed), constructing User via setters rather than the old positional constructor.

6. Frontend. New consolidated login page (texera-login.component) with tabbed local sign-in/sign-up plus Google and Facebook buttons; new FacebookAuthService; the User type and auth.service JWT decode swap googleId/googleAvatar for avatar; app.module registers a FacebookLoginProvider alongside Google, resolving both client ids in parallel.

7. Tests. New: ExternalAuthProvisionerSpec (embedded-Postgres integration over the full provisioning matrix), facebook-auth.service.spec.ts, texera-login.component.spec.ts. Updated: JwtAuth/JwtParser/SessionUser/UserAuthenticator specs for the avatar-claim change, plus a repo-wide sweep dropping user.setPassword(...) from existing specs to match the new schema.

Any related issues, documentation, discussions?

Closes #6718. The design rationale and coupling points that drove this split (the jwtClaims provider fields, the ck_nulltest CHECK, the DAO-per-resource pattern, and the frontend User shape) are documented in auth-split-notes.md. No other tracked issues.

How was this PR tested?

Auth-specific suites were run and are green:

• Backend (sbt, ScalaTest): ExternalAuthProvisionerSpec runs against embedded Postgres (MockTexeraDB loads the real sql/texera_ddl.sql, so the auth_provider constraints are live) — 7/7, covering new-identity provisioning, returning-identity idempotency, profile refresh, the Facebook-avatar-not-clobbered case, email-match linking, and provider-id upsert. JwtAuthSpec — 5/5, including the new avatar claim.
• Frontend (ng test / Vitest): facebook-auth.service.spec.ts + texera-login.component.spec.ts — 22/22, covering local login/register validation and navigation, social sign-in routing (Google vs Facebook), the confirm-password validator, and error paths.

Commands:

sbt "Auth/testOnly org.apache.texera.auth.JwtAuthSpec" \
    "WorkflowExecutionService/testOnly org.apache.texera.web.resource.auth.ExternalAuthProvisionerSpec"
npx ng test --watch=false \
  --include="src/app/common/service/user/facebook-auth.service.spec.ts" \
  --include="src/app/hub/component/login/texera-login.component.spec.ts"

A full sbt clean compile test + complete frontend suite run is still recommended before merge (the schema-matching spec sweep touches many modules).

Was this PR authored or co-authored using generative AI tooling?

Yes. This PR was co-authored with Claude Opus 4.8. The overall architecture and design decisions were the author's; Claude assisted with implementing much of the code and the accompanying tests.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @Yicong-Huang, @Ma77Ball, @jaeyun0503
  You can notify them by mentioning @Yicong-Huang, @Ma77Ball, @jaeyun0503 in a comment.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 61.84211% with 116 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.42%. Comparing base (0467c76) to head (596ec59).
⚠️ Report is 87 commits behind head on main.

Files with missing lines	Patch %	Lines
...che/texera/web/resource/FacebookAuthResource.scala	0.00%	39 Missing ⚠️
...pp/hub/component/login/texera-login.component.html	79.01%	15 Missing and 2 partials ⚠️
...apache/texera/web/resource/auth/AuthResource.scala	0.00%	13 Missing ⚠️
...ource/dashboard/admin/user/AdminUserResource.scala	0.00%	10 Missing ⚠️
.../app/hub/component/login/texera-login.component.ts	87.67%	4 Missing and 5 partials ⚠️
.../texera/web/resource/auth/GoogleAuthResource.scala	0.00%	8 Missing ⚠️
...ra/web/resource/auth/ExternalAuthProvisioner.scala	83.33%	3 Missing and 2 partials ⚠️
...era/web/resource/dashboard/user/UserResource.scala	0.00%	4 Missing ⚠️
...g/apache/texera/web/ServletAwareConfigurator.scala	0.00%	2 Missing ⚠️
...ontend/src/app/common/service/user/user.service.ts	0.00%	2 Missing ⚠️
... and 7 more

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #6720      +/-   ##
============================================
+ Coverage     74.65%   76.42%   +1.76%     
+ Complexity     3438     3435       -3     
============================================
  Files          1160     1166       +6     
  Lines         45793    46094     +301     
  Branches       5069     5116      +47     
============================================
+ Hits          34189    35228    +1039     
+ Misses         9953     9322     -631     
+ Partials       1651     1544     -107     

Flag	Coverage Δ		*Carryforward flag
access-control-service	70.00% <ø> (ø)
agent-service	76.76% <ø> (ø)		Carriedforward from a06f570
amber	66.78% <33.06%> (-0.03%)	⬇️	Carriedforward from a06f570
computing-unit-managing-service	18.00% <0.00%> (ø)		Carriedforward from a06f570
config-service	66.66% <ø> (ø)
file-service	67.21% <ø> (+0.40%)	⬆️
frontend	82.56% <82.12%> (+3.99%)	⬆️
notebook-migration-service	78.94% <ø> (ø)
pyamber	91.99% <ø> (ø)		Carriedforward from a06f570
workflow-compiling-service	55.14% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📊 Arrow Flight E2E bench

(no arrow-flight-e2e.csv in artifact)

Full dashboard · Workflow run

[aglinxinyuan]

Please separate the consolidated login page, the authentication refactor, and the Facebook Login implementation into three separate PRs. These changes are independent and can be developed and reviewed separately without any dependencies on one another.