feat: JWT auth, minimal ClickHouse Cloud CI

.github/workflows/ci.yml

@@ -17,81 +17,91 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - run: rustup show active-toolchain -v
-    - run: cargo build --all-targets
-    - run: cargo build --all-targets --no-default-features
-    - run: cargo build --all-targets --all-features
+      - uses: actions/checkout@v4
+      - run: rustup show active-toolchain -v
+      - run: cargo build --all-targets
+      - run: cargo build --all-targets --no-default-features
+      - run: cargo build --all-targets --all-features
 
   msrv:
     runs-on: ubuntu-latest
     env:
       RUSTFLAGS: "" # remove -Dwarnings
     steps:
-    - uses: actions/checkout@v4
-    - run: rustup toolchain install ${{ env.MSRV }} --profile minimal
-    - run: rustup override set ${{ env.MSRV }}
-    - run: rustup show active-toolchain -v
-    - run: cargo update -p native-tls --precise 0.2.13 # 0.2.14 requires rustc 1.80
-    - run: cargo update -p litemap --precise 0.7.4 # 0.7.5 requires rustc 1.81
-    - run: cargo update -p zerofrom --precise 0.1.5 # 0.1.6 requires rustc 1.81
-    - run: cargo build
-    - run: cargo build --no-default-features
-    - run: cargo build --features uuid,time,chrono
-    - run: cargo build --all-features
+      - uses: actions/checkout@v4
+      - run: rustup toolchain install ${{ env.MSRV }} --profile minimal
+      - run: rustup override set ${{ env.MSRV }}
+      - run: rustup show active-toolchain -v
+      - run: cargo update -p native-tls --precise 0.2.13 # 0.2.14 requires rustc 1.80
+      - run: cargo update -p litemap --precise 0.7.4 # 0.7.5 requires rustc 1.81
+      - run: cargo update -p zerofrom --precise 0.1.5 # 0.1.6 requires rustc 1.81
+      - run: cargo build
+      - run: cargo build --no-default-features
+      - run: cargo build --features uuid,time,chrono
+      - run: cargo build --all-features
 
   rustfmt:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - run: rustup show active-toolchain -v
-    - run: rustup component add rustfmt
-    - run: cargo fmt --version
-    - run: cargo fmt -- --check
+      - uses: actions/checkout@v4
+      - run: rustup show active-toolchain -v
+      - run: rustup component add rustfmt
+      - run: cargo fmt --version
+      - run: cargo fmt -- --check
 
   clippy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - run: rustup show active-toolchain -v
-    - run: rustup component add clippy
-    - run: cargo clippy --version
-    - run: cargo clippy
-    - run: cargo clippy --all-targets --no-default-features
-    - run: cargo clippy --all-targets --all-features
+      - uses: actions/checkout@v4
+      - run: rustup show active-toolchain -v
+      - run: rustup component add clippy
+      - run: cargo clippy --version
+      - run: cargo clippy
+      - run: cargo clippy --all-targets --no-default-features
+      - run: cargo clippy --all-targets --all-features
 
-    # TLS
-    - run: cargo clippy --features native-tls
-    - run: cargo clippy --features rustls-tls
-    - run: cargo clippy --features rustls-tls-ring,rustls-tls-webpki-roots
-    - run: cargo clippy --features rustls-tls-ring,rustls-tls-native-roots
-    - run: cargo clippy --features rustls-tls-aws-lc,rustls-tls-webpki-roots
-    - run: cargo clippy --features rustls-tls-aws-lc,rustls-tls-native-roots
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - run: rustup show active-toolchain -v
-    - run: cargo test
-    - run: cargo test --no-default-features
-    - run: cargo test --features uuid,time
-    - run: cargo test --all-features
-
-    services:
-      clickhouse:
-        image: clickhouse/clickhouse-server:24.10-alpine
-        ports:
-          - 8123:8123
+      # TLS
+      - run: cargo clippy --features native-tls
+      - run: cargo clippy --features rustls-tls
+      - run: cargo clippy --features rustls-tls-ring,rustls-tls-webpki-roots
+      - run: cargo clippy --features rustls-tls-ring,rustls-tls-native-roots
+      - run: cargo clippy --features rustls-tls-aws-lc,rustls-tls-webpki-roots
+      - run: cargo clippy --features rustls-tls-aws-lc,rustls-tls-native-roots
 
   docs:
     needs: build
     runs-on: ubuntu-latest
     env:
       RUSTDOCFLAGS: -Dwarnings --cfg docsrs
     steps:
-    - uses: actions/checkout@v4
-    - run: rustup toolchain install nightly
-    - run: rustup override set nightly
-    - run: rustup show active-toolchain -v
-    - run: cargo doc --all-features
+      - uses: actions/checkout@v4
+      - run: rustup toolchain install nightly
+      - run: rustup override set nightly
+      - run: rustup show active-toolchain -v
+      - run: cargo doc --all-features
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Start ClickHouse in Docker
+        uses: hoverkraft-tech/[email protected]
+        with:
+          compose-file: 'docker-compose.yml'
+          down-flags: '--volumes'
+
+      - run: rustup show active-toolchain -v
+      - run: cargo test
+      - run: cargo test --no-default-features
+      - run: cargo test --features uuid,time
+      - run: cargo test --all-features
+
+      # Temporary runs tests with `cloud_` prefix only until we validate that the rest of the tests are working
+      - name: Run tests with ClickHouse Cloud
+        env:
+          CLICKHOUSE_TEST_ENVIRONMENT: cloud
+          CLICKHOUSE_CLOUD_HOST: ${{ secrets.INTEGRATIONS_TEAM_TESTS_CLOUD_HOST_SMT }}
+          CLICKHOUSE_CLOUD_PASSWORD: ${{ secrets.INTEGRATIONS_TEAM_TESTS_CLOUD_PASSWORD_SMT }}
+          CLICKHOUSE_CLOUD_JWT_ACCESS_TOKEN: ${{ secrets.INTEGRATIONS_TEAM_TESTS_CLOUD_JWT_DESERT_VM_43 }}
+        run: |
+          cargo test cloud_ --features rustls-tls -- --nocapture

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 <!-- next-header -->
 
 ## [Unreleased] - ReleaseDate
+### Added
+- client: added `Client::with_access_token` to support JWT authentication ClickHouse Cloud feature ([#215]).
+
+[#215]: https://github.com/ClickHouse/clickhouse-rs/pull/215
 
 ## [0.13.2] - 2025-03-12
 ### Added

src/headers.rs

@@ -1,5 +1,5 @@
-use crate::ProductInfo;
-use hyper::header::USER_AGENT;
+use crate::{Authentication, ProductInfo};
+use hyper::header::{AUTHORIZATION, USER_AGENT};
 use hyper::http::request::Builder;
 use std::collections::HashMap;
 use std::env::consts::OS;
@@ -22,6 +22,7 @@ fn get_user_agent(products_info: &[ProductInfo]) -> String {
     }
 }
 
+#[inline]
 pub(crate) fn with_request_headers(
     mut builder: Builder,
     headers: &HashMap<String, String>,
@@ -33,3 +34,22 @@ pub(crate) fn with_request_headers(
     builder = builder.header(USER_AGENT.to_string(), get_user_agent(products_info));
     builder
 }
+
+#[inline]
+pub(crate) fn with_authentication(mut builder: Builder, auth: &Authentication) -> Builder {
+    match auth {
+        Authentication::Jwt { access_token } => {
+            let bearer = format!("Bearer {access_token}");
+            builder = builder.header(AUTHORIZATION, bearer);
+        }
+        Authentication::Credentials { user, password } => {
+            if let Some(user) = &user {
+                builder = builder.header("X-ClickHouse-User", user);
+            }
+            if let Some(password) = &password {
+                builder = builder.header("X-ClickHouse-Key", password);
+            }
+        }
+    }
+    builder
+}

src/insert.rs

@@ -10,7 +10,7 @@ use tokio::{
 };
 use url::Url;
 
-use crate::headers::with_request_headers;
+use crate::headers::{with_authentication, with_request_headers};
 use crate::{
     error::{Error, Result},
     request_body::{ChunkSender, RequestBody},
@@ -353,14 +353,7 @@ impl<T> Insert<T> {
 
         let mut builder = Request::post(url.as_str());
         builder = with_request_headers(builder, &client.headers, &client.products_info);
-
-        if let Some(user) = &client.user {
-            builder = builder.header("X-ClickHouse-User", user);
-        }
-
-        if let Some(password) = &client.password {
-            builder = builder.header("X-ClickHouse-Key", password);
-        }
+        builder = with_authentication(builder, &client.authentication);
 
         let (sender, body) = RequestBody::chunked();