Add OAuth2 login to clickhouse-client (--login / --login=device)

[BorisTyshkevich]

Summary

Adds --login and --login=device flags to clickhouse-client so users can authenticate via an OpenID Connect provider without manually obtaining a JWT token.

• --login (bare) — ClickHouse Cloud auto-login path; provider is inferred from the server (existing cloud behaviour, no credentials file needed)
• --login=browser — Authorization Code + PKCE flow (RFC 7636); opens a browser, captures the callback on a one-shot localhost server, exchanges the code for an ID token
• --login=device — Device Authorization flow (RFC 8628); prints a URL + short code, polls the token endpoint; works in headless/SSH environments
• --oauth-credentials <path> — path to a Google-Cloud-Console-format JSON credentials file (default ~/.clickhouse-client/oauth_client.json)

Refresh tokens are cached in ~/.clickhouse-client/oauth_cache.json (mode 0600). Subsequent runs reuse the cached token silently.

Both flows produce an ID token that is passed to the existing --jwt path; no changes to the server or connection layer.

New files

File	Purpose
src/Client/OAuthLogin.h	OAuthCredentials struct, loadOAuthCredentials, obtainIDToken
src/Client/OAuthLogin.cpp	Full OAuth2/PKCE/Device implementation (gated on USE_JWT_CPP && USE_SSL)
src/Client/tests/gtest_oauth_login.cpp	11 unit tests: credential loading, PKCE building blocks

Modified files

File	Change
programs/client/Client.cpp	--login[=<mode>], --oauth-credentials flags; option validation; cloud vs. OIDC dispatch
src/Access/TokenProcessorsOpaque.cpp	Fix picojson long/double specialization gap for Google JWT exp on arm64
docs/en/interfaces/cli.md	Document new flags; add OAuth credentials file format section
tests/queries/0_stateless/03749_cloud_endpoint_auth_precedence.sh	Tests 9–11: missing credentials file, invalid mode, --jwt+--login conflict

Test plan

• Unit tests (unit_tests_dbms --gtest_filter='OAuthLogin*') pass
• 03749_cloud_endpoint_auth_precedence stateless test passes
• --login=device --oauth-credentials ~/.clickhouse-client/oauth_client-tv.json against a real OIDC provider completes and returns an ID token
• Second run reuses cached refresh token silently
• --login=invalid → BAD_ARGUMENTS
• --jwt tok --login → BAD_ARGUMENTS
• Build without SSL (USE_JWT_CPP=0) → SUPPORT_IS_DISABLED

🤖 Generated with Claude Code

[github-actions]

Workflow [PR], commit [1cb506a]

[zvonand]

exp means the number of seconds since Unix epoch. Usually it is integer, and it is expected to be integer, isn\t it?
At least, Azure and Keycloak stick to integer values.

[BorisTyshkevich]

// picojson only has one numeric type: double
typedef double number_type;

So value.is() returns false, value.is<time_t>() returns false, but value.is() returns true — for any JSON number, including 1719500000.

The original code getValueByKey<time_t>(token_info, "exp") would always fail with "Value for key 'exp' has incorrect type" because picojson doesn't have time_t as a native type. The double fix is actually the
correct fix for picojson's type system.

So I retract my earlier comment. Using double is not "accidentally working" — it's the only way to extract a number from picojson. The static_cast<time_t> then truncates to integer, which is fine since the
value was integer to begin with (JSON 1719500000 → picojson double(1719500000.0) → time_t(1719500000)).

The commit message and the fix are correct. If anything, a brief comment explaining picojson's type model would help future readers:

// picojson stores all JSON numbers as double; cast to time_t for epoch seconds.

But that's a style nit, not a bug.

[BorisTyshkevich]

App config for github.demo.altinity.cloud (not a secret!)

$ cat ~/.clickhouse-client/oauth_client-tv.json
{"installed":{"client_id":"925653064731-d1onu9jr6rdbpmeh41ast4t48cppbvvs.apps.googleusercontent.com","project_id":"altinity-mcp-oauth-test","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"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"}}

 $ cat ~/.clickhouse-client/oauth_client.json
{"installed":{"client_id":"925653064731-fnr56jga567r94470drdnjvvf6lbkf0r.apps.googleusercontent.com","project_id":"altinity-mcp-oauth-test","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"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","redirect_uris":["http://localhost"]}}

[zvonand]

@BorisTyshkevich This PR was made into a stub branch -- I will squash its commits and rebase atop 26.1. I will also make my amendments.
No action needed from your side for now.