feat(access-control-service): add access-control-service to authorize the requests to /wsapi and Computing Unit endpoints

[aicam]

Access Control Service

This service is currently used only by envoy as authorization service. It act as a third party service to authorize any request sent to the computing unit to get socket connection through /wsapi. It parses the user-token from URL parameters and then check user access to the computing unit by checking the database and add the corresponding information to the following headers:

• x-user-cu-access
• x-user-id
• x-user-name
• x-user-email
  If the service can not parse the token or fail for any reason, the access to computing unit is denied by envoy. If the authorization succeed, the user is directly connected to computing unit using Upgrade on the first HTTP handshake request so the latency will not change.

The new connection flow

1. A user initiates an HTTP request to connect to a specific Computing Unit.
2. The request is first routed through the Gateway to Envoy.
3. Envoy pauses the request and sends a query to the Access Control Service to get an authorization decision.
4. The Access Control Service verifies the user's token and checks a PostgreSQL database to see if the user has the necessary permissions for the target Computing Unit.
5. If authorized, the service injects specific HTTP headers (x-user-cu-access, x-user-id, x-user-name) into the request and sends an approval back to Envoy.
6. Envoy then forwards the approved request to the Computing Unit.
7. The connection is then upgraded to a WebSocket, establishing a secure, interactive session.

If authorization fails at any point, Envoy immediately denies the connection request, and the user is prevented from accessing the Computing Unit. This new process provides enhanced security, a centralized authorization logic, and is designed to have no performance impact on the established WebSocket connection since the check is performed only on the initial handshake.

Summary of file changes

Component/Flow	File	Description
Database Access Logic	core/auth/src/main/scala/edu/uci/ics/texera/auth/util/ComputingUnitAccess.scala	Implements the logic to query the PostgreSQL database and determine a user's access privilege (READ, WRITE, NONE) for a given Computing Unit.
	core/auth/src/main/scala/edu/uci/ics/texera/auth/util/HeaderField.scala	Defines constants for the custom HTTP headers (x-user-cu-access, x-user-id, etc.) that are injected by the Access Control Service.
WebSocket Connection Handling	core/amber/src/main/scala/edu/uci/ics/texera/web/ServletAwareConfigurator.scala	Modified to read the new authorization headers during the WebSocket handshake. If headers are present, it creates the User object from them; otherwise, it falls back to the old method of parsing the JWT from URL parameters for single-node mode.
	core/amber/src/main/scala/edu/uci/ics/texera/web/SessionState.scala	Updated to store the user's access privilege level for the current computing unit within the session.
	core/amber/src/main/scala/edu/uci/ics/texera/web/resource/WorkflowWebsocketResource.scala	Enforces the access control by checking if the user has WRITE privilege before allowing a WorkflowExecuteRequest.
Deployment & Routing	deployment/access-control-service.dockerfile	New Dockerfile for building and containerizing the Access Control Service.
	deployment/k8s/texera-helmchart/templates/access-control-service-deployment.yaml	New Kubernetes manifest to deploy the Access Control Service.
	deployment/k8s/texera-helmchart/templates/access-control-service-service.yaml	New Kubernetes service manifest to expose the Access Control Service within the cluster.
	deployment/k8s/texera-helmchart/templates/envoy-config.yaml	Key change: Configures Envoy to use the new service as an external authorization filter (ext_authz). It intercepts relevant requests, forwards them for an authorization check, and then passes the injected headers to the upstream service (AmberMaster).
	deployment/k8s/texera-helmchart/values.yaml	Adds the configuration parameters for the new Access Control Service to the Helm chart.
Frontend UI	core/gui/src/app/workspace/component/menu/menu.component.ts & .html	The frontend is updated to disable the "Run" button if the connected user does not have WRITE access to the selected Computing Unit, providing immediate visual feedback.
Build & Configuration	core/build.sbt	The root SBT build file is updated to include the new AccessControlService module.
	core/config/src/main/scala/edu/uci/ics/amber/util/PathUtils.scala	Adds a path helper for the new service's directory structure.

[bobbai00]

LGTM!

[bobbai00]

Can you also include the design diagram in the PR description?

[chenlica]

Please check those comments.

[chenlica]

This PR has 16 files. Can we divide it into smaller PRs?

[chenlica]

LGTM