feat(yarn_client): auth config for YARN REST (none/simple/basic/kerberos)

Add per-Connection authentication so CDH 5 / Kerberos / HTTP Basic
clusters can be queried.

- auth_type: none / simple / basic / kerberos
- auth_user / auth_password for HTTP Basic
- auth_principal / auth_keytab stored for audit/display; actual SPNEGO
  handled by httpx-kerberos using the system Kerberos credential cache
- YarnClientConfig.auth_for_httpx() returns the right httpx.Auth object
- _request passes auth= through to httpx.request alongside verify=

New dependency: httpx-kerberos.

Tests cover none/simple (no auth object), Basic auth header,
Kerberos auth object, missing basic user, invalid auth_type, and
tool-layer config propagation.

tests/unit/test_connection_tools.py

@@ -81,6 +81,29 @@ def test_save_connection_preserves_ssl_fields(_fresh_store):
     assert out["ssl_ca_bundle"] == "/tmp/ca.crt"
 
 
+def test_save_connection_with_basic_auth(_fresh_store):
+    connections.save_connection(
+        name="secure",
+        master="yarn",
+        auth_type="basic",
+        auth_user="hdfs",
+        auth_password="secret",
+    )
+    out = connections.get_connection("secure")
+    assert out["auth_type"] == "basic"
+    assert out["auth_user"] == "hdfs"
+    assert out["auth_password"] == "secret"
+
+
+def test_save_connection_invalid_auth_type_raises(_fresh_store):
+    with pytest.raises(ValueError, match="auth_type must be one of none/simple/basic/kerberos"):
+        connections.save_connection(
+            name="bad",
+            master="yarn",
+            auth_type="oauth",
+        )
+
+
 def test_get_connection_unknown_raises(_fresh_store):
     with pytest.raises(KeyError):
         connections.get_connection("missing")

tests/unit/test_status_tool.py

@@ -8,6 +8,7 @@ from spark_executor.core.job_store import JobStore
 from spark_executor.core import connection_store
 from spark_executor.models import Connection, Job
 from spark_executor.tools import connections, status
+from spark_executor.core.yarn_client import YarnClientConfig
 
 
 def _fresh_stores():
@@ -67,3 +68,38 @@ def test_get_job_status_raises_when_connection_missing():
     )
     with pytest.raises(KeyError, match="Connection not found"):
         status.get_job_status("abc")
+
+
+def test_get_job_status_passes_auth_config():
+    _fresh_stores()
+    status.conn_store.save(
+        Connection(
+            name="secure",
+            master="yarn",
+            yarn_rm_url="http://rm:8088",
+            auth_type="basic",
+            auth_user="hdfs",
+            auth_password="secret",
+        )
+    )
+    status.store.put(
+        Job(
+            job_id="abc",
+            application_id="application_1",
+            script_path="/tmp/j.py",
+            queue="default",
+            submit_time=datetime(2026, 6, 24),
+            connection="secure",
+            yarn_rm_url="http://rm:8088",
+        )
+    )
+    with patch(
+        "spark_executor.tools.status.get_application_status",
+        return_value=("RUNNING", "State : RUNNING\n"),
+    ) as m:
+        status.get_job_status("abc")
+    args = m.call_args.args
+    assert args[0] == "application_1"
+    assert isinstance(args[1], YarnClientConfig)
+    assert args[1].auth_type == "basic"
+    assert args[1].auth_user == "hdfs"

tests/unit/test_yarn_client.py

@@ -1,4 +1,6 @@
 # coding=utf-8
+import base64
+
 from unittest.mock import patch
 
 import httpx
@@ -323,3 +325,48 @@ def test_ssl_verify_false_without_ca_bundle_uses_global_default():
     with patch("spark_executor.core.yarn_client.httpx.request", return_value=fake) as m:
         get_application_status("application_1", cfg)
     assert m.call_args.kwargs["verify"] is False
+
+
+# --- authentication configuration ---
+
+def test_status_no_auth_for_none():
+    fake = _resp(200, json_data={"app": {"state": "RUNNING"}})
+    with patch("spark_executor.core.yarn_client.httpx.request", return_value=fake) as m:
+        get_application_status("application_1", YarnClientConfig(yarn_rm_url=RM, auth_type="none"))
+    assert m.call_args.kwargs["auth"] is None
+
+def test_status_basic_auth_header():
+    fake = _resp(200, json_data={"app": {"state": "RUNNING"}})
+    cfg = YarnClientConfig(
+        yarn_rm_url=RM,
+        auth_type="basic",
+        auth_user="alice",
+        auth_password="pw",
+    )
+    with patch("spark_executor.core.yarn_client.httpx.request", return_value=fake) as m:
+        get_application_status("application_1", cfg)
+    auth = m.call_args.kwargs["auth"]
+    assert isinstance(auth, httpx.BasicAuth)
+    encoded = auth._auth_header.split(" ", 1)[1]
+    assert base64.b64decode(encoded).decode() == "alice:pw"
+
+
+def test_status_no_auth_for_simple():
+    fake = _resp(200, json_data={"app": {"state": "RUNNING"}})
+    with patch("spark_executor.core.yarn_client.httpx.request", return_value=fake) as m:
+        get_application_status("application_1", YarnClientConfig(yarn_rm_url=RM, auth_type="simple"))
+    assert m.call_args.kwargs["auth"] is None
+
+def test_status_kerberos_auth():
+    fake = _resp(200, json_data={"app": {"state": "RUNNING"}})
+    cfg = YarnClientConfig(yarn_rm_url=RM, auth_type="kerberos")
+    with patch("spark_executor.core.yarn_client.httpx.request", return_value=fake) as m:
+        get_application_status("application_1", cfg)
+    auth = m.call_args.kwargs["auth"]
+    assert auth is not None
+    assert "Kerberos" in type(auth).__name__
+
+def test_basic_auth_missing_user_raises():
+    cfg = YarnClientConfig(yarn_rm_url=RM, auth_type="basic")
+    with pytest.raises(YarnConfigError, match="auth_type='basic' requires auth_user"):
+        get_application_status("application_1", cfg)