feat(auth): add key-pair authentication support

.gitignore

@@ -23,3 +23,4 @@ frontend/.next/
 # Frontend build artifacts now use fixed filenames, included in git
 # cli/frontend/build/ will be committed to ensure cargo install has full UI
 
+.alma-snapshots

cli/src/main.rs

@@ -89,6 +89,15 @@ struct Args {
     )]
     password: Option<SensitiveString>,
 
+    #[clap(
+        long,
+        help = "Private key file for key-pair authentication, overrides password in DSN"
+    )]
+    private_key_file: Option<String>,
+
+    #[clap(long, help = "Passphrase file for encrypted private key")]
+    private_key_passphrase_file: Option<String>,
+
     #[clap(short = 'r', long, help = "Downgrade role name, overrides role in DSN")]
     role: Option<String>,
 
@@ -292,6 +301,19 @@ pub async fn main() -> Result<()> {
         if let Some(role) = args.role {
             conn_args.args.insert("role".to_string(), role);
         }
+
+        // override private key file if specified in command line
+        if let Some(private_key_file) = args.private_key_file {
+            conn_args
+                .args
+                .insert("private_key_file".to_string(), private_key_file);
+        }
+        if let Some(private_key_passphrase_file) = args.private_key_passphrase_file {
+            conn_args.args.insert(
+                "private_key_passphrase_file".to_string(),
+                private_key_passphrase_file,
+            );
+        }
     }
 
     let user = conn_args.user.clone();

core/Cargo.toml

@@ -41,6 +41,10 @@ tokio-retry = "0.3"
 tokio-util = { version = "0.7", features = ["io-util"] }
 url = { version = "2.5", default-features = false }
 uuid = { version = "1.16", features = ["std", "v4", "v7"] }
+jsonwebtoken = "9"
+pem = "3"
+pkcs8 = { version = "0.11", features = ["encryption", "pem"] }
 
 [dev-dependencies]
 chrono = { workspace = true }
+tempfile = "3"