feat: add authenticators, Account, and ClientPermissions (Tasks 3-7, 9)

- Account: per-account SubList and client tracking
- IAuthenticator interface, AuthResult, ClientAuthContext
- TokenAuthenticator: constant-time token comparison
- UserPasswordAuthenticator: multi-user with bcrypt/plain support
- SimpleUserPasswordAuthenticator: single user/pass config
- NKeyAuthenticator: Ed25519 nonce signature verification
- ClientPermissions: SubList-based publish/subscribe authorization

tests/NATS.Server.Tests/ClientPermissionsTests.cs

@@ -0,0 +1,107 @@
+using NATS.Server.Auth;
+
+namespace NATS.Server.Tests;
+
+public class ClientPermissionsTests
+{
+    [Fact]
+    public void No_permissions_allows_everything()
+    {
+        var perms = ClientPermissions.Build(null);
+        perms.ShouldBeNull();
+    }
+
+    [Fact]
+    public void Publish_allow_list_only()
+    {
+        var perms = ClientPermissions.Build(new Permissions
+        {
+            Publish = new SubjectPermission { Allow = ["foo.>", "bar.*"] },
+        });
+
+        perms.ShouldNotBeNull();
+        perms.IsPublishAllowed("foo.bar").ShouldBeTrue();
+        perms.IsPublishAllowed("foo.bar.baz").ShouldBeTrue();
+        perms.IsPublishAllowed("bar.one").ShouldBeTrue();
+        perms.IsPublishAllowed("baz.one").ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Publish_deny_list_only()
+    {
+        var perms = ClientPermissions.Build(new Permissions
+        {
+            Publish = new SubjectPermission { Deny = ["secret.>"] },
+        });
+
+        perms.ShouldNotBeNull();
+        perms.IsPublishAllowed("foo.bar").ShouldBeTrue();
+        perms.IsPublishAllowed("secret.data").ShouldBeFalse();
+        perms.IsPublishAllowed("secret.nested.deep").ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Publish_allow_and_deny()
+    {
+        var perms = ClientPermissions.Build(new Permissions
+        {
+            Publish = new SubjectPermission
+            {
+                Allow = ["events.>"],
+                Deny = ["events.internal.>"],
+            },
+        });
+
+        perms.ShouldNotBeNull();
+        perms.IsPublishAllowed("events.public.data").ShouldBeTrue();
+        perms.IsPublishAllowed("events.internal.secret").ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Subscribe_allow_list()
+    {
+        var perms = ClientPermissions.Build(new Permissions
+        {
+            Subscribe = new SubjectPermission { Allow = ["data.>"] },
+        });
+
+        perms.ShouldNotBeNull();
+        perms.IsSubscribeAllowed("data.updates").ShouldBeTrue();
+        perms.IsSubscribeAllowed("admin.logs").ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Subscribe_deny_list()
+    {
+        var perms = ClientPermissions.Build(new Permissions
+        {
+            Subscribe = new SubjectPermission { Deny = ["admin.>"] },
+        });
+
+        perms.ShouldNotBeNull();
+        perms.IsSubscribeAllowed("data.updates").ShouldBeTrue();
+        perms.IsSubscribeAllowed("admin.logs").ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Publish_cache_returns_same_result()
+    {
+        var perms = ClientPermissions.Build(new Permissions
+        {
+            Publish = new SubjectPermission { Allow = ["foo.>"] },
+        });
+
+        perms.ShouldNotBeNull();
+        perms.IsPublishAllowed("foo.bar").ShouldBeTrue();
+        perms.IsPublishAllowed("foo.bar").ShouldBeTrue();
+        perms.IsPublishAllowed("baz.bar").ShouldBeFalse();
+        perms.IsPublishAllowed("baz.bar").ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Empty_permissions_object_allows_everything()
+    {
+        var perms = ClientPermissions.Build(new Permissions());
+        perms.ShouldBeNull();
+    }
+}

tests/NATS.Server.Tests/NKeyAuthenticatorTests.cs

@@ -0,0 +1,130 @@
+using NATS.NKeys;
+using NATS.Server.Auth;
+using NATS.Server.Protocol;
+
+namespace NATS.Server.Tests;
+
+public class NKeyAuthenticatorTests
+{
+    private static (string PublicKey, string SignatureBase64) CreateSignedNonce(byte[] nonce)
+    {
+        var kp = KeyPair.CreatePair(PrefixByte.User);
+        var publicKey = kp.GetPublicKey();
+        var sig = new byte[64];
+        kp.Sign(nonce, sig);
+        var sigBase64 = Convert.ToBase64String(sig);
+        return (publicKey, sigBase64);
+    }
+
+    private static string SignNonce(KeyPair kp, byte[] nonce)
+    {
+        var sig = new byte[64];
+        kp.Sign(nonce, sig);
+        return Convert.ToBase64String(sig);
+    }
+
+    [Fact]
+    public void Returns_result_for_valid_signature()
+    {
+        var kp = KeyPair.CreatePair(PrefixByte.User);
+        var publicKey = kp.GetPublicKey();
+        var nonce = "test-nonce-123"u8.ToArray();
+        var sigBase64 = SignNonce(kp, nonce);
+
+        var nkeyUser = new NKeyUser { Nkey = publicKey };
+        var auth = new NKeyAuthenticator([nkeyUser]);
+
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Nkey = publicKey, Sig = sigBase64 },
+            Nonce = nonce,
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.Identity.ShouldBe(publicKey);
+    }
+
+    [Fact]
+    public void Returns_null_for_invalid_signature()
+    {
+        var kp = KeyPair.CreatePair(PrefixByte.User);
+        var publicKey = kp.GetPublicKey();
+        var nonce = "test-nonce-123"u8.ToArray();
+
+        var nkeyUser = new NKeyUser { Nkey = publicKey };
+        var auth = new NKeyAuthenticator([nkeyUser]);
+
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Nkey = publicKey, Sig = Convert.ToBase64String(new byte[64]) },
+            Nonce = nonce,
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_for_unknown_nkey()
+    {
+        var kp = KeyPair.CreatePair(PrefixByte.User);
+        var publicKey = kp.GetPublicKey();
+        var nonce = "test-nonce-123"u8.ToArray();
+        var sigBase64 = SignNonce(kp, nonce);
+
+        var auth = new NKeyAuthenticator([]);
+
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Nkey = publicKey, Sig = sigBase64 },
+            Nonce = nonce,
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_when_no_nkey_provided()
+    {
+        var kp = KeyPair.CreatePair(PrefixByte.User);
+        var publicKey = kp.GetPublicKey();
+        var nkeyUser = new NKeyUser { Nkey = publicKey };
+        var auth = new NKeyAuthenticator([nkeyUser]);
+
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions(),
+            Nonce = "nonce"u8.ToArray(),
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_permissions_from_nkey_user()
+    {
+        var kp = KeyPair.CreatePair(PrefixByte.User);
+        var publicKey = kp.GetPublicKey();
+        var nonce = "test-nonce"u8.ToArray();
+        var sigBase64 = SignNonce(kp, nonce);
+
+        var perms = new Permissions
+        {
+            Publish = new SubjectPermission { Allow = ["foo.>"] },
+        };
+        var nkeyUser = new NKeyUser { Nkey = publicKey, Permissions = perms };
+        var auth = new NKeyAuthenticator([nkeyUser]);
+
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Nkey = publicKey, Sig = sigBase64 },
+            Nonce = nonce,
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.Permissions.ShouldBe(perms);
+    }
+}

tests/NATS.Server.Tests/SimpleUserPasswordAuthenticatorTests.cs

@@ -0,0 +1,116 @@
+using NATS.Server.Auth;
+using NATS.Server.Protocol;
+
+namespace NATS.Server.Tests;
+
+public class SimpleUserPasswordAuthenticatorTests
+{
+    [Fact]
+    public void Returns_result_for_correct_credentials()
+    {
+        var auth = new SimpleUserPasswordAuthenticator("admin", "password123");
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "admin", Password = "password123" },
+            Nonce = [],
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.Identity.ShouldBe("admin");
+    }
+
+    [Fact]
+    public void Returns_null_for_wrong_username()
+    {
+        var auth = new SimpleUserPasswordAuthenticator("admin", "password123");
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "wrong", Password = "password123" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_for_wrong_password()
+    {
+        var auth = new SimpleUserPasswordAuthenticator("admin", "password123");
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "admin", Password = "wrong" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_for_null_username()
+    {
+        var auth = new SimpleUserPasswordAuthenticator("admin", "password123");
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = null, Password = "password123" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_for_empty_username()
+    {
+        var auth = new SimpleUserPasswordAuthenticator("admin", "password123");
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "", Password = "password123" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_for_null_password()
+    {
+        var auth = new SimpleUserPasswordAuthenticator("admin", "password123");
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "admin", Password = null },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Supports_bcrypt_password()
+    {
+        var hash = BCrypt.Net.BCrypt.HashPassword("secret");
+        var auth = new SimpleUserPasswordAuthenticator("admin", hash);
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "admin", Password = "secret" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldNotBeNull();
+    }
+
+    [Fact]
+    public void Rejects_wrong_password_with_bcrypt()
+    {
+        var hash = BCrypt.Net.BCrypt.HashPassword("secret");
+        var auth = new SimpleUserPasswordAuthenticator("admin", hash);
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "admin", Password = "wrongpassword" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+}

tests/NATS.Server.Tests/UserPasswordAuthenticatorTests.cs

@@ -0,0 +1,120 @@
+using NATS.Server.Auth;
+using NATS.Server.Protocol;
+
+namespace NATS.Server.Tests;
+
+public class UserPasswordAuthenticatorTests
+{
+    private static UserPasswordAuthenticator CreateAuth(params User[] users)
+    {
+        return new UserPasswordAuthenticator(users);
+    }
+
+    [Fact]
+    public void Returns_result_for_correct_plain_password()
+    {
+        var auth = CreateAuth(new User { Username = "alice", Password = "secret" });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "alice", Password = "secret" },
+            Nonce = [],
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.Identity.ShouldBe("alice");
+    }
+
+    [Fact]
+    public void Returns_result_for_correct_bcrypt_password()
+    {
+        var hash = BCrypt.Net.BCrypt.HashPassword("secret");
+        var auth = CreateAuth(new User { Username = "bob", Password = hash });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "bob", Password = "secret" },
+            Nonce = [],
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.Identity.ShouldBe("bob");
+    }
+
+    [Fact]
+    public void Returns_null_for_wrong_password()
+    {
+        var auth = CreateAuth(new User { Username = "alice", Password = "secret" });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "alice", Password = "wrong" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_for_unknown_user()
+    {
+        var auth = CreateAuth(new User { Username = "alice", Password = "secret" });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "unknown", Password = "secret" },
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_null_when_no_username_provided()
+    {
+        var auth = CreateAuth(new User { Username = "alice", Password = "secret" });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions(),
+            Nonce = [],
+        };
+
+        auth.Authenticate(ctx).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_permissions_from_user()
+    {
+        var perms = new Permissions
+        {
+            Publish = new SubjectPermission { Allow = ["foo.>"] },
+        };
+        var auth = CreateAuth(new User { Username = "alice", Password = "secret", Permissions = perms });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "alice", Password = "secret" },
+            Nonce = [],
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.Permissions.ShouldBe(perms);
+    }
+
+    [Fact]
+    public void Returns_account_name_from_user()
+    {
+        var auth = CreateAuth(new User { Username = "alice", Password = "secret", Account = "myaccount" });
+        var ctx = new ClientAuthContext
+        {
+            Opts = new ClientOptions { Username = "alice", Password = "secret" },
+            Nonce = [],
+        };
+
+        var result = auth.Authenticate(ctx);
+
+        result.ShouldNotBeNull();
+        result.AccountName.ShouldBe("myaccount");
+    }
+}