Uh oh!
There was an error while loading. Please reload this page.
Modify permissions to use SDK types where available - #4686
Merged
Conversation
denik
requested review from
andrewnester, anton-107, pietern, shreyas-goenka and simonfaltum
as code ownersMarch 9, 2026 15:04
denik added a commit
that referenced
this pull request
Mar 9, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Collaborator
Commit: c16028d
17 interesting tests: 7 SKIP, 6 RECOVERED, 4 flaky
Top 20 slowest tests (at least 2 minutes):
|
denik added a commit
that referenced
this pull request
Mar 10, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
denikforce-pushed
the
denik/simpler-permissions
branch
from
March 10, 2026 13:32
a39e224 to
04f0df6CompareAnalogous to simpler-grant: replace 12 resource-specific permission types with iam.AccessControlRequest from the SDK directly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove 12 per-resource permission structs (JobPermission, PipelinePermission, etc.) and corresponding PermissionLevel enum types in favor of shared resources.Permission - Remove IPermission interface and reflection-based dispatch in dresources/permissions.go - Replace with static permissionResourceToObjectType map and direct type assertion - Update annotations.yml and annotations_openapi_overrides.yml to remove obsolete entries - Regenerate JSON schema - Add backward-compat aliases (JobPermission, PipelinePermission, etc.) in Python __init__.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move jobs/pipelines permission aliases from packages.EXTRA_ALIASES to aliases_patch.ALIASES, consistent with how grant aliases are handled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JobPermissionLevel = str and PipelinePermissionLevel = str preserve the exported names while reflecting that levels are now plain strings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the generic `[]resources.Permission[iam.PermissionLevel]` with per-resource typed `resources.Permissions[L]` using the SDK's own enum types (e.g. `jobs.JobPermissionLevel`, `pipelines.PipelinePermissionLevel`, etc.). This provides type safety and IDE autocomplete for valid permission levels per resource. A `PermissionsSlice` interface enables type-agnostic conversion to `iam.AccessControlRequest` without reflection. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ypes Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ermission Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…mize diff Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ython codegen Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The spec is already flat with dotted keys; no logic changes needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kanterov
approved these changes
Mar 10, 2026
kanterov
left a comment
Collaborator
There was a problem hiding this comment.
//python/... LGTM
Other code I didn't check
| ### Bundles | ||
| * Modify grants to use SDK types ([#4666](https://github.com/databricks/cli/pull/4666)) | ||
| * Modify permissions to use SDK types where available ([#4686](https://github.com/databricks/cli/pull/4686)) |
Collaborator
There was a problem hiding this comment.
Is this a user-visible change now? We can clarify that we re-ordered Python enums
pietern
reviewed
Mar 11, 2026
pietern
left a comment
Contributor
There was a problem hiding this comment.
Can you take a look at the changelog to make it to users if they need to do anything?
pietern
approved these changes
Mar 11, 2026
eng-dev-ecosystem-bot
commented
Mar 11, 2026
Collaborator
Commit: dc16dbd
54 interesting tests: 22 RECOVERED, 20 FAIL, 6 flaky, 3 BUG, 2 KNOWN, 1 SKIP
Top 50 slowest tests (at least 2 minutes):
|
deco-sdk-taggingBot
added a commit
that referenced
this pull request
Mar 12, 2026
## Release v0.294.0 ### Bundles * Modify grants to use SDK types ([#4666](#4666)) * Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](#4686)) ### Dependency updates * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](#4631), [#4695](#4695))
rauchy pushed a commit
that referenced
this pull request
Mar 17, 2026
## Changes Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not. This affects enum validation, previously, our types (except for AlertPermission) did not have associated list of values, which means invalid values were not producing a warning. Note, alerts, dashboards, database_instances do not have dedicated permission level type, so their list of possible values includes all valid values for levels for all resources. ## Why Simplification. Supports autogeneration of resource, no need to manually provide allowed levels. Similar change for grants: #4666 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
rauchy pushed a commit
that referenced
this pull request
Mar 17, 2026
## Release v0.294.0 ### Bundles * Modify grants to use SDK types ([#4666](#4666)) * Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](#4686)) ### Dependency updates * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](#4631), [#4695](#4695))
denik added a commit
that referenced
this pull request
May 20, 2026
## Changes Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not. This affects enum validation, previously, our types (except for AlertPermission) did not have associated list of values, which means invalid values were not producing a warning. Note, alerts, dashboards, database_instances do not have dedicated permission level type, so their list of possible values includes all valid values for levels for all resources. ## Why Simplification. Supports autogeneration of resource, no need to manually provide allowed levels. Similar change for grants: #4666 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Release v0.294.0 ### Bundles * Modify grants to use SDK types ([#4666](#4666)) * Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](#4686)) ### Dependency updates * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](#4631), [#4695](#4695))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not.
This affects enum validation, previously, our types (except for AlertPermission) did not have associated list of values, which means invalid values were not producing a warning.
Note, alerts, dashboards, database_instances do not have dedicated permission level type, so their list of possible values includes all valid values for levels for all resources.
Why
Simplification. Supports autogeneration of resource, no need to manually provide allowed levels.
Similar change for grants: #4666