Uh oh!
There was an error while loading. Please reload this page.
Auth: resolve positional arg as profile name first - #4840
Merged
Conversation
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 22:01 — with 
GitHub Actions
Inactive
Collaborator
Commit: 62ee5d5
19 interesting tests: 10 SKIP, 6 RECOVERED, 3 flaky
Top 20 slowest tests (at least 2 minutes):
|
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 22:55 — with GitHub Actions
Inactive
simonfaltum
marked this pull request as ready for review
March 25, 2026 22:56
simonfaltum
requested review from
andrewnester, anton-107, denik, pietern and shreyas-goenka
as code ownersMarch 25, 2026 22:56
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 23:10 — with GitHub Actions
Inactive
simonfaltumtemporarily deployed
to
test-trigger-is
March 26, 2026 22:01 — with GitHub Actions
Inactive
simonfaltum
removed request for
andrewnester, anton-107, denik and shreyas-goenkaApril 7, 2026 10:40
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
simonfaltum
requested review from
renaudhartert-db
and removed request for
pieternApril 7, 2026 17:39
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
- Fix token command skipping resolver when DATABRICKS_CONFIG_PROFILE is set by moving positional arg resolution before the env var read - Add test for login's --host + positional argument conflict guard - Align token command's Use string to PROFILE_OR_HOST for consistency - Add host:port detection (e.g., localhost:8080) to looksLikeHost - Improve resolveHostToProfile prompt label to "Select one to use" Co-authored-by: Isaac
Co-authored-by: Isaac
The positional argument is primarily a profile name. Host URL support is backwards compatibility, not the intended path forward, so we don't advertise it in --help output. Co-authored-by: Isaac
…arg conflict - Use errNoProfileFound sentinel error instead of formatted string for resolvePositionalArg, enabling errors.Is checks in tests - Remove unnecessary nil guard on global --profile flag in logout and token commands (profile is always registered as a persistent root flag) - Add positional arg + --profile conflict check in login command Co-authored-by: Isaac
…lict The testifylint linter requires assert.ErrorIs over assert.True(errors.Is). The blanket rejection of positional arg + --profile in login was wrong: `databricks auth login https://host --profile myprofile` is valid (host as positional arg with explicit profile). The profile-first resolution already skips when profileName is set, so no extra guard is needed. Co-authored-by: Isaac
The positional argument is a shorthand that resolves to either a profile or a host. Combining it with explicit flags is ambiguous, so we now error with a user-friendly message that echoes the argument and suggests using the flags directly. This is consistent across login, logout, and token. Co-authored-by: Isaac
Co-authored-by: Isaac
We silently support host URLs as positional args but don't want to advertise it in the usage line. Co-authored-by: Isaac
simonfaltumforce-pushed
the
simonfaltum/auth-positional-profile
branch
from
April 8, 2026 09:22
fdfea5a to
f4bf117CompareThe profileHostConflictCheck PreRunE hook now rejects login when --profile and --host specify different hosts. Update the test to expect the conflict error instead of a successful override. Co-authored-by: Isaac
renaudhartert-db
approved these changes
Apr 9, 2026
Contributor
Approved (maintainer-authored PR)See OWNERS for ownership rules. |
Uh oh!
There was an error while loading. Please reload this page.
deco-sdk-taggingBot
added a commit
that referenced
this pull request
Apr 15, 2026
## Release v0.297.0 ### CLI * Auth commands now accept a profile name as a positional argument ([#4840](#4840)) * Add `auth logout` command for clearing cached OAuth tokens and optionally removing profiles ([#4613](#4613), [#4616](#4616), [#4647](#4647)) ### Bundles * Added support for lifecycle.started option for apps ([#4672](#4672)) * engine/direct: Fix permissions for resources.models ([#4941](#4941)) * Fix resource references not correctly resolved in apps config section ([#4964](#4964)) * Allow run_as for dashboards with embed_credentials set to false ([#4961](#4961)) * direct: Pass changed fields into update mask for apps instead of wildcard ([#4963](#4963)) * engine/direct: Fix deploy of configurations with dots in maps keys ([#4977](#4977))
3 tasks
ilia-db added a commit
to databricks/databricks-vscode
that referenced
this pull request
Apr 21, 2026
## Summary Bump bundled Databricks CLI from v0.295.0 → v0.297.2. ## CLI changes since v0.295.0 ### v0.297.2 (2026-04-19) - **Fix `error downloading Terraform: unable to verify checksums signature: openpgp: key expired`** for `bundle deploy` — uses a hardcoded ArmoredPublicKey for the TF binary install ([#5019](databricks/cli#5019)). **Highly relevant** — extension users hitting this during `bundle deploy` flows are unblocked by the upgrade. ### v0.297.1 - Dep bump only: Go toolchain to 1.25.9. ### v0.297.0 - CLI: `auth` commands accept a profile name as a positional argument ([#4840](databricks/cli#4840)). - CLI: new `auth logout` command to clear cached OAuth tokens / remove profiles ([#4613](databricks/cli#4613), [#4616](databricks/cli#4616), [#4647](databricks/cli#4647)). - Bundles: `lifecycle.started` option for apps ([#4672](databricks/cli#4672)). - Bundles: resource references now resolved correctly in apps config ([#4964](databricks/cli#4964)). - Bundles: allow `run_as` for dashboards with `embed_credentials: false` ([#4961](databricks/cli#4961)). - Direct engine: permissions fix for `resources.models` ([#4941](databricks/cli#4941)); update mask fix for apps ([#4963](databricks/cli#4963)); dotted map keys fix ([#4977](databricks/cli#4977)). ### v0.296.0 - **Direct deployment engine for DABs is now in Public Preview** (`docs/direct.md`). Relevant to the extension's bundle deploy UX, though opt-in. - CLI: `auth` commands error when `--profile` and `--host` conflict ([#4841](databricks/cli#4841)). - CLI: `--force-refresh` flag on `databricks auth token` ([#4767](databricks/cli#4767)). - Bundles: `bundle deployment bind` now pulls remote state before modifying ([#4892](databricks/cli#4892)). - Bundles: dedupe grant entries ([#4801](databricks/cli#4801)). - Direct engine: several fixes (grants reordering, ALL_PRIVILEGES, secret scope recreation/permissions, bind/unbind for non-TF resources, removed principals). ## Relevance to the extension - **TF checksum fix (v0.297.2)** — unblocks `bundle deploy` for users hitting the expired-key error; this alone is a good reason to ship. - **Auth CLI surface changes** — extension shells out to `databricks auth …`; `--profile` + `--host` now conflict, and `auth logout` / positional profile are new. Worth a glance at auth-related code paths to make sure we aren't passing both. - **Direct deploy engine GA preview** — no action required today (opt-in), but worth tracking for future bundle deploy UX. ## Test plan - [ ] CI green (unit tests, integration tests pulling the pinned CLI). - [ ] Manually sanity-check `bundle deploy` from the extension against a simple bundle to confirm the TF download path works. - [ ] Verify `databricks auth login` / token refresh flows still work from the extension. This pull request and its description were written by Isaac.
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Why Running `databricks auth login logfood` treats `logfood` as a host URL, which fails confusingly. Running `databricks auth token e2-logfood` (a typo) falls through to host resolution, producing a misleading DNS error. The three auth commands handle positional arguments inconsistently: login only accepts hosts, token tries profile-first, logout tries profile-first. ## Changes All three auth commands now share a `resolvePositionalArg` function that resolves positional arguments as profile names first. If no profile matches and the argument doesn't look like a profile name, it returns a clear error. Before: `databricks auth login logfood` tries to resolve `logfood` as a hostname and fails. Now: `databricks auth login logfood` loads the `logfood` profile and logs into its configured host. Before: `databricks auth token e2-logfood` produces a confusing DNS/OAuth error. Now: `databricks auth token e2-logfood` produces `no profile named "e2-logfood" found`. The usage strings show `[PROFILE]` as the positional argument, reinforcing that profile is the primary concept. Host URLs still work as a silent fallback for backwards compatibility. Also removes the local `--profile` flag from `auth logout` in favor of the global persistent flag, restoring `-p` shorthand consistency. ## Test plan - [x] New unit tests for `resolvePositionalArg` (7 table-driven cases) - [x] New unit tests for `resolveHostToProfile` (4 cases) - [x] New token test for non-host non-profile error message - [x] Updated logout tests for new resolution flow - [x] `make checks` passes - [x] `make lintfull` passes - [x] `go test ./cmd/auth/` passes
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Release v0.297.0 ### CLI * Auth commands now accept a profile name as a positional argument ([#4840](#4840)) * Add `auth logout` command for clearing cached OAuth tokens and optionally removing profiles ([#4613](#4613), [#4616](#4616), [#4647](#4647)) ### Bundles * Added support for lifecycle.started option for apps ([#4672](#4672)) * engine/direct: Fix permissions for resources.models ([#4941](#4941)) * Fix resource references not correctly resolved in apps config section ([#4964](#4964)) * Allow run_as for dashboards with embed_credentials set to false ([#4961](#4961)) * direct: Pass changed fields into update mask for apps instead of wildcard ([#4963](#4963)) * engine/direct: Fix deploy of configurations with dots in maps keys ([#4977](#4977))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Running
databricks auth login logfoodtreatslogfoodas a host URL, which fails confusingly. Runningdatabricks auth token e2-logfood(a typo) falls through to host resolution, producing a misleading DNS error. The three auth commands handle positional arguments inconsistently: login only accepts hosts, token tries profile-first, logout tries profile-first.Changes
All three auth commands now share a
resolvePositionalArgfunction that resolves positional arguments as profile names first. If no profile matches and the argument doesn't look like a profile name, it returns a clear error.Before:
databricks auth login logfoodtries to resolvelogfoodas a hostname and fails.Now:
databricks auth login logfoodloads thelogfoodprofile and logs into its configured host.Before:
databricks auth token e2-logfoodproduces a confusing DNS/OAuth error.Now:
databricks auth token e2-logfoodproducesno profile named "e2-logfood" found.The usage strings show
[PROFILE]as the positional argument, reinforcing that profile is the primary concept. Host URLs still work as a silent fallback for backwards compatibility.Also removes the local
--profileflag fromauth logoutin favor of the global persistent flag, restoring-pshorthand consistency.Test plan
resolvePositionalArg(7 table-driven cases)resolveHostToProfile(4 cases)make checkspassesmake lintfullpassesgo test ./cmd/auth/passes