Uh oh!
There was an error while loading. Please reload this page.
Auth: error when --profile and --host conflict - #4841
Merged
Conversation
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 22:01 — with 
GitHub Actions
Inactive
Collaborator
Commit: 70e8eab
17 interesting tests: 10 SKIP, 7 RECOVERED
Top 20 slowest tests (at least 2 minutes):
|
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 22:51 — with GitHub Actions
Inactive
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 22:53 — with GitHub Actions
Inactive
simonfaltum
marked this pull request as ready for review
March 25, 2026 22:53
simonfaltum
requested review from
andrewnester, anton-107, denik, pietern and shreyas-goenka
as code ownersMarch 25, 2026 22:53
Contributor
Suggested reviewersBased on git history of the changed files, these people are best suited to review:
Confidence: high Eligible reviewersBased on CODEOWNERS, these people or teams could also review: @andrewnester, @anton-107, @denik, @shreyas-goenka Suggestions based on git history of 4 changed files (3 scored). See CODEOWNERS for path-specific ownership rules. |
simonfaltumtemporarily deployed
to
test-trigger-is
March 25, 2026 23:10 — with GitHub Actions
Inactive
simonfaltumtemporarily deployed
to
test-trigger-is
March 26, 2026 08:41 — with GitHub Actions
Inactive
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
simonfaltumforce-pushed
the
simonfaltum/auth-profile-host-conflict
branch
from
March 26, 2026 22:24
a07aa55 to
c758131Comparesimonfaltumtemporarily deployed
to
test-trigger-is
March 26, 2026 22:24 — with GitHub Actions
Inactive
Remove promptForWorkspaceID that was deleted on main but accidentally reintroduced during rebase. Update the custom-config-file acceptance test to expect the new profile/host conflict error. Co-authored-by: Isaac
simonfaltumtemporarily deployed
to
test-trigger-is
March 26, 2026 22:37 — with GitHub Actions
Inactive
simonfaltum
requested review from
mihaimitrea-db
and removed request for
andrewnester, anton-107, denik, pietern and shreyas-goenkaApril 7, 2026 10:41
mihaimitrea-db
approved these changes
Apr 7, 2026
mihaimitrea-db
left a comment
Contributor
There was a problem hiding this comment.
LGTM after description is updated
Uh oh!
There was an error while loading. Please reload this page.
Item 3 in the long description still described the old behavior where conflicting --profile and --host would silently update the profile. Updated to describe the new error behavior. Co-authored-by: Isaac
Keep both the new --force-refresh flag from main and the profileHostConflictCheck PreRunE from this branch. Co-authored-by: Isaac
simonfaltum
enabled auto-merge
April 7, 2026 12:27
Uh oh!
There was an error while loading. Please reload this page.
deco-sdk-taggingBot
added a commit
that referenced
this pull request
Apr 8, 2026
## Release v0.296.0 ### Notable Changes * Direct deployment engine for DABs is now in Public Preview. Documentation at [docs/direct.md](docs/direct.md). ### CLI * Auth commands now error when --profile and --host conflict ([#4841](#4841)) * Add `--force-refresh` flag to `databricks auth token` to force a token refresh even when the cached token is still valid ([#4767](#4767)) ### Bundles * Deduplicate grant entries with duplicate principals or privileges during initialization ([#4801](#4801)) * Fix `bundle deployment bind` to always pull remote state before modifying ([#4892](#4892)) * engine/direct: Fix drift in grants resource due to privilege reordering ([#4794](#4794)) * engine/direct: Fix 400 error when deploying grants with ALL_PRIVILEGES ([#4801](#4801)) * engine/direct: Fix unwanted recreation of secret scopes when scope_backend_type is not set ([#4834](#4834)) * engine/direct: Fix bind and unbind for non-Terraform resources ([#4850](#4850)) * engine/direct: Fix deploying removed principals ([#4824](#4824)) * engine/direct: Fix secret scope permissions migration from Terraform to Direct engine ([#4866](#4866))
3 tasks
ilia-db added a commit
to databricks/databricks-vscode
that referenced
this pull request
Apr 21, 2026
## Summary Bump bundled Databricks CLI from v0.295.0 → v0.297.2. ## CLI changes since v0.295.0 ### v0.297.2 (2026-04-19) - **Fix `error downloading Terraform: unable to verify checksums signature: openpgp: key expired`** for `bundle deploy` — uses a hardcoded ArmoredPublicKey for the TF binary install ([#5019](databricks/cli#5019)). **Highly relevant** — extension users hitting this during `bundle deploy` flows are unblocked by the upgrade. ### v0.297.1 - Dep bump only: Go toolchain to 1.25.9. ### v0.297.0 - CLI: `auth` commands accept a profile name as a positional argument ([#4840](databricks/cli#4840)). - CLI: new `auth logout` command to clear cached OAuth tokens / remove profiles ([#4613](databricks/cli#4613), [#4616](databricks/cli#4616), [#4647](databricks/cli#4647)). - Bundles: `lifecycle.started` option for apps ([#4672](databricks/cli#4672)). - Bundles: resource references now resolved correctly in apps config ([#4964](databricks/cli#4964)). - Bundles: allow `run_as` for dashboards with `embed_credentials: false` ([#4961](databricks/cli#4961)). - Direct engine: permissions fix for `resources.models` ([#4941](databricks/cli#4941)); update mask fix for apps ([#4963](databricks/cli#4963)); dotted map keys fix ([#4977](databricks/cli#4977)). ### v0.296.0 - **Direct deployment engine for DABs is now in Public Preview** (`docs/direct.md`). Relevant to the extension's bundle deploy UX, though opt-in. - CLI: `auth` commands error when `--profile` and `--host` conflict ([#4841](databricks/cli#4841)). - CLI: `--force-refresh` flag on `databricks auth token` ([#4767](databricks/cli#4767)). - Bundles: `bundle deployment bind` now pulls remote state before modifying ([#4892](databricks/cli#4892)). - Bundles: dedupe grant entries ([#4801](databricks/cli#4801)). - Direct engine: several fixes (grants reordering, ALL_PRIVILEGES, secret scope recreation/permissions, bind/unbind for non-TF resources, removed principals). ## Relevance to the extension - **TF checksum fix (v0.297.2)** — unblocks `bundle deploy` for users hitting the expired-key error; this alone is a good reason to ship. - **Auth CLI surface changes** — extension shells out to `databricks auth …`; `--profile` + `--host` now conflict, and `auth logout` / positional profile are new. Worth a glance at auth-related code paths to make sure we aren't passing both. - **Direct deploy engine GA preview** — no action required today (opt-in), but worth tracking for future bundle deploy UX. ## Test plan - [ ] CI green (unit tests, integration tests pulling the pinned CLI). - [ ] Manually sanity-check `bundle deploy` from the extension against a simple bundle to confirm the TF download path works. - [ ] Verify `databricks auth login` / token refresh flows still work from the extension. This pull request and its description were written by Isaac.
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Why Users can pass both `--profile logfood` and `--host https://other-host.com` on auth commands with no validation. The CLI silently picks one based on internal priority, which is confusing. ## Changes Before: `databricks auth login --profile logfood --host https://other.com` silently uses one of the two with no warning. Now: produces an error explaining the conflict and suggesting to use `--profile` alone. Adds a `PersistentPreRunE` on the `auth` parent command that validates when both `--profile` and `--host` are explicitly set. If the profile's host matches the `--host` value (after canonicalization), the command proceeds silently. If they conflict, it returns a clear error. ## Test plan - [x] New unit tests for `validateProfileHostConflict` (5 table-driven cases: matching hosts, trailing slash, conflict, profile not found, no host) - [x] `make checks` passes - [x] `make lintfull` passes - [x] `go test ./cmd/auth/` passes
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Release v0.296.0 ### Notable Changes * Direct deployment engine for DABs is now in Public Preview. Documentation at [docs/direct.md](docs/direct.md). ### CLI * Auth commands now error when --profile and --host conflict ([#4841](#4841)) * Add `--force-refresh` flag to `databricks auth token` to force a token refresh even when the cached token is still valid ([#4767](#4767)) ### Bundles * Deduplicate grant entries with duplicate principals or privileges during initialization ([#4801](#4801)) * Fix `bundle deployment bind` to always pull remote state before modifying ([#4892](#4892)) * engine/direct: Fix drift in grants resource due to privilege reordering ([#4794](#4794)) * engine/direct: Fix 400 error when deploying grants with ALL_PRIVILEGES ([#4801](#4801)) * engine/direct: Fix unwanted recreation of secret scopes when scope_backend_type is not set ([#4834](#4834)) * engine/direct: Fix bind and unbind for non-Terraform resources ([#4850](#4850)) * engine/direct: Fix deploying removed principals ([#4824](#4824)) * engine/direct: Fix secret scope permissions migration from Terraform to Direct engine ([#4866](#4866))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Users can pass both
--profile logfoodand--host https://other-host.comon auth commands with no validation. The CLI silently picks one based on internal priority, which is confusing.Changes
Before:
databricks auth login --profile logfood --host https://other.comsilently uses one of the two with no warning.Now: produces an error explaining the conflict and suggesting to use
--profilealone.Adds a
PersistentPreRunEon theauthparent command that validates when both--profileand--hostare explicitly set. If the profile's host matches the--hostvalue (after canonicalization), the command proceeds silently. If they conflict, it returns a clear error.Test plan
validateProfileHostConflict(5 table-driven cases: matching hosts, trailing slash, conflict, profile not found, no host)make checkspassesmake lintfullpassesgo test ./cmd/auth/passes