From df2a122a9e2fa70d88922031c621458f0c94ce81 Mon Sep 17 00:00:00 2001 From: Rada Kamysheva Date: Tue, 18 Aug 2026 08:16:53 +0000 Subject: [PATCH 1/4] Validate secret scope permission levels during bundle validate. Without Values(), generated enum validation skipped permissions[*].level, so invalid levels passed validate --strict and only failed at deploy. --- .../databricks.yml | 26 +++++++++++++ .../out.test.toml | 2 + .../output.txt | 39 +++++++++++++++++++ .../script | 5 +++ .../test.toml | 5 +++ bundle/config/resources/secret_scope.go | 9 +++++ .../validation/generated/enum_fields.go | 3 +- 7 files changed, 88 insertions(+), 1 deletion(-) create mode 100644 acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml create mode 100644 acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml create mode 100644 acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt create mode 100644 acceptance/bundle/validate/secret_scope_invalid_permission_level/script create mode 100644 acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml new file mode 100644 index 00000000000..da679395a92 --- /dev/null +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml @@ -0,0 +1,26 @@ +bundle: + name: test-bundle + +resources: + secret_scopes: + bad_numeric_level: + name: test-scope-bad-numeric-level + permissions: + # YAML int is coerced to string; must still fail enum validation. + - level: 2147483648 + group_name: users + bad_numeric_string_level: + name: test-scope-bad-numeric-string-level + permissions: + - level: "2147483648" + user_name: someone@example.com + bad_string_level: + name: test-scope-bad-string-level + permissions: + - level: fuzz_badlevel + service_principal_name: 12345678-1234-1234-1234-123456789abc + valid: + name: test-scope-valid + permissions: + - level: READ + group_name: users diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml new file mode 100644 index 00000000000..98ea5040486 --- /dev/null +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml @@ -0,0 +1,2 @@ +Cloud = false +EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"] diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt new file mode 100644 index 00000000000..b58d1223d42 --- /dev/null +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt @@ -0,0 +1,39 @@ + +>>> [CLI] bundle validate +Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] + at resources.secret_scopes.bad_numeric_level.permissions[0].level + +Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] + at resources.secret_scopes.bad_numeric_string_level.permissions[0].level + +Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE] + at resources.secret_scopes.bad_string_level.permissions[0].level + +Name: test-bundle +Target: default +Workspace: + User: [USERNAME] + Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default + +Found 3 warnings + +>>> [CLI] bundle validate --strict +Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] + at resources.secret_scopes.bad_numeric_level.permissions[0].level + +Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] + at resources.secret_scopes.bad_numeric_string_level.permissions[0].level + +Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE] + at resources.secret_scopes.bad_string_level.permissions[0].level + +Name: test-bundle +Target: default +Workspace: + User: [USERNAME] + Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default + +Found 3 warnings +Error: 3 warnings were found. Warnings are not allowed in strict mode + +Exit code: 1 diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/script b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script new file mode 100644 index 00000000000..acb281980e2 --- /dev/null +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script @@ -0,0 +1,5 @@ +# Without --strict, invalid enum levels are warnings only. +trace $CLI bundle validate + +# With --strict, those warnings must fail validation. +errcode trace $CLI bundle validate --strict diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml new file mode 100644 index 00000000000..465d3c41ccc --- /dev/null +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml @@ -0,0 +1,5 @@ +# Pin the fuzz-found invalid level so the root [NUMID] regex does not rewrite it. +[[Repls]] +Old = '2147483648' +New = '[BAD_PERM_LEVEL]' +Order = 5 diff --git a/bundle/config/resources/secret_scope.go b/bundle/config/resources/secret_scope.go index 702ee914f8a..6e5e58a3fc5 100644 --- a/bundle/config/resources/secret_scope.go +++ b/bundle/config/resources/secret_scope.go @@ -17,6 +17,15 @@ const ( SecretScopePermissionLevelWrite SecretScopePermissionLevel = "WRITE" ) +// Values enables generated enum validation for secret scope permission levels. +func (SecretScopePermissionLevel) Values() []SecretScopePermissionLevel { + return []SecretScopePermissionLevel{ + SecretScopePermissionLevelRead, + SecretScopePermissionLevelWrite, + SecretScopePermissionLevelManage, + } +} + // SecretScopePermission holds the permission level setting for a single principal. // Multiple of these can be defined on any secret scope. // Secret scopes permissions are mapped to Secret ACLs diff --git a/bundle/internal/validation/generated/enum_fields.go b/bundle/internal/validation/generated/enum_fields.go index 5dadaece243..ecdef3afa24 100644 --- a/bundle/internal/validation/generated/enum_fields.go +++ b/bundle/internal/validation/generated/enum_fields.go @@ -233,7 +233,8 @@ var EnumFields = map[string][]string{ "resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, - "resources.secret_scopes.*.backend_type": {"AZURE_KEYVAULT", "DATABRICKS"}, + "resources.secret_scopes.*.backend_type": {"AZURE_KEYVAULT", "DATABRICKS"}, + "resources.secret_scopes.*.permissions[*].level": {"READ", "WRITE", "MANAGE"}, "resources.secrets.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"}, From bdb5865237d7864510d16923314d38be388ca007 Mon Sep 17 00:00:00 2001 From: Rada Kamysheva Date: Tue, 18 Aug 2026 08:27:49 +0000 Subject: [PATCH 2/4] Stabilize secret scope invalid permission level acceptance output. Multiple secret_scopes map keys made warning order non-deterministic across engines; keep the cases as ordered permissions on one scope instead. --- .../databricks.yml | 10 ++-------- .../secret_scope_invalid_permission_level/output.txt | 12 ++++++------ 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml index da679395a92..2315410319c 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml @@ -3,20 +3,14 @@ bundle: resources: secret_scopes: - bad_numeric_level: - name: test-scope-bad-numeric-level + bad_levels: + name: test-scope-bad-levels permissions: # YAML int is coerced to string; must still fail enum validation. - level: 2147483648 group_name: users - bad_numeric_string_level: - name: test-scope-bad-numeric-string-level - permissions: - level: "2147483648" user_name: someone@example.com - bad_string_level: - name: test-scope-bad-string-level - permissions: - level: fuzz_badlevel service_principal_name: 12345678-1234-1234-1234-123456789abc valid: diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt index b58d1223d42..024e0c08c51 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt @@ -1,13 +1,13 @@ >>> [CLI] bundle validate Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_numeric_level.permissions[0].level + at resources.secret_scopes.bad_levels.permissions[0].level Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_numeric_string_level.permissions[0].level + at resources.secret_scopes.bad_levels.permissions[1].level Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_string_level.permissions[0].level + at resources.secret_scopes.bad_levels.permissions[2].level Name: test-bundle Target: default @@ -19,13 +19,13 @@ Found 3 warnings >>> [CLI] bundle validate --strict Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_numeric_level.permissions[0].level + at resources.secret_scopes.bad_levels.permissions[0].level Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_numeric_string_level.permissions[0].level + at resources.secret_scopes.bad_levels.permissions[1].level Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_string_level.permissions[0].level + at resources.secret_scopes.bad_levels.permissions[2].level Name: test-bundle Target: default From 14cc05b3886eac3d542ecb6304f17a54a13abf3f Mon Sep 17 00:00:00 2001 From: Rada Kamysheva Date: Tue, 18 Aug 2026 08:29:37 +0000 Subject: [PATCH 3/4] Use musterr for expected strict validate failure. errcode only records tolerated failures; musterr asserts validate --strict must fail. --- .../validate/secret_scope_invalid_permission_level/output.txt | 2 -- .../validate/secret_scope_invalid_permission_level/script | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt index 024e0c08c51..24b7fc3dc85 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt @@ -35,5 +35,3 @@ Workspace: Found 3 warnings Error: 3 warnings were found. Warnings are not allowed in strict mode - -Exit code: 1 diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/script b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script index acb281980e2..cba001f92b4 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/script +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script @@ -2,4 +2,4 @@ trace $CLI bundle validate # With --strict, those warnings must fail validation. -errcode trace $CLI bundle validate --strict +musterr trace $CLI bundle validate --strict From d1a5b060838f3d10b88db42fd4044dbfea1c4c31 Mon Sep 17 00:00:00 2001 From: Rada Kamysheva Date: Tue, 18 Aug 2026 09:50:14 +0000 Subject: [PATCH 4/4] Address review feedback on secret scope permission validation. Add a changelog fragment, simplify the acceptance fixture, and align permission-level constant order with privilege rank. --- .../secret-scope-invalid-permission-level.md | 1 + .../databricks.yml | 4 +--- .../output.txt | 20 +++++++------------ .../script | 4 +--- .../test.toml | 5 ----- bundle/config/resources/secret_scope.go | 4 ++-- 6 files changed, 12 insertions(+), 26 deletions(-) create mode 100644 .nextchanges/bundles/secret-scope-invalid-permission-level.md delete mode 100644 acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml diff --git a/.nextchanges/bundles/secret-scope-invalid-permission-level.md b/.nextchanges/bundles/secret-scope-invalid-permission-level.md new file mode 100644 index 00000000000..4e1a6c86cd1 --- /dev/null +++ b/.nextchanges/bundles/secret-scope-invalid-permission-level.md @@ -0,0 +1 @@ +Warn on invalid `secret_scopes` permission levels (`READ`, `WRITE`, `MANAGE`); fail under `bundle validate --strict`. diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml index 2315410319c..b80dc842d6e 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml @@ -7,10 +7,8 @@ resources: name: test-scope-bad-levels permissions: # YAML int is coerced to string; must still fail enum validation. - - level: 2147483648 + - level: 12 group_name: users - - level: "2147483648" - user_name: someone@example.com - level: fuzz_badlevel service_principal_name: 12345678-1234-1234-1234-123456789abc valid: diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt index 24b7fc3dc85..ce3a523536f 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt @@ -1,13 +1,10 @@ >>> [CLI] bundle validate -Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] +Warning: invalid value "12" for enum field. Valid values are [READ WRITE MANAGE] at resources.secret_scopes.bad_levels.permissions[0].level -Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_levels.permissions[1].level - Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_levels.permissions[2].level + at resources.secret_scopes.bad_levels.permissions[1].level Name: test-bundle Target: default @@ -15,17 +12,14 @@ Workspace: User: [USERNAME] Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default -Found 3 warnings +Found 2 warnings >>> [CLI] bundle validate --strict -Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] +Warning: invalid value "12" for enum field. Valid values are [READ WRITE MANAGE] at resources.secret_scopes.bad_levels.permissions[0].level -Warning: invalid value "[BAD_PERM_LEVEL]" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_levels.permissions[1].level - Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE] - at resources.secret_scopes.bad_levels.permissions[2].level + at resources.secret_scopes.bad_levels.permissions[1].level Name: test-bundle Target: default @@ -33,5 +27,5 @@ Workspace: User: [USERNAME] Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default -Found 3 warnings -Error: 3 warnings were found. Warnings are not allowed in strict mode +Found 2 warnings +Error: 2 warnings were found. Warnings are not allowed in strict mode diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/script b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script index cba001f92b4..9bfb2b86d2c 100644 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/script +++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script @@ -1,5 +1,3 @@ -# Without --strict, invalid enum levels are warnings only. +# Invalid levels warn (same as other enum fields); --strict must fail. trace $CLI bundle validate - -# With --strict, those warnings must fail validation. musterr trace $CLI bundle validate --strict diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml deleted file mode 100644 index 465d3c41ccc..00000000000 --- a/acceptance/bundle/validate/secret_scope_invalid_permission_level/test.toml +++ /dev/null @@ -1,5 +0,0 @@ -# Pin the fuzz-found invalid level so the root [NUMID] regex does not rewrite it. -[[Repls]] -Old = '2147483648' -New = '[BAD_PERM_LEVEL]' -Order = 5 diff --git a/bundle/config/resources/secret_scope.go b/bundle/config/resources/secret_scope.go index 6e5e58a3fc5..30d0ebd901d 100644 --- a/bundle/config/resources/secret_scope.go +++ b/bundle/config/resources/secret_scope.go @@ -13,11 +13,11 @@ type SecretScopePermissionLevel string const ( SecretScopePermissionLevelRead SecretScopePermissionLevel = "READ" - SecretScopePermissionLevelManage SecretScopePermissionLevel = "MANAGE" SecretScopePermissionLevelWrite SecretScopePermissionLevel = "WRITE" + SecretScopePermissionLevelManage SecretScopePermissionLevel = "MANAGE" ) -// Values enables generated enum validation for secret scope permission levels. +// Values enables generated enum validation. Order matches privilege rank (READ < WRITE < MANAGE). func (SecretScopePermissionLevel) Values() []SecretScopePermissionLevel { return []SecretScopePermissionLevel{ SecretScopePermissionLevelRead,