Add group configuration and auth validation - #307
Open
mihaimitrea-db wants to merge 1 commit into
Open
Conversation
parthban-db
approved these changes
Sep 2, 2026
parthban-db
left a comment
parthban-db
left a comment
Contributor
There was a problem hiding this comment.
LGTM modulo comments.
Comment on lines
+124
to
+151
| it('skips unsupported strategies when a group is configured', async () => { | ||
| let unsupportedCalls = 0; | ||
| const creds = new DefaultCredentials( | ||
| [ | ||
| configuredStrategy('pat', false, () => { | ||
| unsupportedCalls += 1; | ||
| }), | ||
| configuredStrategy('oauth-m2m'), | ||
| ], | ||
| loaderFor({host: HOST, groupId: 'group-123'}) | ||
| ); | ||
|
|
||
| expect(await creds.authHeaders()).toEqual([ | ||
| {key: 'X-Test-Strategy', value: 'oauth-m2m'}, | ||
| ]); | ||
| expect(unsupportedCalls).toBe(0); | ||
| }); | ||
|
|
||
| it('preserves normal strategy ordering when the group is empty', async () => { | ||
| const creds = new DefaultCredentials( | ||
| [configuredStrategy('pat', false), configuredStrategy('oauth-m2m')], | ||
| loaderFor({host: HOST, groupId: ''}) | ||
| ); | ||
|
|
||
| expect(await creds.authHeaders()).toEqual([ | ||
| {key: 'X-Test-Strategy', value: 'pat'}, | ||
| ]); | ||
| }); |
Contributor
There was a problem hiding this comment.
These tests should be part of the above table test.
| expect(loaderCalls).toBe(1); | ||
| }); | ||
|
|
||
| it('does not configure a fallback after the selected strategy fails', async () => { |
| vi.unstubAllEnvs(); | ||
| }); | ||
|
|
||
| it('rejects grouped explicit CLI auth before invoking the CLI', async () => { |
Contributor
There was a problem hiding this comment.
ditto should be part of below table.
Comment on lines
86
to
+92
| describe('PROPERTY_DEFS', () => { | ||
| it('maps groupId to the Databricks environment and INI names', () => { | ||
| expect(GROUP_ID_DEF).toMatchObject({ | ||
| envVar: 'DATABRICKS_GROUP_ID', | ||
| iniKey: 'group_id', | ||
| }); | ||
| }); |
Contributor
There was a problem hiding this comment.
ditto we should have existing table for this.
| } | ||
| }); | ||
|
|
||
| const emptyGroupCases: { |
Contributor
There was a problem hiding this comment.
Why a different table? We should have an existing table for these cases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds group configuration and default-auth validation for group role assumption. This is the first of two stacked PRs and mirrors the configuration/validation boundary used by the Go Mod SDK.
Why
The SDK needs to resolve a requested group from supported configuration sources before OAuth credentials can request a group-scoped token. PAT and Databricks CLI authentication cannot assume a group, so allowing either strategy to silently ignore the setting would authenticate with the wrong identity.
This PR establishes the configuration and validation layer. The stacked follow-up, #308, adds
assume_groupto OAuth token requests.What changed
Interface changes
Profile.groupId, mapped toDATABRICKS_GROUP_IDand profile keygroup_id.M2mCredentialsOptions.groupIdfor the stacked OAuth implementation.GROUP_ROLE_UNSUPPORTEDtoDefaultCredentialsErrorCode.Behavioral changes
Internal changes
How is this tested?
Passed the full repository checks:
npm run formatnpm run lintnpm run typechecknpm testnpm run test:browsernpm run build