Skip to content

Commit f81f37b

Browse files
committed
Merge main, extract reusable ExtractHostQueryParams
Resolve merge conflicts with origin/main (discovery login flow). Extract host URL query param parsing into libs/auth.ExtractHostQueryParams so it can be reused by the bundle SPOG support PR (#4825). Co-authored-by: Isaac
2 parents 4c1b3ac + 1572b1a commit f81f37b

File tree

17 files changed

+1223
-58
lines changed

17 files changed

+1223
-58
lines changed

.github/dependabot.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "weekly"
7+
ignore:
8+
# Ignore Databricks Go SDK because its upgrade requires code generation
9+
- dependency-name: github.com/databricks/databricks-sdk-go
710
- package-ecosystem: "gomod"
811
directory: "/tools"
912
schedule:
@@ -15,7 +18,9 @@ updates:
1518
- "/.github/actions/setup-build-environment"
1619
schedule:
1720
interval: "monthly"
21+
cooldown:
22+
default-days: 7
1823
# tagging.yml is generated and maintained externally. Ignore
1924
# actions/create-github-app-token since it is only used in tagging.yml.
20-
ignore:
21-
- dependency-name: "actions/create-github-app-token"
25+
exclude-paths:
26+
- .github/workflows/tagging.yml

.github/workflows/push.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -422,7 +422,7 @@ jobs:
422422
# Use Checks API (not Statuses API) to match the required "Integration Tests" check.
423423
- name: Skip integration tests (pull request)
424424
if: ${{ github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') && !contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh') }}
425-
uses: actions/github-script@v8
425+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
426426
with:
427427
github-token: ${{ steps.generate-check-token.outputs.token }}
428428
script: |
@@ -443,7 +443,7 @@ jobs:
443443
# Use Checks API (not Statuses API) to match the required "Integration Tests" check.
444444
- name: Auto-approve for merge group
445445
if: ${{ github.event_name == 'merge_group' }}
446-
uses: actions/github-script@v8
446+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
447447
with:
448448
github-token: ${{ steps.generate-check-token.outputs.token }}
449449
script: |
@@ -487,7 +487,7 @@ jobs:
487487

488488
steps:
489489
- name: Skip integration tests
490-
uses: actions/github-script@v8
490+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
491491
with:
492492
script: |-
493493
await github.rest.checks.create({

.github/workflows/release.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ jobs:
115115
AZURE_CLIENT_SECRET: ${{ secrets.DECO_SIGN_AZURE_CLIENT_SECRET }}
116116

117117
- name: Upload Windows artifacts to GitHub Actions
118-
uses: actions/upload-artifact@v7
118+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
119119
with:
120120
name: windows-artifacts
121121
path: |
@@ -135,7 +135,7 @@ jobs:
135135

136136
steps:
137137
- name: Download Windows artifacts
138-
uses: actions/download-artifact@v8
138+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
139139
with:
140140
name: windows-artifacts
141141
path: dist

.github/workflows/tagging.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,13 @@ jobs:
3434
steps:
3535
- name: Generate GitHub App Token
3636
id: generate-token
37-
uses: actions/create-github-app-token@v3
37+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
3838
with:
3939
app-id: ${{ secrets.DECO_SDK_TAGGING_APP_ID }}
4040
private-key: ${{ secrets.DECO_SDK_TAGGING_PRIVATE_KEY }}
4141

4242
- name: Checkout repository
43-
uses: actions/checkout@v6.0.2
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4444
with:
4545
fetch-depth: 0
4646
token: ${{ steps.generate-token.outputs.token }}
Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/env python3
2+
"""
3+
Simulates the login.databricks.com discovery flow for acceptance tests.
4+
5+
When the CLI opens this "browser" with the login.databricks.com URL,
6+
the script extracts the OAuth parameters from the destination_url,
7+
constructs a callback to localhost with an iss parameter pointing
8+
at the testserver, and fetches it.
9+
10+
Usage: discovery_browser.py <url>
11+
"""
12+
13+
import os
14+
import sys
15+
import urllib.parse
16+
import urllib.request
17+
18+
if len(sys.argv) < 2:
19+
sys.stderr.write("Usage: discovery_browser.py <url>\n")
20+
sys.exit(1)
21+
22+
url = sys.argv[1]
23+
parsed = urllib.parse.urlparse(url)
24+
top_params = urllib.parse.parse_qs(parsed.query)
25+
26+
destination_url = top_params.get("destination_url", [None])[0]
27+
if not destination_url:
28+
sys.stderr.write(f"No destination_url found in: {url}\n")
29+
sys.exit(1)
30+
31+
dest_parsed = urllib.parse.urlparse(destination_url)
32+
dest_params = urllib.parse.parse_qs(dest_parsed.query)
33+
34+
redirect_uri = dest_params.get("redirect_uri", [None])[0]
35+
state = dest_params.get("state", [None])[0]
36+
37+
if not redirect_uri or not state:
38+
sys.stderr.write(f"Missing redirect_uri or state in destination_url: {destination_url}\n")
39+
sys.exit(1)
40+
41+
# The testserver's host acts as the workspace issuer.
42+
testserver_host = os.environ.get("DATABRICKS_HOST", "")
43+
if not testserver_host:
44+
sys.stderr.write("DATABRICKS_HOST not set\n")
45+
sys.exit(1)
46+
47+
issuer = testserver_host.rstrip("/") + "/oidc"
48+
49+
# Build the callback URL with code, state, and iss (the workspace issuer).
50+
callback_params = urllib.parse.urlencode(
51+
{
52+
"code": "oauth-code",
53+
"state": state,
54+
"iss": issuer,
55+
}
56+
)
57+
callback_url = f"{redirect_uri}?{callback_params}"
58+
59+
try:
60+
response = urllib.request.urlopen(callback_url)
61+
if response.status != 200:
62+
sys.stderr.write(f"Callback failed: {callback_url} (status {response.status})\n")
63+
sys.exit(1)
64+
except Exception as e:
65+
sys.stderr.write(f"Callback failed: {callback_url} ({e})\n")
66+
sys.exit(1)
67+
68+
sys.exit(0)
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
2+
[DEFAULT]
3+
4+
[discovery-test]
5+
host = [DATABRICKS_URL]
6+
workspace_id = 12345
7+
auth_type = databricks-cli
8+
9+
[__settings__]
10+
default_profile = discovery-test

acceptance/cmd/auth/login/discovery/out.test.toml

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
2+
>>> [CLI] auth login --profile discovery-test
3+
Opening login.databricks.com in your browser...
4+
Profile discovery-test was successfully saved
5+
6+
>>> [CLI] auth profiles
7+
Name Host Valid
8+
discovery-test (Default) [DATABRICKS_URL] YES
9+
10+
>>> print_requests.py --get //tokens/introspect
11+
{
12+
"method": "GET",
13+
"path": "/api/2.0/tokens/introspect"
14+
}
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
sethome "./home"
2+
3+
# Use the discovery browser script that simulates login.databricks.com
4+
export BROWSER="discovery_browser.py"
5+
6+
trace $CLI auth login --profile discovery-test
7+
8+
trace $CLI auth profiles
9+
10+
# Verify the introspection endpoint was called (workspace_id in profile confirms this too).
11+
trace print_requests.py --get //tokens/introspect
12+
13+
# Track the .databrickscfg file that was created to surface changes.
14+
mv "./home/.databrickscfg" "./out.databrickscfg"
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
Ignore = [
2+
"home"
3+
]
4+
RecordRequests = true
5+
6+
# Override the introspection endpoint so we can verify it gets called.
7+
[[Server]]
8+
Pattern = "GET /api/2.0/tokens/introspect"
9+
Response.Body = '''
10+
{
11+
"principal_context": {
12+
"authentication_scope": {
13+
"account_id": "test-account-123",
14+
"workspace_id": 12345
15+
}
16+
}
17+
}
18+
'''

0 commit comments

Comments
 (0)