Auth: error when --profile and --host conflict#4841
Merged
simonfaltum merged 8 commits intomainfrom Apr 7, 2026
Merged
Conversation
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: 70e8eab
17 interesting tests: 10 SKIP, 7 RECOVERED
Top 20 slowest tests (at least 2 minutes):
|
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
Suggested reviewersBased on git history of the changed files, these people are best suited to review:
Confidence: high Eligible reviewersBased on CODEOWNERS, these people or teams could also review: @andrewnester, @anton-107, @denik, @shreyas-goenka Suggestions based on git history of 4 changed files (3 scored). See CODEOWNERS for path-specific ownership rules. |
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
Co-authored-by: Isaac
simonfaltum
force-pushed
the
simonfaltum/auth-profile-host-conflict
branch
from
a07aa55 to
c758131
Compare
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Remove promptForWorkspaceID that was deleted on main but accidentally reintroduced during rebase. Update the custom-config-file acceptance test to expect the new profile/host conflict error. Co-authored-by: Isaac
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
requested review from
mihaimitrea-db
and removed request for
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
mihaimitrea-db
approved these changes
Apr 7, 2026
Contributor
mihaimitrea-db
left a comment
mihaimitrea-db
left a comment
There was a problem hiding this comment.
LGTM after description is updated
Item 3 in the long description still described the old behavior where conflicting --profile and --host would silently update the profile. Updated to describe the new error behavior. Co-authored-by: Isaac
Keep both the new --force-refresh flag from main and the profileHostConflictCheck PreRunE from this branch. Co-authored-by: Isaac
deco-sdk-tagging bot
added a commit
that referenced
this pull request
Apr 8, 2026
## Release v0.296.0 ### Notable Changes * Direct deployment engine for DABs is now in Public Preview. Documentation at [docs/direct.md](docs/direct.md). ### CLI * Auth commands now error when --profile and --host conflict ([#4841](#4841)) * Add `--force-refresh` flag to `databricks auth token` to force a token refresh even when the cached token is still valid ([#4767](#4767)) ### Bundles * Deduplicate grant entries with duplicate principals or privileges during initialization ([#4801](#4801)) * Fix `bundle deployment bind` to always pull remote state before modifying ([#4892](#4892)) * engine/direct: Fix drift in grants resource due to privilege reordering ([#4794](#4794)) * engine/direct: Fix 400 error when deploying grants with ALL_PRIVILEGES ([#4801](#4801)) * engine/direct: Fix unwanted recreation of secret scopes when scope_backend_type is not set ([#4834](#4834)) * engine/direct: Fix bind and unbind for non-Terraform resources ([#4850](#4850)) * engine/direct: Fix deploying removed principals ([#4824](#4824)) * engine/direct: Fix secret scope permissions migration from Terraform to Direct engine ([#4866](#4866))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Users can pass both
--profile logfoodand--host https://other-host.comon auth commands with no validation. The CLI silently picks one based on internal priority, which is confusing.Changes
Before:
databricks auth login --profile logfood --host https://other.comsilently uses one of the two with no warning.Now: produces an error explaining the conflict and suggesting to use
--profilealone.Adds a
PersistentPreRunEon theauthparent command that validates when both--profileand--hostare explicitly set. If the profile's host matches the--hostvalue (after canonicalization), the command proceeds silently. If they conflict, it returns a clear error.Test plan
validateProfileHostConflict(5 table-driven cases: matching hosts, trailing slash, conflict, profile not found, no host)make checkspassesmake lintfullpassesgo test ./cmd/auth/passes