Add app_spaces as a DABs resource type (direct mode only)

Adds support for declaring Databricks App Spaces in bundle YAML via
the `app_spaces` resource type. Spaces are containers for apps that
provide shared resources, OAuth scopes, and a service principal.

Implements direct mode CRUD with async operation waiting, a merge
mutator for the space resources array, run_as validation, and test
server handlers for the fake workspace.

Co-authored-by: Isaac

Author: bernardo-rodriguez

bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go

@@ -18,6 +18,7 @@ import (
 // This list exists to ensure that this mutator is updated when new resource is added.
 // These resources are there because they use grants, not permissions:
 var unsupportedResources = []string{
+	"app_spaces",
 	"catalogs",
 	"external_locations",
 	"volumes",

bundle/config/mutator/resourcemutator/apply_target_mode_test.go

@@ -161,6 +161,13 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 						},
 					},
 				},
+				AppSpaces: map[string]*resources.AppSpace{
+					"app_space1": {
+						Space: apps.Space{
+							Name: "app-space-1",
+						},
+					},
+				},
 				SecretScopes: map[string]*resources.SecretScope{
 					"secretScope1": {
 						Name: "secretScope1",
@@ -442,7 +449,7 @@ func TestAllNonUcResourcesAreRenamed(t *testing.T) {
 
 				// Skip resources that are not renamed (either because they don't have a user-facing Name field,
 				// or because their Name is server-generated rather than user-specified)
-				if resourceType == "Apps" || resourceType == "SecretScopes" || resourceType == "DatabaseInstances" || resourceType == "DatabaseCatalogs" || resourceType == "SyncedDatabaseTables" || resourceType == "PostgresProjects" || resourceType == "PostgresBranches" || resourceType == "PostgresEndpoints" {
+				if resourceType == "Apps" || resourceType == "AppSpaces" || resourceType == "SecretScopes" || resourceType == "DatabaseInstances" || resourceType == "DatabaseCatalogs" || resourceType == "SyncedDatabaseTables" || resourceType == "PostgresProjects" || resourceType == "PostgresBranches" || resourceType == "PostgresEndpoints" {
 					continue
 				}
 

bundle/config/mutator/resourcemutator/merge_app_spaces.go

@@ -0,0 +1,45 @@
+package resourcemutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/merge"
+)
+
+type mergeAppSpaces struct{}
+
+func MergeAppSpaces() bundle.Mutator {
+	return &mergeAppSpaces{}
+}
+
+func (m *mergeAppSpaces) Name() string {
+	return "MergeAppSpaces"
+}
+
+func (m *mergeAppSpaces) resourceName(v dyn.Value) string {
+	switch v.Kind() {
+	case dyn.KindInvalid, dyn.KindNil:
+		return ""
+	case dyn.KindString:
+		return v.MustString()
+	default:
+		panic("app space resource name must be a string")
+	}
+}
+
+func (m *mergeAppSpaces) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
+		if v.Kind() == dyn.KindNil {
+			return v, nil
+		}
+
+		return dyn.Map(v, "resources.app_spaces", dyn.Foreach(func(_ dyn.Path, space dyn.Value) (dyn.Value, error) {
+			return dyn.Map(space, "resources", merge.ElementsByKeyWithOverride("name", m.resourceName))
+		}))
+	})
+
+	return diag.FromErr(err)
+}

bundle/config/mutator/resourcemutator/resource_mutator.go

@@ -167,6 +167,10 @@ func applyNormalizeMutators(ctx context.Context, b *bundle.Bundle) {
 		// Updates (dynamic): resources.apps.*.resources (merges app resources with the same name)
 		MergeApps(),
 
+		// Reads (dynamic): resources.app_spaces.*.resources (reads app space resources to merge)
+		// Updates (dynamic): resources.app_spaces.*.resources (merges app space resources with the same name)
+		MergeAppSpaces(),
+
 		// Reads (dynamic): resources.{catalogs,schemas,external_locations,volumes,registered_models}.*.grants
 		// Updates (dynamic): same paths — merges grant entries by principal and deduplicates privileges
 		MergeGrants(),

bundle/config/mutator/resourcemutator/run_as.go

@@ -126,6 +126,16 @@ func validateRunAs(b *bundle.Bundle) diag.Diagnostics {
 		))
 	}
 
+	// App spaces do not support run_as in the API.
+	if len(b.Config.Resources.AppSpaces) > 0 {
+		diags = diags.Extend(reportRunAsNotSupported(
+			"app_spaces",
+			b.Config.GetLocation("resources.app_spaces"),
+			b.Config.Workspace.CurrentUser.UserName,
+			identity,
+		))
+	}
+
 	return diags
 }
 

bundle/config/mutator/resourcemutator/run_as_test.go

@@ -33,6 +33,7 @@ func allResourceTypes(t *testing.T) []string {
 	// also update this check when adding a new resource
 	require.Equal(t, []string{
 		"alerts",
+		"app_spaces",
 		"apps",
 		"catalogs",
 		"clusters",

bundle/config/resources.go

@@ -26,6 +26,7 @@ type Resources struct {
 	Clusters              map[string]*resources.Cluster              `json:"clusters,omitempty"`
 	Dashboards            map[string]*resources.Dashboard            `json:"dashboards,omitempty"`
 	Apps                  map[string]*resources.App                  `json:"apps,omitempty"`
+	AppSpaces             map[string]*resources.AppSpace             `json:"app_spaces,omitempty"`
 	SecretScopes          map[string]*resources.SecretScope          `json:"secret_scopes,omitempty"`
 	Alerts                map[string]*resources.Alert                `json:"alerts,omitempty"`
 	SqlWarehouses         map[string]*resources.SqlWarehouse         `json:"sql_warehouses,omitempty"`
@@ -103,6 +104,7 @@ func (r *Resources) AllResources() []ResourceGroup {
 		collectResourceMap(descriptions["dashboards"], r.Dashboards),
 		collectResourceMap(descriptions["volumes"], r.Volumes),
 		collectResourceMap(descriptions["apps"], r.Apps),
+		collectResourceMap(descriptions["app_spaces"], r.AppSpaces),
 		collectResourceMap(descriptions["alerts"], r.Alerts),
 		collectResourceMap(descriptions["secret_scopes"], r.SecretScopes),
 		collectResourceMap(descriptions["sql_warehouses"], r.SqlWarehouses),
@@ -158,6 +160,7 @@ func SupportedResources() map[string]resources.ResourceDescription {
 		"dashboards":              (&resources.Dashboard{}).ResourceDescription(),
 		"volumes":                 (&resources.Volume{}).ResourceDescription(),
 		"apps":                    (&resources.App{}).ResourceDescription(),
+		"app_spaces":              (&resources.AppSpace{}).ResourceDescription(),
 		"secret_scopes":           (&resources.SecretScope{}).ResourceDescription(),
 		"alerts":                  (&resources.Alert{}).ResourceDescription(),
 		"sql_warehouses":          (&resources.SqlWarehouse{}).ResourceDescription(),

bundle/config/resources/app_spaces.go

@@ -0,0 +1,61 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/apps"
+)
+
+type AppSpace struct {
+	BaseResource
+	apps.Space
+}
+
+func (s *AppSpace) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s AppSpace) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (s *AppSpace) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	_, err := w.Apps.GetSpace(ctx, apps.GetSpaceRequest{Name: id})
+	if err != nil {
+		log.Debugf(ctx, "app space %s does not exist", id)
+		return false, err
+	}
+	return true, nil
+}
+
+func (*AppSpace) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "app_space",
+		PluralName:    "app_spaces",
+		SingularTitle: "App Space",
+		PluralTitle:   "App Spaces",
+	}
+}
+
+func (s *AppSpace) InitializeURL(baseURL url.URL) {
+	if s.ModifiedStatus == "" || s.ModifiedStatus == ModifiedStatusCreated {
+		return
+	}
+	baseURL.Path = "apps/spaces/" + s.GetName()
+	s.URL = baseURL.String()
+}
+
+func (s *AppSpace) GetName() string {
+	if s.ID != "" {
+		return s.ID
+	}
+	return s.Name
+}
+
+func (s *AppSpace) GetURL() string {
+	return s.URL
+}

bundle/config/resources_test.go

@@ -205,6 +205,11 @@ func TestResourcesBindSupport(t *testing.T) {
 				App: apps.App{},
 			},
 		},
+		AppSpaces: map[string]*resources.AppSpace{
+			"my_app_space": {
+				Space: apps.Space{},
+			},
+		},
 		Alerts: map[string]*resources.Alert{
 			"my_alert": {
 				AlertV2: sql.AlertV2{},
@@ -300,6 +305,7 @@ func TestResourcesBindSupport(t *testing.T) {
 	m.GetMockLakeviewAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockVolumesAPI().EXPECT().Read(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockAppsAPI().EXPECT().GetByName(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockAppsAPI().EXPECT().GetSpace(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockAlertsV2API().EXPECT().GetAlertById(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockQualityMonitorsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockServingEndpointsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)

bundle/direct/dresources/all.go

@@ -16,6 +16,7 @@ var SupportedResources = map[string]any{
 	"volumes":                 (*ResourceVolume)(nil),
 	"models":                  (*ResourceMlflowModel)(nil),
 	"apps":                    (*ResourceApp)(nil),
+	"app_spaces":              (*ResourceAppSpace)(nil),
 	"sql_warehouses":          (*ResourceSqlWarehouse)(nil),
 	"database_instances":      (*ResourceDatabaseInstance)(nil),
 	"database_catalogs":       (*ResourceDatabaseCatalog)(nil),