Address review: extract profile precedence helper, cover bundle host+profile

Dedupe the --profile precedence block shared by MustWorkspaceClient and
MustAccountClient into applyProfileAuthPrecedence so the rationale lives in
one place. Add a bundle test for workspace.host + workspace.profile with
conflicting auth env vars.

Author: radakam

bundle/config/workspace_test.go

@@ -201,6 +201,34 @@ func TestWorkspaceClientProfileFillsAuthFromEnv(t *testing.T) {
 	assert.Equal(t, "env-token", client.Config.Token)
 }
 
+func TestWorkspaceClientHostAndProfileOverridesAuthEnv(t *testing.T) {
+	// A bundle that pins both workspace.host and workspace.profile: the profile
+	// still wins for auth over the env vars, the bundle host is honored, and
+	// ValidateConfigAndProfileHost passes because they agree (#5096).
+	setupWorkspaceTest(t)
+
+	err := databrickscfg.SaveToProfile(t.Context(), &config.Config{
+		Profile: "tst",
+		Host:    "https://tst.cloud.databricks.test",
+		Token:   "tst-token",
+	})
+	require.NoError(t, err)
+
+	// direnv-style auth env vars pointing at a different (dev) workspace.
+	t.Setenv("DATABRICKS_HOST", "https://dev.cloud.databricks.test")
+	t.Setenv("DATABRICKS_TOKEN", "dev-token")
+
+	w := Workspace{
+		Host:    "https://tst.cloud.databricks.test",
+		Profile: "tst",
+	}
+	client, err := w.Client(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "tst", client.Config.Profile)
+	assert.Equal(t, "https://tst.cloud.databricks.test", client.Config.Host)
+	assert.Equal(t, "tst-token", client.Config.Token)
+}
+
 func TestWorkspaceConfigHTTPTimeout(t *testing.T) {
 	for _, tc := range []struct {
 		envVal string

cmd/root/auth.go

@@ -110,6 +110,25 @@ func profileFlagValue(cmd *cobra.Command) (string, bool) {
 	return value, value != ""
 }
 
+// applyProfileAuthPrecedence makes an explicitly selected --profile take
+// precedence over auth environment variables instead of being shadowed by them.
+//
+// With a profile flag we install databrickscfg.ProfileAuthLoaders (the single
+// source of truth for this precedence rule; see its doc and #5096) and skip
+// NormalizeDatabricksConfigFromEnv: the host comes from the profile, not
+// DATABRICKS_HOST, so promoting that env host's ?o=/?a= query params would be
+// wrong. Trade-off: a host-less profile combined with a SPOG-style
+// DATABRICKS_HOST (?o=123) no longer extracts the workspace_id from the query.
+//
+// Without a profile flag we keep the SDK's env-first behavior.
+func applyProfileAuthPrecedence(ctx context.Context, cfg *config.Config, hasProfileFlag bool) {
+	if hasProfileFlag {
+		cfg.Loaders = databrickscfg.ProfileAuthLoaders
+		return
+	}
+	auth.NormalizeDatabricksConfigFromEnv(ctx, cfg)
+}
+
 // Helper function to create an account client or prompt once if the given configuration is not valid.
 func accountClientOrPrompt(ctx context.Context, cfg *config.Config, allowPrompt bool) (*databricks.AccountClient, error) {
 	a, err := databricks.NewAccountClient((*databricks.Config)(cfg))
@@ -201,14 +220,8 @@ func MustAccountClient(cmd *cobra.Command, args []string) error {
 	pr, hasProfileFlag := profileFlagValue(cmd)
 	if hasProfileFlag {
 		cfg.Profile = pr
-		// An explicit --profile takes precedence over auth env vars; see
-		// databrickscfg.ProfileAuthLoaders (#5096). NormalizeDatabricksConfigFromEnv
-		// is skipped too: the host comes from the profile, not DATABRICKS_HOST, so
-		// promoting its ?o=/?a= query params would be wrong.
-		cfg.Loaders = databrickscfg.ProfileAuthLoaders
-	} else {
-		auth.NormalizeDatabricksConfigFromEnv(ctx, cfg)
 	}
+	applyProfileAuthPrecedence(ctx, cfg, hasProfileFlag)
 
 	ctx = cmdctx.SetConfigUsed(ctx, cfg)
 	cmd.SetContext(ctx)
@@ -330,16 +343,8 @@ func MustWorkspaceClient(cmd *cobra.Command, args []string) error {
 	profile, hasProfileFlag := profileFlagValue(cmd)
 	if hasProfileFlag {
 		cfg.Profile = profile
-		// An explicit --profile takes precedence over auth env vars; see
-		// databrickscfg.ProfileAuthLoaders (#5096). NormalizeDatabricksConfigFromEnv
-		// is skipped too: the host comes from the profile, not DATABRICKS_HOST, so
-		// promoting its ?o=/?a= query params would be wrong. Trade-off: a host-less
-		// profile + SPOG-style DATABRICKS_HOST (?o=123) no longer extracts the
-		// workspace_id from the query.
-		cfg.Loaders = databrickscfg.ProfileAuthLoaders
-	} else {
-		auth.NormalizeDatabricksConfigFromEnv(ctx, cfg)
 	}
+	applyProfileAuthPrecedence(ctx, cfg, hasProfileFlag)
 	resolveDefaultProfile(ctx, cfg)
 
 	_, isTargetFlagSet := targetFlagValue(cmd)