auth: --skip-workspace skips workspace selector in discovery flow#5347
Draft
simonfaltum wants to merge 4 commits into
Draft
auth: --skip-workspace skips workspace selector in discovery flow#5347simonfaltum wants to merge 4 commits into
simonfaltum wants to merge 4 commits into
Conversation
`databricks auth login --skip-workspace` (no --host) now lands the user on the account selector at login.databricks.com instead of the workspace selector. The workspace pick was a wasted step when the caller already said they only want account-level access. Wired through u2m.WithDiscoveryAccountTarget() from databricks-sdk-go, which sets target=ACCOUNT on the discovery authorize URL. Co-authored-by: Isaac
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
Integration test reportCommit: f7d7f7d
29 interesting tests: 15 SKIP, 7 KNOWN, 4 flaky, 3 FAIL
Top 43 slowest tests (at least 2 minutes):
|
…space-account-target
The branch predated SDK v0.140.0, so u2m.WithDiscoveryAccountTarget did not exist and every CI job failed on the compile error. Merging main brings SDK v0.141.0 which has the option. Main also replaced the tokenCache field on discoveryLoginInputs with tokenStore, so the new test now uses tokenStore: newTestStore(). Co-authored-by: Isaac
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
…space-account-target # Conflicts: # NEXT_CHANGELOG.md
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
When the user runs
databricks auth login --skip-workspace(without--host), the CLI uses the discovery flow vialogin.databricks.com. Today the discovery page asks the user to pick a workspace before sending them to OAuth, even though they explicitly said they only want account-level access. That workspace pick is wasted: the resulting profile is account-only either way.Changes
--skip-workspacewas silently ignored in the discovery flow. The user landed on the workspace selector and had to pick a workspace anyway.--skip-workspaceis set and the discovery flow is used, the CLI passesu2m.WithDiscoveryAccountTarget()to the SDK. The SDK setstarget=ACCOUNTon the discovery authorize URL, sologin.databricks.comlands the user directly on the account selector instead of the workspace selector.Behavior outside the discovery flow (i.e. when
--hostis set) is unchanged.Depends on databricks/databricks-sdk-go#1701 (
u2m.WithDiscoveryAccountTarget) being merged and the SDK bumped in the CLI. CI will fail compilation until that happens; that's expected.Test plan
TestDiscoveryLogin_SkipWorkspaceAddsAccountTargetOptionverifies that runningdiscoveryLoginwithskipWorkspace: trueresults in exactly one additionalPersistentAuthOptionbeing passed to the SDK relative to the baseline. The SDK PR's tests cover what that option actually does to the URL.go test ./cmd/auth/...(existing tests still green)./task checks(with local SDK replace)