add uv as a required dependency for codegen for early return

Author: Divyansh-db

.codegen.json

@@ -5,7 +5,7 @@
     "databricks/sdk/version.py": "__version__ = \"$VERSION\""
   },
   "toolchain": {
-    "required": ["python3.12"],
+    "required": ["python3.12", "uv"],
     "pre_setup": [
       "python3.12 -m venv .databricks"
     ],

ES-1769884-investigation.md

@@ -0,0 +1,104 @@
+# ES-1769884: SDK Recipient Activation API Investigation
+
+## Ticket Summary
+
+A customer reports that the Databricks Python SDK's `RecipientActivationAPI` for Delta Sharing does not work. The REST API (via `curl`) and browser-based download both work correctly, but the SDK implementation fails to download credential files.
+
+## Background: How Delta Sharing Activation Works
+
+Delta Sharing allows a data provider to share data with external recipients who may not have a Databricks workspace.
+
+### The Activation Flow
+
+1. **Provider** creates a recipient using `w.recipients.create(name=..., authentication_type=AuthenticationType.TOKEN)`.
+2. The server generates an `activation_url` and returns it as part of the `RecipientInfo` response. The field is described as: *"Full activation url to retrieve the access token."*
+3. **Provider** sends this `activation_url` to the recipient (e.g., via email).
+4. **Recipient** calls the activation URL (a simple unauthenticated GET request) to download a credential containing a `bearer_token` and `endpoint`.
+5. The **recipient** uses this credential with a Delta Sharing client (e.g., the `delta-sharing` Python library) to access the shared data. This token is **not** a Databricks OAuth/PAT token — it only works with the Delta Sharing protocol.
+
+**Important:** The activation URL is one-time use. Once redeemed, it cannot be used again.
+
+## Bugs Found
+
+### Bug 1: Authentication is always sent on a public endpoint
+
+The `retrieve_token` method (`sharing.py:2755`) is documented as *"a public API without any authentication"*, but the SDK **always injects auth headers**.
+
+**Root cause chain:**
+
+- `_base_client.py:86` — the HTTP session is initialized with `self._session.auth = self._authenticate`, which adds credentials to every request.
+- `retrieve_token` calls `self._api.do("GET", path, headers=headers)` without passing an `auth` override.
+- In `_base_client.py:286`, `self._session.request(..., auth=auth)` is called with `auth=None`.
+- Python's `requests` library treats `auth=None` as "use the session default" — so **auth headers are always added**.
+
+To make an unauthenticated request, the code would need to pass a no-op auth callable (e.g., `auth=lambda r: r`) instead of `None`. There is no mechanism for this currently.
+
+### Bug 2: The activation URL is incorrectly used as a path segment
+
+The `retrieve_token` method at `sharing.py:2773` constructs:
+
+```python
+f"/api/2.1/unity-catalog/public/data_sharing_activation/{activation_url}"
+```
+
+Then in `core.py:86`, the configured workspace host is prepended:
+
+```python
+url = f"{self._cfg.host}{path}"
+```
+
+The `activation_url` from `RecipientInfo` is documented as a **"full activation URL"** — a complete URL pointing to the provider's workspace. Embedding a full URL inside another API path produces a nonsensical URL. Even if the user passes just the token portion, the request is sent to the configured workspace host (the recipient's or whoever created the `WorkspaceClient`), not to the provider's host where the activation endpoint lives.
+
+### Bug 3: `get_activation_url_info` silently discards its response
+
+At `sharing.py:2751`, the return value of `self._api.do(...)` is never returned — the caller always gets `None`.
+
+## Fundamental Design Issue
+
+Beyond the implementation bugs, there is a deeper architectural problem: `RecipientActivationAPI` is attached to `WorkspaceClient`, which requires a Databricks host and credentials to instantiate. This creates a paradox:
+
+- The **provider** has no reason to call `retrieve_token` — they created the share and already have access to the data.
+- The **recipient** cannot use it — they would need a `WorkspaceClient` with credentials for the provider's workspace, which they don't have (and may not even be a Databricks customer).
+
+Neither persona can meaningfully use this API through the SDK as currently implemented.
+
+### Why `curl` / browser works but the SDK doesn't
+
+With `curl` or a browser, the customer:
+- Hits the provider's host directly (the URL is self-contained)
+- Sends no auth headers (it's a public endpoint)
+
+With the SDK:
+- The request goes to the wrong host (the configured workspace, not the provider's)
+- Auth headers are added that the provider's public endpoint doesn't expect
+- If the full activation URL is passed, it gets mangled into the path
+
+## Recommended Fix
+
+The `RecipientActivationAPI` should be a **standalone utility** that does not require a `WorkspaceClient`. The implementation should:
+
+1. Accept the full activation URL as-is (as returned by `RecipientInfo.activation_url`).
+2. Make a direct, unauthenticated GET request to that URL.
+3. Return the typed `RetrieveTokenResponse`.
+
+Example of the desired API:
+
+```python
+from databricks.sdk.service.sharing import RecipientActivation
+
+# No WorkspaceClient needed
+response = RecipientActivation.retrieve_token("https://provider.databricks.com/api/2.1/...")
+# response.bearer_token — Delta Sharing bearer token
+# response.endpoint     — Provider's sharing endpoint
+```
+
+Similarly, `get_activation_url_info` should follow the same pattern and should also return its response instead of discarding it.
+
+## References
+
+- Ticket: https://databricks.atlassian.net/browse/ES-1769884
+- SDK docs: https://databricks-sdk-py.readthedocs.io/en/latest/workspace/sharing/recipient_activation.html
+- Relevant source files:
+  - `databricks/sdk/service/sharing.py` — `RecipientActivationAPI` (line 2722), `RecipientInfo` (line 1404), `RetrieveTokenResponse` (line 1742)
+  - `databricks/sdk/core.py` — `ApiClient.do()` (line 68)
+  - `databricks/sdk/_base_client.py` — session auth setup (line 86), `_perform()` (line 274)

pyrefly.toml

@@ -0,0 +1,11 @@
+project-includes = [
+   "**/*.py"
+]
+
+project-excludes = []
+
+search-path = []
+
+disable-search-path-heuristics = true
+ignore-missing-imports = ["*"]
+ignore-errors-in-generated-code = true