auth-m2m.test.ts

// Copyright (c) 2026 Databricks, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import { expect } from 'chai';
import expectNativeConnectionOptions from './_helpers/nativeOptions';
import KernelBackend from '../../../lib/kernel/KernelBackend';
import { buildKernelConnectionOptions } from '../../../lib/kernel/KernelAuth';
import { ConnectionOptions } from '../../../lib/contracts/IDBSQLClient';
import AuthenticationError from '../../../lib/errors/AuthenticationError';
import HiveDriverError from '../../../lib/errors/HiveDriverError';
import { makeFakeBinding, makeFakeContext } from './_helpers/fakeBinding';

describe('KernelAuth + KernelBackend — OAuth M2M auth flow', () => {
  describe('buildKernelConnectionOptions', () => {
    it('accepts databricks-oauth + oauthClientId + oauthClientSecret', () => {
      const opts: ConnectionOptions = {
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
      };

      const native = buildKernelConnectionOptions(opts);
      expectNativeConnectionOptions(native, {
        hostName: 'example.cloud.databricks.com',
        httpPath: '/sql/1.0/warehouses/abc',
        intervalsAsString: true,
        authMode: 'OAuthM2m',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
        oauthScopes: ['all-apis'],
      });
    });

    it('defaults M2M oauthScopes to all-apis (Thrift + kernel parity)', () => {
      const native = buildKernelConnectionOptions({
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
      });
      expect(native.authMode).to.equal('OAuthM2m');
      expect((native as { oauthScopes?: string[] }).oauthScopes).to.deep.equal(['all-apis']);
    });

    it('honors a caller-supplied M2M oauthScopes override (parity with pyo3)', () => {
      const native = buildKernelConnectionOptions({
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
        oauthScopes: ['sql', 'offline_access'],
      } as ConnectionOptions);
      expect((native as { oauthScopes?: string[] }).oauthScopes).to.deep.equal(['sql', 'offline_access']);
    });

    it('prepends `/` to the path on the M2M branch too', () => {
      const opts: ConnectionOptions = {
        host: 'example.cloud.databricks.com',
        path: 'sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
      };

      const native = buildKernelConnectionOptions(opts);
      expect(native.httpPath).to.equal('/sql/1.0/warehouses/abc');
    });

    it('rejects missing oauthClientId with AuthenticationError', () => {
      const opts = {
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientSecret: 'dose-fake-secret',
      } as unknown as ConnectionOptions;

      expect(() => buildKernelConnectionOptions(opts)).to.throw(AuthenticationError, /oauthClientId.*required/);
    });

    it('rejects empty oauthClientId with AuthenticationError', () => {
      const opts = {
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: '',
        oauthClientSecret: 'dose-fake-secret',
      } as unknown as ConnectionOptions;

      expect(() => buildKernelConnectionOptions(opts)).to.throw(AuthenticationError, /oauthClientId.*required/);
    });

    it('rejects empty oauthClientSecret with AuthenticationError when oauthClientId is set (M2M intent)', () => {
      const opts: ConnectionOptions = {
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: '',
      };

      // Presence of `oauthClientId` signals M2M intent; an empty secret
      // is a typo/missing-env, not a request to fall back to U2M.
      // Surface the M2M "secret required" error so the user knows the
      // real problem instead of getting routed to a different flow.
      expect(() => buildKernelConnectionOptions(opts)).to.throw(
        AuthenticationError,
        /oauthClientSecret.*non-empty.*OAuth M2M/,
      );
    });

    it('rejects azureTenantId with a clear Entra-direct-out-of-scope error', () => {
      const opts: ConnectionOptions = {
        host: 'adb-12345.0.azuredatabricks.net',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
        azureTenantId: 'tenant-uuid',
      };

      expect(() => buildKernelConnectionOptions(opts)).to.throw(
        HiveDriverError,
        /Azure-direct OAuth.*is not supported/,
      );
    });

    it('rejects useDatabricksOAuthInAzure with the same Entra-direct error', () => {
      const opts: ConnectionOptions = {
        host: 'adb-12345.0.azuredatabricks.net',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
        useDatabricksOAuthInAzure: true,
      };

      expect(() => buildKernelConnectionOptions(opts)).to.throw(
        HiveDriverError,
        /Azure-direct OAuth.*is not supported/,
      );
    });

    it('rejects a `persistence` hook on M2M (no cache needed)', () => {
      const opts: ConnectionOptions = {
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
        persistence: {
          read: async () => undefined,
          persist: async () => undefined,
        },
      };

      expect(() => buildKernelConnectionOptions(opts)).to.throw(
        HiveDriverError,
        /`persistence` is not supported on OAuth M2M/,
      );
    });
  });

  describe('KernelBackend.connect + openSession (M2M)', () => {
    it('round-trips M2M options through to the napi binding', async () => {
      const { binding, calls } = makeFakeBinding();
      const backend = new KernelBackend({ nativeBinding: binding, context: makeFakeContext() });

      await backend.connect({
        host: 'example.cloud.databricks.com',
        path: '/sql/1.0/warehouses/abc',
        authType: 'databricks-oauth',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
      });

      const session = await backend.openSession({});
      // Post-integration: KernelSessionBackend generates UUIDv4 ids; the
      // earlier auth-only counter-id scheme was superseded.
      expect(session.id).to.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);

      expect(calls).to.have.lengthOf(1);
      expect(calls[0].method).to.equal('openSession');
      expectNativeConnectionOptions(calls[0].args[0], {
        hostName: 'example.cloud.databricks.com',
        httpPath: '/sql/1.0/warehouses/abc',
        intervalsAsString: true,
        authMode: 'OAuthM2m',
        oauthClientId: 'client-uuid',
        oauthClientSecret: 'dose-fake-secret',
        oauthScopes: ['all-apis'],
      });

      await session.close();
      await backend.close();
    });

    it('rejects connect() for missing oauthClientId before touching the binding', async () => {
      const { binding, calls } = makeFakeBinding();
      const backend = new KernelBackend({ nativeBinding: binding, context: makeFakeContext() });

      let caught: unknown;
      try {
        await backend.connect({
          host: 'example.cloud.databricks.com',
          path: '/sql/1.0/warehouses/abc',
          authType: 'databricks-oauth',
          // eslint-disable-next-line @typescript-eslint/no-explicit-any
          oauthClientSecret: 'dose-fake-secret',
        } as any);
      } catch (e) {
        caught = e;
      }
      expect(caught).to.be.instanceOf(AuthenticationError);
      expect(calls).to.have.lengthOf(0);
    });
  });
});