@dbx-tools/auth 0.9.31 → 0.9.36

package/src/databricks-auth.ts

@@ -1,416 +0,0 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-import * as environmentUtils from "@dbx-tools/shared-core/environment-utils";
-
-import { authLogger, tokenMetadata } from "./_logging.ts";
-import { AuthError } from "./errors.ts";
-import { DatabricksCliProvider, resolveDatabricksCli } from "./databricks-cli.ts";
-import { publicToken, TokenLifecycle } from "./lifecycle.ts";
-import { FileCredentialStore } from "./node-storage.ts";
-import { DatabricksPersonalAccessTokenProvider } from "./personal-access-token.ts";
-import {
-  listDatabricksProfiles,
-  machineScopes,
-  resolveConfigFile,
-  resolveDatabricksProfile,
-} from "./_profile.ts";
-import { DatabricksServicePrincipalProvider } from "./service-principal.ts";
-import { MemoryCredentialStore } from "./storage.ts";
-import {
-  AuthKind,
-  type AuthClient,
-  AuthOptions,
-  type CredentialStore,
-  type DatabricksAuthOptions,
-  type DatabricksAuthStatus,
-  type DatabricksProfile,
-  DEFAULT_ACCESS_TOKEN_HEADER,
-  Storage,
-  TargetKind,
-  type Token,
-  type TokenProvider,
-  WORKSPACE_ID_HEADER,
-} from "./types.ts";
-
-const logger = authLogger("databricks");
-
-/** Injectable host capabilities for Databricks authentication. */
-export interface DatabricksAuthDependencies {
-  environment?: Readonly<Record<string, string | undefined>>;
-  fetch?: typeof globalThis.fetch;
-  resolveCli?: (options: { install: boolean }) => Promise<string | undefined>;
-}
-
-/** Persistent Databricks auth facade over the provider-neutral lifecycle. */
-class PersistentAuth implements AuthClient {
-  constructor(
-    private readonly profileValue: DatabricksProfile,
-    private readonly storageValue: Storage,
-    private readonly options: DatabricksAuthOptions,
-    private readonly environment: Readonly<Record<string, string | undefined>>,
-    private readonly client?: TokenLifecycle,
-    private readonly requestToken?: Token,
-  ) {}
-
-  async challenge(): Promise<void> {
-    if (!this.client)
-      throw new AuthError("oauth", "app_obo uses the current request token and cannot start login");
-    logger.debug("authentication challenge requested", this.context());
-    await this.client.login();
-    logger.debug("authentication challenge completed", this.context());
-  }
-
-  token(login?: boolean) {
-    logger.debug("Databricks token requested", {
-      ...this.context(),
-      login: login ?? "auto",
-      source: this.requestToken ? "request" : "lifecycle",
-    });
-    return this.requestToken
-      ? Promise.resolve(publicToken(this.requestToken))
-      : this.requiredClient().tokenWithLogin(login);
-  }
-
-  async authenticate(login?: boolean): Promise<Record<string, string>> {
-    const token = await this.token(login);
-    const headers = {
-      [DEFAULT_ACCESS_TOKEN_HEADER]: `${token.tokenType} ${token.accessToken}`,
-      ...(this.profileValue.workspaceId
-        ? { [WORKSPACE_ID_HEADER]: this.profileValue.workspaceId }
-        : {}),
-    };
-    logger.debug("generated Databricks authentication headers", {
-      ...this.context(),
-      headerNames: Object.keys(headers),
-      token: tokenMetadata(token),
-    });
-    return headers;
-  }
-
-  async authorizationHeaderForUrl(
-    requestUrl: string,
-    login?: boolean,
-  ): Promise<string | undefined> {
-    return (await this.requestHeadersForUrl(requestUrl, login))[DEFAULT_ACCESS_TOKEN_HEADER];
-  }
-
-  async requestHeadersForUrl(requestUrl: string, login?: boolean): Promise<Record<string, string>> {
-    const request = new URL(requestUrl);
-    const credentialOrigin = new URL(this.profileValue.host).origin;
-    if (request.origin !== credentialOrigin) {
-      logger.debug("skipped authentication for different origin", {
-        ...this.context(),
-        requestOrigin: request.origin,
-        credentialOrigin,
-      });
-      return {};
-    }
-    logger.debug("applying authentication to matching origin", {
-      ...this.context(),
-      requestOrigin: request.origin,
-    });
-    return this.authenticate(login);
-  }
-
-  forceRefreshToken(login = true) {
-    logger.debug("Databricks token force refresh requested", { ...this.context(), login });
-    return this.requestToken
-      ? Promise.resolve(publicToken(this.requestToken))
-      : this.requiredClient().forceRefresh(login);
-  }
-
-  refreshRejectedToken(staleAccessToken: string, login = true) {
-    logger.debug("Databricks rejected token refresh requested", {
-      ...this.context(),
-      login,
-      requestToken: Boolean(this.requestToken),
-    });
-    return this.requestToken
-      ? Promise.resolve(publicToken(this.requestToken))
-      : this.requiredClient().refreshRejectedToken(staleAccessToken, login);
-  }
-
-  logout(): Promise<void> {
-    logger.debug("Databricks logout requested", this.context());
-    return this.client?.logout() ?? Promise.resolve();
-  }
-
-  status(): DatabricksAuthStatus {
-    return {
-      profile: this.profileValue.name,
-      host: this.profileValue.host,
-      storage: this.storageValue,
-    };
-  }
-
-  principal(): string {
-    return this.profileValue.principal;
-  }
-
-  workspaceId(): string | undefined {
-    return this.profileValue.workspaceId;
-  }
-
-  authKind(): AuthKind {
-    return this.profileValue.authKind;
-  }
-
-  profile(name?: string) {
-    const profile =
-      !name || name === this.profileValue.name
-        ? this.profileValue
-        : resolveDatabricksProfile({ ...this.options, profile: name }, this.environment);
-    return profileSummary(profile);
-  }
-
-  listProfiles(refresh = false) {
-    return listDatabricksProfiles(this.options.configFile, refresh, this.environment);
-  }
-
-  private requiredClient(): TokenLifecycle {
-    if (!this.client) throw new AuthError("oauth", "Authentication lifecycle is not available");
-    return this.client;
-  }
-
-  private context(): Record<string, unknown> {
-    return {
-      profile: this.profileValue.name,
-      host: this.profileValue.host,
-      authKind: this.profileValue.authKind,
-      storage: this.storageValue,
-      hasWorkspaceId: Boolean(this.profileValue.workspaceId),
-    };
-  }
-}
-
-/** Create a Databricks authentication client. */
-export function createAuthClient(
-  options: DatabricksAuthOptions = { preferUserToMachine: true },
-  storage = Storage.Auto,
-  dependencies: DatabricksAuthDependencies = {},
-): Promise<AuthClient> {
-  return createPersistentAuth(options, storage, dependencies);
-}
-
-/** Resolve a Databricks profile and open built-in credential storage. */
-async function createPersistentAuth(
-  options: DatabricksAuthOptions,
-  storage: Storage,
-  dependencies: DatabricksAuthDependencies,
-): Promise<PersistentAuth> {
-  const environment = dependencies.environment ?? process.env;
-  const profile = resolveDatabricksProfile(options, environment);
-  const inApp =
-    profile.authKind === AuthKind.AppOnBehalfOf ||
-    profile.authKind === AuthKind.AppServicePrincipal;
-  const backend = storage === Storage.Auto ? Storage.Memory : storage;
-  logger.debug("creating persistent Databricks auth", {
-    profile: profile.name,
-    host: profile.host,
-    authKind: profile.authKind,
-    requestedStorage: storage,
-    resolvedStorage: backend,
-    inApp,
-  });
-  const store =
-    backend === Storage.Memory
-      ? new MemoryCredentialStore()
-      : new FileCredentialStore(options.cacheDir ?? join(homedir(), ".databricks"));
-  return createPersistentAuthWithStorage(options, store, storage, dependencies, profile);
-}
-
-/** Resolve a Databricks profile using caller-owned generic storage. */
-async function createPersistentAuthWithStorage(
-  options: DatabricksAuthOptions,
-  store: CredentialStore,
-  storage = store.name() === "memory" ? Storage.Memory : Storage.File,
-  dependencies: DatabricksAuthDependencies = {},
-  resolvedProfile?: DatabricksProfile,
-): Promise<PersistentAuth> {
-  const profile =
-    resolvedProfile ?? resolveDatabricksProfile(options, dependencies.environment ?? process.env);
-  if (profile.authKind === AuthKind.AppOnBehalfOf) {
-    logger.debug("created request-scoped App OBO authentication", {
-      profile: profile.name,
-      host: profile.host,
-      hasWorkspaceId: Boolean(profile.workspaceId),
-    });
-    return new PersistentAuth(
-      profile,
-      Storage.Memory,
-      options,
-      dependencies.environment ?? process.env,
-      undefined,
-      {
-        accessToken: profile.accessToken!,
-        tokenType: "Bearer",
-        scopes: [...profile.scopes],
-      },
-    );
-  }
-  const provider = await providerFor(profile, options, dependencies);
-  const client = new TokenLifecycle(
-    profile.cacheKey,
-    provider,
-    store,
-    AuthOptions.create(options.auth),
-  );
-  const persistent = new PersistentAuth(
-    profile,
-    storage === Storage.Auto ? storageFromName(store.name()) : storage,
-    options,
-    dependencies.environment ?? process.env,
-    client,
-  );
-  logger.debug("created persistent authentication lifecycle", {
-    profile: profile.name,
-    host: profile.host,
-    authKind: profile.authKind,
-    storage: persistent.status().storage,
-  });
-  return persistent;
-}
-
-async function providerFor(
-  profile: DatabricksProfile,
-  options: DatabricksAuthOptions,
-  dependencies: DatabricksAuthDependencies,
-): Promise<TokenProvider> {
-  const environment = dependencies.environment ?? process.env;
-  const inApp = environmentUtils.isDatabricksAppEnv({ ...environment });
-  switch (profile.authKind) {
-    case AuthKind.UserToMachine: {
-      const install = !inApp || options.installCliInApp === true;
-      logger.debug("selected Databricks CLI provider", {
-        profile: profile.name,
-        inApp,
-        install,
-      });
-      return new DatabricksCliProvider(
-        profile.name,
-        () =>
-          dependencies.resolveCli
-            ? dependencies.resolveCli({ install })
-            : resolveDatabricksCli(environment, { install }),
-        cliEnvironment(profile, resolveConfigFile(options.configFile, environment)),
-      );
-    }
-    case AuthKind.PersonalAccessToken:
-      logger.debug("selected personal access token provider", { profile: profile.name });
-      return new DatabricksPersonalAccessTokenProvider(profile.accessToken!);
-    case AuthKind.MachineToMachine:
-    case AuthKind.AppServicePrincipal: {
-      logger.debug("selected service-principal provider", {
-        profile: profile.name,
-        authKind: profile.authKind,
-        target: profile.target,
-      });
-      const endpoints = await resolveOAuthEndpoints(profile, dependencies.fetch);
-      return new DatabricksServicePrincipalProvider({
-        tokenEndpoint: endpoints.tokenEndpoint,
-        clientId: profile.clientId,
-        clientSecret: profile.clientSecret!,
-        scopes: machineScopes(profile.scopes),
-        ...(profile.groupId ? { groupId: profile.groupId } : {}),
-        allowInsecureRequests: isLoopbackHttp(profile.host),
-        fetch: dependencies.fetch,
-      });
-    }
-    case AuthKind.AppOnBehalfOf:
-      throw new AuthError("config", "App OBO tokens do not use a persistent provider");
-  }
-}
-
-interface AuthorizationServer {
-  tokenEndpoint: string;
-}
-
-async function resolveOAuthEndpoints(
-  profile: DatabricksProfile,
-  fetcher: typeof globalThis.fetch = globalThis.fetch,
-): Promise<AuthorizationServer> {
-  const host = profile.host.replace(/\/$/, "");
-  if (profile.target === TargetKind.Account) {
-    if (!profile.accountId) throw new AuthError("config", "Account target requires account_id");
-    const endpoints = {
-      tokenEndpoint: `${host}/oidc/accounts/${profile.accountId}/v1/token`,
-    };
-    logger.debug("resolved account OAuth endpoint", {
-      profile: profile.name,
-      tokenOrigin: new URL(endpoints.tokenEndpoint).origin,
-    });
-    return endpoints;
-  }
-  const discovery =
-    profile.target === TargetKind.Unified
-      ? `${host}/oidc/accounts/${requiredAccountId(profile)}/.well-known/oauth-authorization-server`
-      : `${host}/oidc/.well-known/oauth-authorization-server`;
-  logger.debug("requesting OAuth discovery", {
-    profile: profile.name,
-    target: profile.target,
-    discovery,
-  });
-  const response = await fetcher(discovery, { redirect: "manual" });
-  logger.debug("received OAuth discovery response", {
-    profile: profile.name,
-    status: response.status,
-  });
-  if (response.status === 404)
-    throw new AuthError("oauth", `OAuth is not supported at ${discovery}`);
-  if (!response.ok)
-    throw new AuthError("oauth", `OAuth discovery returned HTTP ${response.status}`);
-  const value = (await response.json()) as Record<string, unknown>;
-  const tokenEndpoint = stringValue(value.token_endpoint);
-  if (!tokenEndpoint) throw new AuthError("oauth", "OAuth discovery response is incomplete");
-  logger.debug("resolved OAuth token endpoint", {
-    profile: profile.name,
-    tokenOrigin: new URL(tokenEndpoint).origin,
-  });
-  return { tokenEndpoint };
-}
-
-function requiredAccountId(profile: DatabricksProfile): string {
-  if (!profile.accountId) throw new AuthError("config", "Unified target requires account_id");
-  return profile.accountId;
-}
-
-function storageFromName(name: string): Storage {
-  return name === "memory" ? Storage.Memory : Storage.File;
-}
-
-function profileSummary(profile: DatabricksProfile) {
-  return {
-    name: profile.name,
-    host: profile.host,
-    ...(profile.accountId ? { accountId: profile.accountId } : {}),
-    ...(profile.workspaceId ? { workspaceId: profile.workspaceId } : {}),
-    target: profile.target,
-    authKind: profile.authKind,
-  };
-}
-
-function isLoopbackHttp(host: string): boolean {
-  const url = new URL(host);
-  return url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname);
-}
-
-function cliEnvironment(profile: DatabricksProfile, configFile: string): Record<string, string> {
-  return {
-    DATABRICKS_CONFIG_FILE: configFile,
-    DATABRICKS_CONFIG_PROFILE: profile.name,
-    DATABRICKS_HOST: profile.host,
-    ...(profile.accountId ? { DATABRICKS_ACCOUNT_ID: profile.accountId } : {}),
-    ...(profile.workspaceId ? { DATABRICKS_WORKSPACE_ID: profile.workspaceId } : {}),
-    ...(profile.authKind === AuthKind.PersonalAccessToken
-      ? {
-          DATABRICKS_AUTH_TYPE: "pat",
-          DATABRICKS_TOKEN: profile.accessToken!,
-        }
-      : {}),
-  };
-}
-
-function stringValue(value: unknown): string | undefined {
-  return typeof value === "string" && value.trim() ? value : undefined;
-}

package/src/errors.ts

@@ -1,16 +0,0 @@
-/** Authentication failure with a stable category for callers and language shims. */
-export class AuthError extends Error {
-  constructor(
-    readonly kind: "config" | "oauth" | "storage" | "lock-timeout" | "cli" | "http",
-    message: string,
-    options?: ErrorOptions,
-  ) {
-    super(message, options);
-    this.name = "AuthError";
-  }
-}
-
-/** Normalize arbitrary failures without erasing their original cause. */
-export function authError(kind: AuthError["kind"], message: string, cause?: unknown): AuthError {
-  return cause instanceof AuthError ? cause : new AuthError(kind, message, { cause });
-}

package/src/generated/databricks-cli-assets.json

@@ -1,33 +0,0 @@
-{
-  "schemaVersion": 1,
-  "dbxToolsVersion": "0.9.21",
-  "minimumVersion": "0.296.0",
-  "version": "1.19.0",
-  "publishedAt": "2026-09-30T13:13:22Z",
-  "assets": {
-    "darwin-arm64": {
-      "url": "https://github.com/databricks/cli/releases/download/v1.19.0/databricks_cli_1.19.0_darwin_arm64.tar.gz",
-      "sha256": "b84c6a8c623578308a724cdd7181b92b0816c2531564f16f8de7559b2a39f51f"
-    },
-    "darwin-x64": {
-      "url": "https://github.com/databricks/cli/releases/download/v1.19.0/databricks_cli_1.19.0_darwin_amd64.tar.gz",
-      "sha256": "d29a5dc1ea7d44d0d892fd4beac05d22daa932982ca6bf98a06d52c95f5ed4cd"
-    },
-    "linux-arm64": {
-      "url": "https://github.com/databricks/cli/releases/download/v1.19.0/databricks_cli_1.19.0_linux_arm64.tar.gz",
-      "sha256": "2997ccbda57090ee48bd9282d5cb3a5bef78025db64fd1573fbd7c8726856086"
-    },
-    "linux-x64": {
-      "url": "https://github.com/databricks/cli/releases/download/v1.19.0/databricks_cli_1.19.0_linux_amd64.tar.gz",
-      "sha256": "bddf87df3d72b61384da724b40f18ab483a98af742748260097a7bb8154b070e"
-    },
-    "win32-arm64": {
-      "url": "https://github.com/databricks/cli/releases/download/v1.19.0/databricks_cli_1.19.0_windows_arm64.tar.gz",
-      "sha256": "c28d098490ea1966230c07585312f8bc66e18d468e34b06319d44e29d61c4602"
-    },
-    "win32-x64": {
-      "url": "https://github.com/databricks/cli/releases/download/v1.19.0/databricks_cli_1.19.0_windows_amd64.tar.gz",
-      "sha256": "0ded24a2b001e001c815b9c1c66dc2ef1f6c2e60c64f63c6d9afb8e9fe85afdb"
-    }
-  }
-}

package/src/http-client.ts

@@ -1,147 +0,0 @@
-import { authLogger } from "./_logging.ts";
-import { AuthError } from "./errors.ts";
-import { createAuthClient, type DatabricksAuthDependencies } from "./databricks-auth.ts";
-import type { AuthClient, DatabricksAuthOptions } from "./types.ts";
-import { DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./types.ts";
-
-const logger = authLogger("http");
-
-/** Options for one Databricks JSON API request. */
-export interface DatabricksRequestOptions {
-  method?: string;
-  body?: unknown;
-  headers?: Headers | Record<string, string> | [string, string][];
-  login?: boolean;
-  signal?: AbortSignal;
-}
-
-/** Dependency-light Databricks JSON client with one rejected-token refresh. */
-export class DatabricksClient {
-  private constructor(
-    readonly auth: AuthClient,
-    private readonly fetcher: typeof globalThis.fetch,
-  ) {}
-
-  static async create(
-    options: DatabricksAuthOptions = { preferUserToMachine: true },
-    dependencies: DatabricksAuthDependencies = {},
-  ): Promise<DatabricksClient> {
-    const client = new DatabricksClient(
-      await createAuthClient(options, undefined, dependencies),
-      dependencies.fetch ?? globalThis.fetch,
-    );
-    logger.debug("created Databricks HTTP client", {
-      profile: client.profile(),
-      host: client.host(),
-      hasWorkspaceId: Boolean(client.workspaceId()),
-    });
-    return client;
-  }
-
-  profile(): string {
-    return this.auth.status().profile;
-  }
-
-  host(): string {
-    return this.auth.status().host;
-  }
-
-  principal(): string {
-    return this.auth.principal();
-  }
-
-  workspaceId(): string | undefined {
-    return this.auth.workspaceId();
-  }
-
-  async request(path: string, options: DatabricksRequestOptions = {}): Promise<unknown> {
-    const url = new URL(path, `${this.host().replace(/\/$/, "")}/`).toString();
-    const method = options.method ?? (options.body === undefined ? "GET" : "POST");
-    const requestUrl = new URL(url);
-    logger.debug("sending Databricks API request", {
-      method,
-      origin: requestUrl.origin,
-      path: requestUrl.pathname,
-      hasBody: options.body !== undefined,
-      login: options.login ?? "auto",
-    });
-    let authHeaders = await this.auth.authenticate(options.login);
-    let response = await this.send(url, method, authHeaders, options);
-    logger.debug("received Databricks API response", {
-      method,
-      path: requestUrl.pathname,
-      status: response.status,
-      attempt: 1,
-    });
-    if (response.status === 401) {
-      logger.debug("refreshing rejected Databricks API credential", {
-        method,
-        path: requestUrl.pathname,
-      });
-      await this.auth.refreshRejectedToken(
-        accessTokenFromHeaders(authHeaders),
-        options.login ?? true,
-      );
-      authHeaders = await this.auth.authenticate(false);
-      response = await this.send(url, method, authHeaders, options);
-      logger.debug("received Databricks API response", {
-        method,
-        path: requestUrl.pathname,
-        status: response.status,
-        attempt: 2,
-      });
-    }
-    const text = await response.text();
-    if (!response.ok)
-      throw new AuthError(
-        "http",
-        `Databricks API ${path} returned HTTP ${response.status}: ${text}`,
-      );
-    if (!text) {
-      logger.debug("Databricks API response had no body", {
-        method,
-        path: requestUrl.pathname,
-      });
-      return undefined;
-    }
-    try {
-      const value = JSON.parse(text);
-      logger.debug("parsed Databricks API JSON response", {
-        method,
-        path: requestUrl.pathname,
-      });
-      return value;
-    } catch (cause) {
-      throw new AuthError("http", `Databricks API ${path} did not return JSON`, { cause });
-    }
-  }
-
-  private send(
-    url: string,
-    method: string,
-    authHeaders: Record<string, string>,
-    options: DatabricksRequestOptions,
-  ): Promise<Response> {
-    const headers = new Headers(options.headers);
-    headers.delete(DEFAULT_ACCESS_TOKEN_HEADER);
-    headers.delete(WORKSPACE_ID_HEADER);
-    for (const [name, value] of Object.entries(authHeaders)) headers.set(name, value);
-    headers.set("accept", "application/json");
-    if (options.body !== undefined) headers.set("content-type", "application/json");
-    return this.fetcher(url, {
-      method,
-      headers,
-      ...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
-      signal: options.signal,
-    });
-  }
-}
-
-function accessTokenFromHeaders(headers: Record<string, string>): string {
-  const authorization = headers[DEFAULT_ACCESS_TOKEN_HEADER];
-  const separator = authorization?.indexOf(" ") ?? -1;
-  if (separator < 1 || !authorization?.slice(separator + 1).trim()) {
-    throw new AuthError("http", "Authentication headers did not contain an access token");
-  }
-  return authorization.slice(separator + 1).trim();
-}