@dbx-tools/auth 0.9.32 → 0.9.36

package/src/http-client.ts

@@ -1,147 +0,0 @@
-import { authLogger } from "./_logging.ts";
-import { AuthError } from "./errors.ts";
-import { createAuthClient, type DatabricksAuthDependencies } from "./databricks-auth.ts";
-import type { AuthClient, DatabricksAuthOptions } from "./types.ts";
-import { DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./types.ts";
-
-const logger = authLogger("http");
-
-/** Options for one Databricks JSON API request. */
-export interface DatabricksRequestOptions {
-  method?: string;
-  body?: unknown;
-  headers?: Headers | Record<string, string> | [string, string][];
-  login?: boolean;
-  signal?: AbortSignal;
-}
-
-/** Dependency-light Databricks JSON client with one rejected-token refresh. */
-export class DatabricksClient {
-  private constructor(
-    readonly auth: AuthClient,
-    private readonly fetcher: typeof globalThis.fetch,
-  ) {}
-
-  static async create(
-    options: DatabricksAuthOptions = { preferUserToMachine: true },
-    dependencies: DatabricksAuthDependencies = {},
-  ): Promise<DatabricksClient> {
-    const client = new DatabricksClient(
-      await createAuthClient(options, undefined, dependencies),
-      dependencies.fetch ?? globalThis.fetch,
-    );
-    logger.debug("created Databricks HTTP client", {
-      profile: client.profile(),
-      host: client.host(),
-      hasWorkspaceId: Boolean(client.workspaceId()),
-    });
-    return client;
-  }
-
-  profile(): string {
-    return this.auth.status().profile;
-  }
-
-  host(): string {
-    return this.auth.status().host;
-  }
-
-  principal(): string {
-    return this.auth.principal();
-  }
-
-  workspaceId(): string | undefined {
-    return this.auth.workspaceId();
-  }
-
-  async request(path: string, options: DatabricksRequestOptions = {}): Promise<unknown> {
-    const url = new URL(path, `${this.host().replace(/\/$/, "")}/`).toString();
-    const method = options.method ?? (options.body === undefined ? "GET" : "POST");
-    const requestUrl = new URL(url);
-    logger.debug("sending Databricks API request", {
-      method,
-      origin: requestUrl.origin,
-      path: requestUrl.pathname,
-      hasBody: options.body !== undefined,
-      login: options.login ?? "auto",
-    });
-    let authHeaders = await this.auth.authenticate(options.login);
-    let response = await this.send(url, method, authHeaders, options);
-    logger.debug("received Databricks API response", {
-      method,
-      path: requestUrl.pathname,
-      status: response.status,
-      attempt: 1,
-    });
-    if (response.status === 401) {
-      logger.debug("refreshing rejected Databricks API credential", {
-        method,
-        path: requestUrl.pathname,
-      });
-      await this.auth.refreshRejectedToken(
-        accessTokenFromHeaders(authHeaders),
-        options.login ?? true,
-      );
-      authHeaders = await this.auth.authenticate(false);
-      response = await this.send(url, method, authHeaders, options);
-      logger.debug("received Databricks API response", {
-        method,
-        path: requestUrl.pathname,
-        status: response.status,
-        attempt: 2,
-      });
-    }
-    const text = await response.text();
-    if (!response.ok)
-      throw new AuthError(
-        "http",
-        `Databricks API ${path} returned HTTP ${response.status}: ${text}`,
-      );
-    if (!text) {
-      logger.debug("Databricks API response had no body", {
-        method,
-        path: requestUrl.pathname,
-      });
-      return undefined;
-    }
-    try {
-      const value = JSON.parse(text);
-      logger.debug("parsed Databricks API JSON response", {
-        method,
-        path: requestUrl.pathname,
-      });
-      return value;
-    } catch (cause) {
-      throw new AuthError("http", `Databricks API ${path} did not return JSON`, { cause });
-    }
-  }
-
-  private send(
-    url: string,
-    method: string,
-    authHeaders: Record<string, string>,
-    options: DatabricksRequestOptions,
-  ): Promise<Response> {
-    const headers = new Headers(options.headers);
-    headers.delete(DEFAULT_ACCESS_TOKEN_HEADER);
-    headers.delete(WORKSPACE_ID_HEADER);
-    for (const [name, value] of Object.entries(authHeaders)) headers.set(name, value);
-    headers.set("accept", "application/json");
-    if (options.body !== undefined) headers.set("content-type", "application/json");
-    return this.fetcher(url, {
-      method,
-      headers,
-      ...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
-      signal: options.signal,
-    });
-  }
-}
-
-function accessTokenFromHeaders(headers: Record<string, string>): string {
-  const authorization = headers[DEFAULT_ACCESS_TOKEN_HEADER];
-  const separator = authorization?.indexOf(" ") ?? -1;
-  if (separator < 1 || !authorization?.slice(separator + 1).trim()) {
-    throw new AuthError("http", "Authentication headers did not contain an access token");
-  }
-  return authorization.slice(separator + 1).trim();
-}

package/src/types.ts

@@ -1,196 +0,0 @@
-/** Authentication strategy selected from Databricks configuration. */
-export enum AuthKind {
-  UserToMachine = "user-to-machine",
-  MachineToMachine = "machine-to-machine",
-  PersonalAccessToken = "personal-access-token",
-  AppServicePrincipal = "app-service-principal",
-  AppOnBehalfOf = "app-on-behalf-of",
-}
-
-/** Scope of the Databricks authentication target. */
-export enum TargetKind {
-  Workspace = "workspace",
-  Account = "account",
-  Unified = "unified",
-}
-
-/** Built-in credential storage backend. */
-export enum Storage {
-  Auto = "auto",
-  Memory = "memory",
-  File = "file",
-}
-
-/** File organization used by a persistent credential store. */
-export enum FileLayout {
-  Single = "single",
-  PerCredential = "per-credential",
-}
-
-/** Stored OAuth credential, including renewal metadata. */
-export interface Token {
-  accessToken: string;
-  tokenType: string;
-  refreshToken?: string;
-  expiry?: string;
-  scopes: string[];
-}
-
-/** Public credential result; deliberately excludes the refresh token. */
-export interface AccessToken {
-  accessToken: string;
-  tokenType: string;
-  expiry?: string;
-  scopes: string[];
-}
-
-/** Shared lifecycle configuration embedded by every provider. All times in milliseconds. */
-export interface AuthOptions {
-  refreshBufferMs: number;
-  /**
-   * Opt-in cap, in milliseconds, on waiting to acquire the per-credential
-   * refresh lock. `0` (the default) means wait indefinitely: a holder may
-   * legitimately run for minutes (an interactive login that opens a browser),
-   * and the caller owns the overall request budget. Set a positive value to
-   * fail fast instead.
-   */
-  lockTimeoutMs: number;
-  loginTimeoutMs: number;
-}
-
-const AUTH_DEFAULTS: AuthOptions = {
-  refreshBufferMs: 300_000,
-  lockTimeoutMs: 0,
-  loginTimeoutMs: 900_000,
-};
-
-/** Record-style factory retained for straightforward Node/Python bridging. */
-export const AuthOptions = {
-  create(options: Partial<AuthOptions> = {}): AuthOptions {
-    return { ...AUTH_DEFAULTS, ...options };
-  },
-  defaults(): Readonly<AuthOptions> {
-    return Object.freeze({ ...AUTH_DEFAULTS });
-  },
-};
-
-/** Secret-free metadata discovered from one Databricks CLI profile. */
-export interface DatabricksProfileSummary {
-  name: string;
-  host?: string;
-  accountId?: string;
-  workspaceId?: string;
-  target: TargetKind;
-  authKind: AuthKind;
-}
-
-/** Resolved Databricks identity and active storage backend. */
-export interface DatabricksAuthStatus {
-  profile: string;
-  host: string;
-  storage: Storage;
-}
-
-/** Public Databricks authentication options. */
-export interface DatabricksAuthOptions {
-  profile?: string;
-  host?: string;
-  accountId?: string;
-  workspaceId?: string;
-  configFile?: string;
-  clientId?: string;
-  clientSecret?: string;
-  accessToken?: string;
-  groupId?: string;
-  authType?: string;
-  scopes?: string[];
-  target?: string;
-  cacheDir?: string;
-  auth?: AuthOptions;
-  requestHeaders?: Record<string, string>;
-  accessTokenHeader?: string;
-  installCliInApp?: boolean;
-  preferUserToMachine: boolean;
-}
-
-/** Record-style factory retained for callers migrating from generated bindings. */
-export const DatabricksAuthOptions = {
-  create(options: Partial<DatabricksAuthOptions> = {}): DatabricksAuthOptions {
-    return { preferUserToMachine: true, ...options };
-  },
-  defaults(): Readonly<DatabricksAuthOptions> {
-    return Object.freeze({ preferUserToMachine: true });
-  },
-};
-
-/** Resolved profile with secrets retained only for provider construction. */
-export interface DatabricksProfile extends DatabricksProfileSummary {
-  host: string;
-  authType?: string;
-  clientId: string;
-  groupId?: string;
-  scopes: string[];
-  clientSecret?: string;
-  accessToken?: string;
-  cacheKey: string;
-  principal: string;
-}
-
-/** Cross-language lease adapter; implementations may use files, databases, or FFI. */
-export interface LockAdapter {
-  /** Acquire the key's lease. Omit `timeoutMs` (or pass `0`) to wait indefinitely. */
-  acquire(key: string, timeoutMs?: number): Promise<string>;
-  release(lease: string): Promise<void>;
-}
-
-/** Cross-language credential persistence contract. */
-export interface CredentialStore {
-  load(key: string): Promise<Token | undefined>;
-  prepareWrite(): Promise<void>;
-  save(key: string, token: Token): Promise<void>;
-  remove(key: string): Promise<void>;
-  acquireLock(key: string, timeoutMs?: number): Promise<string>;
-  releaseLock(lease: string): Promise<void>;
-  name(): string;
-}
-
-/** Provider-specific token acquisition. */
-export interface TokenProvider {
-  authenticate(timeoutMs: number): Promise<Token>;
-  login(timeoutMs: number): Promise<Token>;
-  refresh(token: Token): Promise<Token>;
-  canAuthenticateSilently(): boolean;
-}
-
-/** Stable facade shared by Node, the CLI, and generated language bindings. */
-export interface AuthClient {
-  challenge(): Promise<void>;
-  token(login?: boolean): Promise<AccessToken>;
-  authenticate(login?: boolean): Promise<Record<string, string>>;
-  authorizationHeaderForUrl(requestUrl: string, login?: boolean): Promise<string | undefined>;
-  requestHeadersForUrl(requestUrl: string, login?: boolean): Promise<Record<string, string>>;
-  forceRefreshToken(login?: boolean): Promise<AccessToken>;
-  refreshRejectedToken(staleAccessToken: string, login?: boolean): Promise<AccessToken>;
-  logout(): Promise<void>;
-  status(): DatabricksAuthStatus;
-  principal(): string;
-  workspaceId(): string | undefined;
-  authKind(): AuthKind;
-  profile(name?: string): DatabricksProfileSummary;
-  listProfiles(refresh?: boolean): DatabricksProfileSummary[];
-}
-
-/** Public OAuth client used by Databricks CLI-compatible user authentication. */
-export const DEFAULT_CLIENT_ID = "databricks-cli";
-/** Default Databricks profile configuration path. */
-export const DEFAULT_CONFIG_FILE = "~/.databrickscfg";
-/** Default Databricks account console origin. */
-export const DEFAULT_ACCOUNTS_HOST = "https://accounts.cloud.databricks.com";
-/** Canonical request header carrying a bearer access token. */
-export const DEFAULT_ACCESS_TOKEN_HEADER = "authorization";
-/** Canonical request header carrying the resolved Databricks workspace ID. */
-export const WORKSPACE_ID_HEADER = "x-databricks-workspace-id";
-/** Authentication type for Databricks App on-behalf-of request credentials. */
-export const AUTH_TYPE_APP_OBO = "app_obo";
-/** Authentication type for Databricks App service-principal credentials. */
-export const AUTH_TYPE_APP_SP = "app_sp";