databricks-sql-kernel 0.1.2__tar.gz → 0.2.0__tar.gz

databricks_sql_kernel-0.2.0/.github/scripts/check-napi-loader-drift.sh

@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# Drift guard for the committed napi loader.
+#
+# napi/index.js + napi/index.d.ts are GENERATED by `@napi-rs/cli@2.18.4`
+# from the `#[napi]` surface in napi/src/. We commit them because the
+# release workflow uses `@napi-rs/cli@3`, which doesn't emit the loader.
+# This is the only mechanism keeping them in sync — there is no
+# `cargo build` step that would catch staleness.
+#
+# This script catches the most common drift class: a contributor adds a
+# new top-level `#[napi]` function or class in napi/src/ and forgets to
+# regenerate the loader. It parses the Rust source for top-level
+# `#[napi]` items, parses the loader's destructure / module.exports,
+# and fails CI if the symbol sets diverge.
+#
+# Scope:
+# - Detects: missing exports for new `#[napi]` top-level fn / class /
+#   enum (with js_name override honored).
+# - Does NOT detect: formatting drift in index.d.ts, type-only changes
+#   in `#[napi(object)]` shapes, or signature changes to existing
+#   functions. A full regenerate-and-diff (the reviewer's preferred
+#   shape) would catch those, but it requires an npm proxy that this
+#   repo doesn't yet have on the protected runners.
+#
+# Run from repo root.
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+# ──────────────────────────────────────────────────────────────────
+# Collect the expected surface from napi/src/**.rs.
+#
+# Rules (matching @napi-rs/cli@2.18.4 behavior):
+# - `#[napi]` on a top-level `pub fn` / `pub async fn` / `pub struct`
+#   / `pub enum` exports under the item name (snake_case → camelCase
+#   conversion happens for fns; classes / enums keep their name).
+# - `#[napi(js_name = "...")]` overrides the JS name.
+# - `#[napi(object)]` / `#[napi(string_enum)]` items are emitted as
+#   TypeScript interfaces / const enums; for index.js they only
+#   matter if they're classes — strict objects/string_enums don't
+#   appear in the runtime destructure. We collect them separately
+#   for the .d.ts check.
+# - Methods inside `impl` blocks (`#[napi]` inside a `#[napi] impl`)
+#   are NOT separate exports; the parent class covers them.
+# - Items inside `#[napi]\nimpl Foo` blocks have a column-indented
+#   `#[napi]` attribute (column 4+). Top-level items live at column 0.
+# ──────────────────────────────────────────────────────────────────
+
+# Parse top-level Rust items: read each .rs file, find `#[napi...]`
+# attributes that start at column 0 (top-level), and look at the next
+# `pub ...` declaration on the next non-blank line. Emits TSV:
+# kind<TAB>js_name
+collect_rust_surface() {
+  python3 - <<'PY'
+import re
+import sys
+from pathlib import Path
+
+js_name_re = re.compile(r'js_name\s*=\s*"([^"]+)"')
+ATTR_RE = re.compile(r'^#\[napi(?:\(([^)]*)\))?\]$')
+ITEM_RE = re.compile(
+    r'^pub\s+(?:async\s+)?(?:fn\s+(\w+)|struct\s+(\w+)|enum\s+(\w+))'
+)
+
+def snake_to_camel(s: str) -> str:
+    parts = s.split("_")
+    return parts[0] + "".join(p.title() for p in parts[1:])
+
+for path in sorted(Path("napi/src").rglob("*.rs")):
+    lines = path.read_text().splitlines()
+    i = 0
+    while i < len(lines):
+        line = lines[i]
+        # Only top-level attributes (column 0).
+        m = ATTR_RE.match(line)
+        if not m:
+            i += 1
+            continue
+        attr_args = m.group(1) or ""
+        # Find the next pub item — skip blank lines, comments, and
+        # other attribute lines (e.g. `#[derive(...)]`, `#[serde(...)]`
+        # that often sit between the `#[napi]` attribute and the item).
+        j = i + 1
+        while j < len(lines):
+            stripped = lines[j].lstrip()
+            if (
+                not lines[j].strip()
+                or stripped.startswith("//")
+                or stripped.startswith("/*")
+                or stripped.startswith("*")
+                or stripped.startswith("#[")
+            ):
+                j += 1
+                continue
+            break
+        if j >= len(lines):
+            i += 1
+            continue
+        # The pub item must also be column 0 (top-level).
+        next_line = lines[j]
+        if next_line.startswith(" ") or next_line.startswith("\t"):
+            i += 1
+            continue
+        im = ITEM_RE.match(next_line)
+        if not im:
+            # Could be `impl Foo` — skip (methods are exported via
+            # the parent class).
+            i += 1
+            continue
+        fn_name, struct_name, enum_name = im.groups()
+        name = fn_name or struct_name or enum_name
+        # Determine the JS name.
+        js_match = js_name_re.search(attr_args)
+        if js_match:
+            js_name = js_match.group(1)
+        elif fn_name:
+            js_name = snake_to_camel(name)
+        else:
+            js_name = name  # classes/enums keep their PascalCase name
+        if "object" in attr_args:
+            kind = "object"
+        elif "string_enum" in attr_args:
+            kind = "string_enum"
+        elif fn_name:
+            kind = "fn"
+        elif struct_name:
+            kind = "class"
+        else:
+            kind = "enum"
+        print(f"{kind}\t{js_name}")
+        i = j + 1
+PY
+}
+
+# ──────────────────────────────────────────────────────────────────
+# Collect the actual destructured exports from napi/index.js.
+# Pattern: `const { A, B, C } = nativeBinding`
+# ──────────────────────────────────────────────────────────────────
+collect_loader_exports() {
+  python3 - <<'PY'
+import re
+from pathlib import Path
+
+src = Path("napi/index.js").read_text()
+# Find `const { ... } = nativeBinding`
+m = re.search(r"const\s*\{\s*([^}]*)\s*\}\s*=\s*nativeBinding", src)
+if not m:
+    raise SystemExit("ERROR: could not find `const { ... } = nativeBinding` destructure in napi/index.js")
+names = [n.strip() for n in m.group(1).split(",") if n.strip()]
+for n in names:
+    print(n)
+PY
+}
+
+# ──────────────────────────────────────────────────────────────────
+# Compare. Anything in the expected set (fn / class) that isn't in the
+# loader is a drift error. Reverse — names in the loader not in the
+# Rust source — is also a drift error (something was removed).
+# `object` and `string_enum` items aren't in the runtime destructure;
+# they're checked separately against index.d.ts below.
+# ──────────────────────────────────────────────────────────────────
+
+EXPECTED_RUNTIME=$(collect_rust_surface | awk -F'\t' '$1 == "fn" || $1 == "class" || $1 == "enum" || $1 == "string_enum" {print $2}' | sort -u)
+ACTUAL_RUNTIME=$(collect_loader_exports | sort -u)
+
+missing=$(comm -23 <(echo "$EXPECTED_RUNTIME") <(echo "$ACTUAL_RUNTIME"))
+extra=$(comm -13 <(echo "$EXPECTED_RUNTIME") <(echo "$ACTUAL_RUNTIME"))
+
+fail=0
+if [[ -n "$missing" ]]; then
+  echo "::error::napi loader is missing exports for these #[napi] symbols:" >&2
+  echo "$missing" | sed 's/^/  - /' >&2
+  fail=1
+fi
+if [[ -n "$extra" ]]; then
+  echo "::error::napi loader exports symbols that no longer exist in napi/src/:" >&2
+  echo "$extra" | sed 's/^/  - /' >&2
+  fail=1
+fi
+
+if [[ $fail -eq 1 ]]; then
+  cat >&2 <<EOF
+
+To fix, regenerate the loader and recommit:
+
+    cd napi && npx --yes @napi-rs/cli@2.18.4 build --platform \\
+        --js-package-name @databricks/databricks-sql-kernel --release
+    git add napi/index.js napi/index.d.ts && git commit --amend --no-edit
+
+See napi/.gitignore for the full regen procedure note.
+EOF
+  exit 1
+fi
+
+count=$(printf '%s\n' "$EXPECTED_RUNTIME" | grep -c .)
+echo "napi loader is in sync with #[napi] surface (${count} symbols)."

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/.github/workflows/napi-checks.yml

@@ -133,6 +133,28 @@ jobs:
         # secrets — purely cdylib + rlib in-tree tests.
         run: cargo test --locked
 
+      # Drift guard for the committed loader (napi/index.js +
+      # napi/index.d.ts). PR #146 review feedback: nothing in CI
+      # detects when a contributor adds a top-level `#[napi]` symbol
+      # without recommitting the generated loader, and that already
+      # happened once (3 logger exports went missing in #146 before
+      # this check landed).
+      #
+      # This is a SURFACE audit, not a full regenerate-and-diff —
+      # parses napi/src/**.rs for top-level `#[napi]` items and
+      # compares against the destructured names in napi/index.js.
+      # Catches the "new export missing" bug class without needing
+      # an npm proxy on the protected runner (which doesn't yet
+      # exist; see .github/actions/setup-jfrog/action.yml — npm
+      # support is a "future" item). When npm-via-JFrog lands, this
+      # step should be replaced with the full reviewer-preferred
+      # form: `npx --yes @napi-rs/cli@2.18.4 build --platform ...`
+      # then `git diff --exit-code -- napi/index.js napi/index.d.ts`.
+      # Tracked in the PR #146 discussion.
+      - name: Check napi loader is in sync with #[napi] surface
+        working-directory: ${{ github.workspace }}
+        run: bash .github/scripts/check-napi-loader-drift.sh
+
       # Release-profile build verifies the cdylib actually links with
       # the production profile knobs (lto=true, codegen-units=1,
       # strip="debuginfo"). The lto=true link is the slow part (~4 min

databricks_sql_kernel-0.2.0/CHANGELOG.md

@@ -0,0 +1,50 @@
+# Version Changelog — Rust crate (`databricks-sql-kernel`)
+
+This changelog tracks releases of the Rust crate published to crates.io.
+The Python (pyo3) and Node.js (napi) bindings have their own changelogs
+under [`pyo3/CHANGELOG.md`](pyo3/CHANGELOG.md) and
+[`napi/CHANGELOG.md`](napi/CHANGELOG.md); they ship on independent
+cadences and may not move in lockstep with the crate.
+
+## [v0.2.0] - 2026-06-08
+
+**Beta release of the Databricks SQL Kernel.** Bumps the crate out
+of its initial-public-release line into a beta-quality cut intended
+for downstream-driver adoption (Reyden bring-up in
+`databricks-sql-connector` and `@databricks/sql`). Public API
+surface is stable; behaviour changes captured below.
+
+### Added
+- `Statement::execute_direct()` — directResults execution (the
+  Thrift/JDBC model): one `ExecuteStatement` POST with the server
+  inline wait, returning `DirectStatement::Completed` (terminal,
+  result materialised inline) or `DirectStatement::Running` (a
+  poll/cancel handle) **without** an internal poll loop. Added
+  **alongside** an unchanged blocking `execute()`.
+
+### Updated
+- Removed `StatementSpec::query_timeout_secs` and the
+  `resolve_wait_timeout` `CANCEL` branch: it mapped a per-statement
+  timeout onto the SEA `wait_timeout` field, which is the server's
+  inline-hold window (capped 5–50s), not a statement-execution
+  timeout (use the `STATEMENT_TIMEOUT` SQL conf for that). The sync
+  path now always omits `wait_timeout`.
+
+### Fixed
+- `terminal_outcome`: `CLOSED` is now an unconditional terminal
+  **success** (parity with JDBC's `DatabricksSdkClient`); an empty
+  `CLOSED` materialises an empty result set instead of erroring
+  with `invalid_state("Statement was closed")`. Reaches all callers
+  (`execute()`, `fetch_completed_result`, `execute_direct`).
+
+## [v0.1.2] - 2026-06-06
+
+Initial public release of the Rust kernel core.
+
+### Added
+- `databricks-sql-kernel` Rust crate published to crates.io.
+- Async public API: `Session` → `Statement` → `ExecutedStatement` /
+  `ExecutedAsyncStatement` → `ResultStream`, plus a flat `Metadata`
+  surface (see `docs/spec-v0.md`).
+- SEA backend (Statement Execution API) with CloudFetch and inline-Arrow
+  result paths; PAT, OAuth M2M, and OAuth U2M authentication.

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/Cargo.lock

@@ -382,7 +382,7 @@ dependencies = [
 
 [[package]]
 name = "databricks-sql-kernel"
-version = "0.1.2"
+version = "0.2.0"
 dependencies = [
  "arrow-array",
  "arrow-buffer",

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/Cargo.toml

@@ -14,7 +14,7 @@
 
 [package]
 name = "databricks-sql-kernel"
-version = "0.1.2"
+version = "0.2.0"
 edition = "2021"
 authors = ["Databricks"]
 license = "Apache-2.0"

databricks_sql_kernel-0.2.0/NEXT_CHANGELOG.md

@@ -0,0 +1,23 @@
+# NEXT CHANGELOG — Rust crate (`databricks-sql-kernel`)
+
+This file stages unreleased changes for the next Rust crate release.
+The Python (pyo3) and Node.js (napi) bindings stage their own
+unreleased changes under [`pyo3/NEXT_CHANGELOG.md`](pyo3/NEXT_CHANGELOG.md)
+and [`napi/NEXT_CHANGELOG.md`](napi/NEXT_CHANGELOG.md). Only land entries
+here that affect the Rust crate's public API or behaviour; binding-only
+changes go in their respective binding's NEXT_CHANGELOG.
+
+## [Unreleased]
+
+### Added
+
+### Updated
+
+### Fixed
+
+---
+*Note: When making changes, please add your change under the appropriate
+section with a brief description. At release time, move the entries here
+into a new versioned section at the top of `CHANGELOG.md` (heading format
+`## [v<version>] - <YYYY-MM-DD>`) and reset this file back to the empty
+template above.*

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-sql-kernel
-Version: 0.1.2
+Version: 0.2.0
 Requires-Dist: pyarrow>=23.0.1,<24
 Summary: Python bindings for the Databricks SQL Kernel (PyO3)
 Author: Databricks

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/_release-scripts/.github/scripts/extract-changelog.sh

@@ -18,8 +18,11 @@ set -euo pipefail
 CHANGELOG="${1:?Usage: extract-changelog.sh <changelog-file> <version>}"
 VERSION="${2:?Usage: extract-changelog.sh <changelog-file> <version>}"
 
-# Strip leading 'v' for matching — we'll match with or without it.
+# Strip leading 'v' and any prerelease suffix (e.g. -rc.1) for matching:
+# an RC tag (v0.1.2-rc.1) should resolve to the release version's notes
+# (0.1.2). Match with or without the 'v'.
 VERSION_BARE="${VERSION#v}"
+VERSION_BARE="${VERSION_BARE%%-*}"
 
 if [[ ! -f "$CHANGELOG" ]]; then
   echo "::error::Changelog file not found: ${CHANGELOG}"

databricks_sql_kernel-0.2.0/pyo3/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Version Changelog — Python binding (`databricks-sql-kernel`)
+
+This changelog tracks releases of the Python wheel published to PyPI as
+`databricks-sql-kernel` (built from this `pyo3/` directory). The Rust
+crate and Node.js binding have their own changelogs under
+[`../CHANGELOG.md`](../CHANGELOG.md) and [`../napi/CHANGELOG.md`](../napi/CHANGELOG.md);
+they ship on independent cadences.
+
+## [v0.2.0] - 2026-06-08
+
+**Beta release of the Databricks SQL Kernel (Python binding).**
+Ships on PyPI as `databricks-sql-kernel==0.2.0`. The pyo3 surface
+is unchanged from v0.1.2; this release picks up the
+kernel-side v0.2.0 behaviour changes (see the root
+[`../CHANGELOG.md`](../CHANGELOG.md) — `execute_direct`,
+`wait_timeout` removal, `CLOSED`-as-success fix). Intended for
+downstream-driver adoption in `databricks-sql-connector[kernel]`.
+
+## [v0.1.2] - 2026-06-06
+
+Initial public release of the Python binding.
+
+### Added
+- Python bindings published to PyPI as `databricks-sql-kernel`.
+- abi3 wheels for Linux (manylinux_2_28 x86_64/aarch64), macOS
+  (x86_64/arm64), and Windows (x86_64), plus a source distribution.
+- pyo3-based bridge over the Rust kernel's async public API with PyArrow
+  interop for result batches.

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/pyo3/Cargo.lock

@@ -380,7 +380,7 @@ dependencies = [
 
 [[package]]
 name = "databricks-sql-kernel"
-version = "0.1.2"
+version = "0.2.0"
 dependencies = [
  "arrow-array",
  "arrow-buffer",
@@ -412,7 +412,7 @@ dependencies = [
 
 [[package]]
 name = "databricks-sql-kernel-pyo3"
-version = "0.1.2"
+version = "0.2.0"
 dependencies = [
  "arrow-array",
  "arrow-pyarrow",

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/pyo3/Cargo.toml

@@ -31,7 +31,7 @@
 
 [package]
 name = "databricks-sql-kernel-pyo3"
-version = "0.1.2"
+version = "0.2.0"
 edition = "2021"
 authors = ["Databricks"]
 license = "Apache-2.0"

databricks_sql_kernel-0.2.0/pyo3/NEXT_CHANGELOG.md

@@ -0,0 +1,35 @@
+# NEXT CHANGELOG — Python binding (`databricks-sql-kernel`)
+
+This file stages unreleased changes for the next Python wheel release.
+The Rust crate and Node.js binding stage their own unreleased changes
+under [`../NEXT_CHANGELOG.md`](../NEXT_CHANGELOG.md) and
+[`../napi/NEXT_CHANGELOG.md`](../napi/NEXT_CHANGELOG.md).
+
+Only land entries here that affect the Python wheel — pyo3 glue, the
+Python API surface, packaging / wheel-build behaviour. Pure-kernel
+changes go in the root `NEXT_CHANGELOG.md`.
+
+## [Unreleased]
+
+### Added
+
+### Updated
+
+### Fixed
+- `auth_type="oauth-u2m"` now defaults scopes to `["sql", "offline_access"]`
+  when the caller passes neither `client_id` nor `scopes`. The Python binding
+  defaults the U2M client to `databricks-sql-python` (vs. the kernel's
+  `databricks-cli`), but that client isn't registered for the `all-apis` scope
+  the kernel intrinsically defaults to — so an out-of-the-box
+  `Session(auth_type="oauth-u2m")` failed the authorization request with
+  `access_denied — Scopes 'all-apis' are not assigned to the client
+  databricks-sql-python`. Defaults now match `PYSQL_OAUTH_SCOPES` in the
+  standalone Thrift connector, restoring `use_kernel=True` parity. A
+  caller-supplied `client_id` or `scopes` is still honoured verbatim.
+
+---
+*Note: When making changes, please add your change under the appropriate
+section with a brief description. At release time, move the entries here
+into a new versioned section at the top of `CHANGELOG.md` (heading format
+`## [v<version>] - <YYYY-MM-DD>`) and reset this file back to the empty
+template above.*

databricks_sql_kernel-0.2.0/pyo3/release-notes.txt

@@ -0,0 +1,26 @@
+==============================================================================
+Databricks SQL Kernel — Python binding Release Notes
+==============================================================================
+
+These release notes summarize enhancements, new features, known issues,
+and version history for the Python wheel published to PyPI as
+`databricks-sql-kernel` (built from this directory via pyo3 + maturin).
+
+The Rust crate and Node.js (napi) bindings ship on independent cadences;
+their release notes live at `../release-notes.txt` and
+`../napi/release-notes.txt`.
+
+Version History ==============================================================
+
+0.1.2 ========================================================================
+Released 2026-06-06
+
+Initial public release of the Python binding.
+
+Enhancements & New Features
+
+ * Python bindings published to PyPI as `databricks-sql-kernel`.
+ * abi3 wheels for Linux (manylinux_2_28 x86_64/aarch64), macOS
+   (x86_64/arm64), and Windows (x86_64), plus a source distribution.
+ * pyo3-based bridge over the Rust kernel's async public API with PyArrow
+   interop for result batches.

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/pyo3/src/auth.rs

@@ -76,6 +76,30 @@ pub(crate) struct OAuthParams {
 /// OAuth app identity, not the on-disk cache.
 const PYSQL_OAUTH_CLIENT_ID: &str = "databricks-sql-python";
 
+/// Default U2M scopes for the **Python** binding when the caller relies
+/// on the default `PYSQL_OAUTH_CLIENT_ID` above.
+///
+/// The kernel's intrinsic U2M default is `["all-apis", "offline_access"]`,
+/// which is correct for its bare-Rust default client (`databricks-cli`).
+/// But the Python binding overrides the default client to
+/// `databricks-sql-python` — and *that* client is only registered for
+/// `sql` (plus `offline_access`) on the Databricks IdP. Without a
+/// matching scope override here, an out-of-the-box
+/// `Session(auth_type="oauth-u2m")` from Python fails on the
+/// authorization request with
+/// `access_denied — Scopes 'all-apis' are not assigned to the client
+/// databricks-sql-python`.
+///
+/// Matches `PYSQL_OAUTH_SCOPES` in the Thrift connector
+/// (`databricks-sql-python` `auth/auth.py`), so `use_kernel=True` is
+/// drop-in compatible with the standalone Thrift path.
+///
+/// Only applied when the caller passed neither `client_id` nor `scopes`
+/// — a caller supplying their own `client_id` may legitimately want
+/// `all-apis` (or anything else), and an explicit `scopes` is always
+/// honoured verbatim.
+const PYSQL_OAUTH_SCOPES: &[&str] = &["sql", "offline_access"];
+
 /// Build a kernel `AuthConfig` from the Python kwargs the `Session`
 /// constructor accepts.
 ///
@@ -157,23 +181,39 @@ fn build_auth_config_inner(
                         .to_owned(),
                 );
             }
+            // Default the U2M OAuth client to the Python connector's
+            // own registered client (`databricks-sql-python`), NOT the
+            // kernel's bare-Rust fallback (`databricks-cli`). This
+            // matches the standalone Thrift connector
+            // (`PYSQL_OAUTH_CLIENT_ID` in databricks-sql-python's
+            // auth.py) so a user gets the same OAuth app identity — and
+            // the same SSO token cache entry — whether they use the
+            // Thrift backend or `use_kernel=True`. It also keeps the
+            // kernel's per-{host,client_id,scopes} token cache distinct
+            // from the napi (Node) binding's, which defaults to its own
+            // client.
+            //
+            // When BOTH defaults are in play (caller passed no
+            // `client_id` and no `scopes`), also default the scopes to
+            // the Python-binding set so the default client/scopes pair
+            // is internally consistent. The kernel's intrinsic scope
+            // default is for its `databricks-cli` client, not for
+            // `databricks-sql-python` — see `PYSQL_OAUTH_SCOPES` above.
+            let caller_set_client_id = oauth.client_id.is_some();
+            let client_id = oauth
+                .client_id
+                .or_else(|| Some(PYSQL_OAUTH_CLIENT_ID.to_owned()));
+            let scopes = match oauth.scopes {
+                Some(s) => Some(s),
+                None if !caller_set_client_id => {
+                    Some(PYSQL_OAUTH_SCOPES.iter().map(|s| (*s).to_owned()).collect())
+                }
+                None => None,
+            };
             Ok(AuthConfig::OAuthU2M {
-                // Default the U2M OAuth client to the Python connector's
-                // own registered client (`databricks-sql-python`), NOT
-                // the kernel's bare-Rust fallback (`databricks-cli`).
-                // This matches the standalone Thrift connector
-                // (`PYSQL_OAUTH_CLIENT_ID` in databricks-sql-python's
-                // auth.py) so a user gets the same OAuth app identity —
-                // and the same SSO token cache entry — whether they use
-                // the Thrift backend or `use_kernel=True`. It also keeps
-                // the kernel's per-{host,client_id,scopes} token cache
-                // distinct from the napi (Node) binding's, which defaults
-                // to its own client.
-                client_id: oauth
-                    .client_id
-                    .or_else(|| Some(PYSQL_OAUTH_CLIENT_ID.to_owned())),
+                client_id,
                 redirect_port: oauth.redirect_port,
-                scopes: oauth.scopes,
+                scopes,
                 token_url_override: oauth.token_url,
                 callback_timeout: oauth.callback_timeout_secs.map(Duration::from_secs),
             })
@@ -285,11 +325,16 @@ mod tests {
     }
 
     #[test]
-    fn u2m_defaults_client_id_to_python_connector() {
+    fn u2m_defaults_client_id_and_scopes_to_python_connector() {
         // U2M takes no mandatory fields. The Python binding defaults the
         // OAuth client_id to `databricks-sql-python` (NOT the kernel's
         // bare `databricks-cli`) so it matches the standalone Thrift
         // connector and the napi binding gets a distinct cache key.
+        // It also defaults the scopes to `["sql", "offline_access"]` to
+        // match the scopes registered for that client on the Databricks
+        // IdP — the kernel's intrinsic `all-apis` default is for its
+        // own `databricks-cli` client, which `databricks-sql-python`
+        // isn't allowed to request.
         let cfg = build_auth_config_inner("oauth-u2m", None, OAuthParams::default()).unwrap();
         match cfg {
             AuthConfig::OAuthU2M {
@@ -301,7 +346,10 @@ mod tests {
             } => {
                 assert_eq!(client_id.as_deref(), Some("databricks-sql-python"));
                 assert!(redirect_port.is_none());
-                assert!(scopes.is_none());
+                assert_eq!(
+                    scopes,
+                    Some(vec!["sql".to_string(), "offline_access".to_string()])
+                );
                 assert!(token_url_override.is_none());
                 assert!(callback_timeout.is_none());
             }
@@ -321,8 +369,39 @@ mod tests {
         )
         .unwrap();
         match cfg {
-            AuthConfig::OAuthU2M { client_id, .. } => {
+            AuthConfig::OAuthU2M {
+                client_id, scopes, ..
+            } => {
                 assert_eq!(client_id.as_deref(), Some("my-custom-app"));
+                // Custom client_id without scopes: don't override the
+                // kernel's default scopes — a custom client may
+                // legitimately request `all-apis` (or anything else).
+                assert!(scopes.is_none());
+            }
+            other => panic!("expected OAuthU2M, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn u2m_explicit_scopes_are_honoured_verbatim() {
+        // Caller-supplied scopes win over the Python-binding default,
+        // both with the default client_id and with a custom one.
+        let custom = vec!["all-apis".to_string(), "offline_access".to_string()];
+        let cfg = build_auth_config_inner(
+            "oauth-u2m",
+            None,
+            OAuthParams {
+                scopes: Some(custom.clone()),
+                ..Default::default()
+            },
+        )
+        .unwrap();
+        match cfg {
+            AuthConfig::OAuthU2M {
+                client_id, scopes, ..
+            } => {
+                assert_eq!(client_id.as_deref(), Some("databricks-sql-python"));
+                assert_eq!(scopes, Some(custom));
             }
             other => panic!("expected OAuthU2M, got {other:?}"),
         }

{databricks_sql_kernel-0.1.2 → databricks_sql_kernel-0.2.0}/pyo3/src/session.rs

@@ -21,6 +21,7 @@
 //! pyclass alive longer than the user keeps a reference.
 
 use crate::auth::{build_auth_config, OAuthParams};
+use crate::executed_async::ExecutedAsyncStatement;
 use crate::metadata::Metadata;
 use crate::statement::Statement;
 use databricks_sql_kernel::Session as KSession;
@@ -341,6 +342,37 @@ impl Session {
         Ok(Metadata::new(kmeta, inner.runtime.clone()))
     }
 
+    /// Re-attach to an already-submitted server statement by its id,
+    /// returning an `ExecutedAsyncStatement` the caller can poll
+    /// (`status()`), await (`await_result()`), or cancel/close — without
+    /// having been the handle that submitted it.
+    ///
+    /// This is the resume path the connector uses for
+    /// `get_query_state` / `get_async_execution_result`: server
+    /// statement state is keyed solely by the id, so a caller holding
+    /// only the id can recover a working handle bound to this session.
+    ///
+    /// Issues one `GetStatementStatus` to seed the handle. Raises
+    /// `KernelError` with code `NotFound` if the server doesn't
+    /// recognise the id (never submitted, or its result TTL elapsed). A
+    /// *closed* statement is not an error — the server keeps reporting
+    /// `CLOSED` (and terminal `SUCCEEDED`/`FAILED`) until GC, so the
+    /// returned handle's `status()` surfaces the real server state.
+    fn attach_async_statement(
+        &self,
+        py: Python<'_>,
+        statement_id: String,
+    ) -> PyResult<ExecutedAsyncStatement> {
+        let inner = alive!(self, "Session");
+        let runtime = inner.runtime.clone();
+        tracing::debug!(
+            target: crate::logging::PYO3_LOG_TARGET,
+            "Session.attach_async_statement: re-attaching by id (GIL released)"
+        );
+        let exec = run_kernel!(py, runtime, inner.session.attach_async_statement(statement_id))?;
+        Ok(ExecutedAsyncStatement::new(exec, runtime))
+    }
+
     /// Explicitly close the session. Idempotent. Subsequent calls on
     /// this `Session` raise `KernelError`.
     fn close(&mut self, py: Python<'_>) -> PyResult<()> {