Skip to content

auth: decouple CLI from SDK's Experimental_IsUnifiedHost field#5047

Open
simonfaltum wants to merge 11 commits intomainfrom
simonfaltum/deprecate-experimental-unified-host
Open

auth: decouple CLI from SDK's Experimental_IsUnifiedHost field#5047
simonfaltum wants to merge 11 commits intomainfrom
simonfaltum/deprecate-experimental-unified-host

Conversation

@simonfaltum
Copy link
Copy Markdown
Member

@simonfaltum simonfaltum commented Apr 21, 2026

Why

Prep for SDK bump databricks/databricks-sdk-go#1641, which removes Experimental_IsUnifiedHost, its env var, and the UnifiedHost case in HostType(). After the bump the CLI wouldn't compile.

Rather than stubbing the field and leaving the plumbing behind, this PR fully drops the flag from the CLI surface now that .well-known/databricks-config discovery is the canonical way to detect unified hosts.

Changes

Before: CLI wrote Experimental_IsUnifiedHost into every config, exposed --experimental-is-unified-host, read experimental_is_unified_host from .databrickscfg profiles, and honored the DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST env var.

Now: unified-host routing comes entirely from .well-known/databricks-config. Flag, env var, and profile key read are all gone. The only surviving mention is a deprecated no-op field on Workspace so existing databricks.yml files validate.

Removed:

  • --experimental-is-unified-host flag (cmd/auth/auth.go)
  • AuthArguments.IsUnifiedHost and the unifiedHostFallback parameter threaded through HasUnifiedHostSignal / IsSPOG / ResolveConfigType
  • legacyUnifiedHostFromProfile() (libs/auth/credentials.go) and its caller in error.go
  • profile.Profile.IsUnifiedHost and the INI key read in FileProfilerImpl.LoadProfiles
  • profileMetadata.isUnifiedHost (cmd/auth/profiles.go), applyUnifiedHostFlags (cmd/auth/token.go)
  • acceptance/auth/credentials/unified-host/ (tested the now-removed env var; discovery-based unified-host coverage remains in TestToOAuthArgument_SPOGHostRoutesToUnified, TestRunHostDiscovery_SPOGHost, TestProfileLoadSPOGConfigType, TestLogoutSPOGProfile, all using mock .well-known servers)

Kept:

  • Workspace.ExperimentalIsUnifiedHost in bundle/config/workspace.go as a deprecated no-op field so existing databricks.yml still validates. Annotation updated.
  • Clearing experimental_is_unified_host from profiles on OAuth login and configure save, so legacy keys get cleaned up on re-login.

Shared helpers extracted while touching the code:

  • databrickscfg.ExperimentalIsUnifiedHostKey constant for the cleanup-only INI key (was 4 string literals)
  • auth.IsClassicAccountHost helper replacing 3 copies of the accounts. / accounts-dod. prefix check

Back-compat:

Scenario Behavior
Profile with experimental_is_unified_host = true, reachable .well-known/databricks-config Still works via discovery. INI key silently ignored, cleared on next login.
Profile with experimental_is_unified_host = true, unreachable .well-known No longer routes as unified. User needs to re-login.
--experimental-is-unified-host flag Removed; passing it is an unknown-flag error.
DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST env var Not read (was already being removed by the SDK).
New auth login against a unified host Unchanged; routing from discovery.
databricks.yml with experimental_is_unified_host: true Silently ignored, field kept for schema compat.

Test plan

  • make checks clean
  • make lint 0 issues
  • go test ./libs/auth/... ./cmd/auth/... ./bundle/config/... ./libs/databrickscfg/... ./cmd/configure/...
  • go test ./acceptance -run 'TestAccept/(cmd/auth|auth|cmd/configure)'
  • make schema and make docs regenerated; bundle tests green

Prepare for SDK PR databricks/databricks-sdk-go#1641 which removes the
field, its env var, and the UnifiedHost case in HostType(). Thread the
unified-host signal through CLI-owned types via a new HasUnifiedHostSignal
helper and an explicit fallback parameter on IsSPOG.

New profiles no longer persist experimental_is_unified_host; existing
profiles still read the key for back-compat. The --experimental-is-unified-host
flag and DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST env var are deprecated
no-ops for this release.

Co-authored-by: Isaac
@simonfaltum simonfaltum marked this pull request as ready for review April 21, 2026 10:38
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 21, 2026

Approval status: pending

/acceptance/auth/ - needs approval

5 files changed
Suggested: @tanmay-db
Also eligible: @mihaimitrea-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

/bundle/ - needs approval

5 files changed
Suggested: @pietern
Also eligible: @denik, @andrewnester, @shreyas-goenka, @lennartkats-db, @anton-107, @janniklasrose

/cmd/auth/ - needs approval

7 files changed
Suggested: @tanmay-db
Also eligible: @mihaimitrea-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

/cmd/configure/ - needs approval

Files: cmd/configure/configure.go
Suggested: @tanmay-db
Also eligible: @mihaimitrea-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

/libs/auth/ - needs approval

8 files changed
Suggested: @tanmay-db
Also eligible: @mihaimitrea-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

/libs/databrickscfg/ - needs approval

5 files changed
Suggested: @tanmay-db
Also eligible: @mihaimitrea-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

General files (require maintainer)

Files: NEXT_CHANGELOG.md
Based on git history:

  • @pietern -- recent work in cmd/auth/, bundle/schema/, ./

Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @renaudhartert-db) can approve all areas.
See OWNERS for ownership rules.

simonfaltum and others added 10 commits April 21, 2026 12:44
Addresses codex review findings on PR #5047. After dropping cfg.Experimental_IsUnifiedHost
reads, CLICredentials.Configure and writeReauthSteps stopped honoring the INI
fallback for profiles where .well-known is unreachable. This reads
experimental_is_unified_host from the resolved profile's .databrickscfg section
and threads it through AuthArguments.IsUnifiedHost so token cache keys and
reauth suggestions continue to match.

Also rewords the changelog and flag description from "no-op" to "deprecated
but still honored as a routing fallback", which is what the code actually does.

Co-authored-by: Isaac
…-experimental-unified-host

# Conflicts:
#	acceptance/auth/credentials/unified-host/out.requests.txt
…-experimental-unified-host

# Conflicts:
#	NEXT_CHANGELOG.md
#	libs/auth/credentials.go
Unified hosts are now detected exclusively from /.well-known/databricks-config
discovery. Drop the CLI flag, profile INI key reads, and the unifiedHostFallback
threading from HasUnifiedHostSignal/IsSPOG/ResolveConfigType. Keep the
Workspace.ExperimentalIsUnifiedHost field in bundle config as a no-op so
existing databricks.yml files still validate.

Co-authored-by: Isaac
Extract ExperimentalIsUnifiedHostKey constant in libs/databrickscfg so the
legacy INI key isn't repeated as a string literal across login, token, and
configure save paths. Add IsClassicAccountHost helper in libs/auth so the
"https://accounts." / "https://accounts-dod." prefix check is defined once
and reused from ToOAuthArgument, needsAccountIDPrompt, and the test.

Co-authored-by: Isaac
…-experimental-unified-host

# Conflicts:
#	NEXT_CHANGELOG.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant