From 5cf96b488c5093a10b0f0462ad49f82bb62dfab4 Mon Sep 17 00:00:00 2001 From: simon Date: Wed, 20 May 2026 15:36:16 +0200 Subject: [PATCH 1/2] auth: add DATABRICKS_DISCOVERY_HOST env var to override login.databricks.com The discovery login flow (databricks auth login without --host) opens https://login.databricks.com. The SDK already supports overriding that host via u2m.WithDiscoveryHost; this wires the option to a new DATABRICKS_DISCOVERY_HOST environment variable so developers can point the flow at a non-production login instance for testing. The browser-open log line also reflects the override host so the user can tell which host is being opened. --- NEXT_CHANGELOG.md | 1 + cmd/auth/login.go | 15 ++++++++++++++- cmd/auth/login_test.go | 34 ++++++++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 1 deletion(-) diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md index 8320d92369b..b0025b4e685 100644 --- a/NEXT_CHANGELOG.md +++ b/NEXT_CHANGELOG.md @@ -8,6 +8,7 @@ * Added `databricks aitools` command group for installing Databricks skills into your coding agents (Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity). Skills are fetched from [github.com/databricks/databricks-agent-skills](https://github.com/databricks/databricks-agent-skills) and either symlinked into each agent's skills directory or copied into the current project. Use `databricks aitools install` to set up, `update` to pull newer versions, `list` to see what's available, and `uninstall` to remove them. * `[__settings__].default_profile` is now consulted as a fallback by `databricks api`, `databricks auth token`, and bundle commands when neither `--profile` nor `DATABRICKS_CONFIG_PROFILE` is set. `databricks auth token` continues to give precedence to `DATABRICKS_HOST` over `default_profile`. For bundle commands, `default_profile` only applies when the bundle does not pin its own `workspace.host`. +* Added `DATABRICKS_DISCOVERY_HOST` environment variable to override the default `https://login.databricks.com` host used by the `databricks auth login` discovery flow. Intended for testing and development against non-production login instances; unset for normal use. ### Bundles * Make sure warnings asking for approval are understood by agents ([#5239](https://github.com/databricks/cli/pull/5239)) diff --git a/cmd/auth/login.go b/cmd/auth/login.go index d45a77806fd..a7ac42f28c4 100644 --- a/cmd/auth/login.go +++ b/cmd/auth/login.go @@ -46,6 +46,11 @@ const ( defaultTimeout = 1 * time.Hour authTypeDatabricksCLI = "databricks-cli" discoveryFallbackTip = "\n\nTip: you can specify a workspace directly with: databricks auth login --host " + // discoveryHostEnvVar overrides the default https://login.databricks.com + // host used by the discovery login flow. Intended for testing and + // development against non-production environments. See WithDiscoveryHost + // in github.com/databricks/databricks-sdk-go/credentials/u2m. + discoveryHostEnvVar = "DATABRICKS_DISCOVERY_HOST" ) // discoveryErr wraps an error (or creates a new one) and appends the @@ -618,6 +623,10 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error { if len(scopesList) > 0 { opts = append(opts, u2m.WithScopes(scopesList)) } + discoveryHost := env.Get(ctx, discoveryHostEnvVar) + if discoveryHost != "" { + opts = append(opts, u2m.WithDiscoveryHost(discoveryHost)) + } // Apply timeout before creating PersistentAuth so Challenge() respects it. ctx, cancel := context.WithTimeout(ctx, in.timeout) @@ -629,7 +638,11 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error { } defer persistentAuth.Close() - cmdio.LogString(ctx, "Opening login.databricks.com in your browser...") + displayHost := "login.databricks.com" + if discoveryHost != "" { + displayHost = discoveryHost + } + cmdio.LogString(ctx, fmt.Sprintf("Opening %s in your browser...", displayHost)) if err := persistentAuth.Challenge(); err != nil { return discoveryErr("login via login.databricks.com failed", err) } diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go index d209c511154..86820881cf7 100644 --- a/cmd/auth/login_test.go +++ b/cmd/auth/login_test.go @@ -1082,6 +1082,40 @@ auth_type = databricks-cli assert.Equal(t, "222222", savedProfile.WorkspaceID, "workspace_id should be updated to fresh introspection value") } +func TestDiscoveryLogin_OverridesHostFromEnv(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, ".databrickscfg") + err := os.WriteFile(configPath, []byte(""), 0o600) + require.NoError(t, err) + t.Setenv("DATABRICKS_CONFIG_FILE", configPath) + + oauthArg, err := u2m.NewBasicDiscoveryOAuthArgument("DISCOVERY") + require.NoError(t, err) + oauthArg.SetDiscoveredHost("https://workspace.example.com") + + dc := &fakeDiscoveryClient{ + oauthArg: oauthArg, + persistentAuth: &fakeDiscoveryPersistentAuth{ + token: &oauth2.Token{AccessToken: "test-token"}, + }, + introspectionErr: errors.New("introspection failed"), + } + + ctx, stderr := cmdio.NewTestContextWithStderr(t.Context()) + ctx = env.Set(ctx, "DATABRICKS_DISCOVERY_HOST", "https://login.staging.test") + err = discoveryLogin(ctx, discoveryLoginInputs{ + dc: dc, + profileName: "DISCOVERY", + timeout: time.Second, + browserFunc: func(string) error { return nil }, + tokenCache: newTestTokenCache(), + }) + require.NoError(t, err) + + assert.Contains(t, stderr.String(), "Opening https://login.staging.test in your browser...") + assert.NotContains(t, stderr.String(), "Opening login.databricks.com in your browser...") +} + func TestLoginRejectsPositionalArgWithHostFlag(t *testing.T) { ctx := cmdio.MockDiscard(t.Context()) authArgs := &auth.AuthArguments{Host: "https://example.com"} From d271c38862156e01da41f20a15f1fe4e38ab0429 Mon Sep 17 00:00:00 2001 From: simon Date: Wed, 20 May 2026 15:52:01 +0200 Subject: [PATCH 2/2] Drop NEXT_CHANGELOG entry --- NEXT_CHANGELOG.md | 1 - 1 file changed, 1 deletion(-) diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md index b0025b4e685..8320d92369b 100644 --- a/NEXT_CHANGELOG.md +++ b/NEXT_CHANGELOG.md @@ -8,7 +8,6 @@ * Added `databricks aitools` command group for installing Databricks skills into your coding agents (Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity). Skills are fetched from [github.com/databricks/databricks-agent-skills](https://github.com/databricks/databricks-agent-skills) and either symlinked into each agent's skills directory or copied into the current project. Use `databricks aitools install` to set up, `update` to pull newer versions, `list` to see what's available, and `uninstall` to remove them. * `[__settings__].default_profile` is now consulted as a fallback by `databricks api`, `databricks auth token`, and bundle commands when neither `--profile` nor `DATABRICKS_CONFIG_PROFILE` is set. `databricks auth token` continues to give precedence to `DATABRICKS_HOST` over `default_profile`. For bundle commands, `default_profile` only applies when the bundle does not pin its own `workspace.host`. -* Added `DATABRICKS_DISCOVERY_HOST` environment variable to override the default `https://login.databricks.com` host used by the `databricks auth login` discovery flow. Intended for testing and development against non-production login instances; unset for normal use. ### Bundles * Make sure warnings asking for approval are understood by agents ([#5239](https://github.com/databricks/cli/pull/5239))