Add opt-in strict profile matching for bundle targets

.nextchanges/bundles/7109.md

@@ -0,0 +1 @@
+* Add `DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH`, which requires a target's host and workspace ID to match exactly one profile in the config file before authenticating. Targets without a host or workspace ID are not affected. ([#7109](https://github.com/databricks/cli/pull/7109))

acceptance/bundle/strict_profile_match/config_file/account.databrickscfg

@@ -0,0 +1,7 @@
+[workspace_custom_host]
+host = $CUSTOM_HOST
+workspace_id = $WORKSPACE_ID
+
+[account_custom_host]
+host = $CUSTOM_HOST
+account_id = test-account

acceptance/bundle/strict_profile_match/config_file/ambiguous.databrickscfg

@@ -0,0 +1,5 @@
+[DEFAULT]
+host = $CLASSIC_HOST
+
+[workspace_classic]
+host = $CLASSIC_HOST

acceptance/bundle/strict_profile_match/config_file/databricks.yml

@@ -0,0 +1,20 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
+  custom_host_without_workspace_id:
+    workspace:
+      host: $CUSTOM_HOST
+  no_host_with_workspace_id:
+    workspace:
+      workspace_id: "$WORKSPACE_ID"

acceptance/bundle/strict_profile_match/config_file/out.test.toml

@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]

acceptance/bundle/strict_profile_match/config_file/output.txt

@@ -0,0 +1,52 @@
+
+=== A target that matches several profiles, including [DEFAULT], is rejected
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/ambiguous.databrickscfg [CLI] bundle validate -t classic
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: multiple profiles match host [DATABRICKS_URL]: DEFAULT, workspace_classic. Config: host=[DATABRICKS_URL], config_file=[TEST_TMP_DIR]/ambiguous.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== Account profiles are skipped
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/account.databrickscfg [CLI] bundle run -t custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/account.databrickscfg [CLI] bundle validate -t custom_host_without_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: host [CUSTOM_HOST] requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host. Config: host=[CUSTOM_HOST], config_file=[TEST_TMP_DIR]/account.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_without_workspace_id
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
+
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/account.databrickscfg [CLI] bundle validate -t no_host_with_workspace_id -p account_custom_host
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: account_custom_host is not a workspace profile with a host in the config file. Config: workspace_id=[WORKSPACE_ID], profile=account_custom_host, config_file=[TEST_TMP_DIR]/account.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: no_host_with_workspace_id
+
+Found 1 error
+
+Exit code: 1
+
+=== A missing config file is rejected
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/missing.databrickscfg [CLI] bundle validate -t classic
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: config file [TEST_TMP_DIR]/missing.databrickscfg not found. Config: host=[DATABRICKS_URL], config_file=[TEST_TMP_DIR]/missing.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1

acceptance/bundle/strict_profile_match/config_file/script

@@ -0,0 +1,10 @@
+title "A target that matches several profiles, including [DEFAULT], is rejected"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/ambiguous.databrickscfg $CLI bundle validate -t classic
+
+title "Account profiles are skipped"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/account.databrickscfg $CLI bundle run -t custom_host show_auth
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/account.databrickscfg $CLI bundle validate -t custom_host_without_workspace_id
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/account.databrickscfg $CLI bundle validate -t no_host_with_workspace_id -p account_custom_host
+
+title "A missing config file is rejected"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/missing.databrickscfg $CLI bundle validate -t classic

acceptance/bundle/strict_profile_match/default_profile/host/databricks.yml

@@ -0,0 +1,23 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  classic_with_workspace_id:
+    workspace:
+      host: $CLASSIC_HOST/?o=$WORKSPACE_ID
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
+  classic_other_workspace:
+    workspace:
+      host: $CLASSIC_HOST/?o=2222222222
+  custom_host_without_workspace_id:
+    workspace:
+      host: $CUSTOM_HOST

acceptance/bundle/strict_profile_match/default_profile/host/out.test.toml

@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]

acceptance/bundle/strict_profile_match/default_profile/host/output.txt

@@ -0,0 +1,38 @@
+
+=== Target classic matches by host, not the default profile
+>>> errcode [CLI] bundle run -t classic show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_with_workspace_id matches by host, not the default profile
+>>> errcode [CLI] bundle run -t classic_with_workspace_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target custom_host matches by host, not the default profile
+>>> errcode [CLI] bundle run -t custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t classic_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no profile for host [DATABRICKS_URL] has workspace_id 2222222222. Config: host=[DATABRICKS_URL], workspace_id=2222222222, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic_other_workspace
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target custom_host_without_workspace_id is rejected
+>>> errcode [CLI] bundle validate -t custom_host_without_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: host [CUSTOM_HOST] requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host. Config: host=[CUSTOM_HOST], config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_without_workspace_id
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1

acceptance/bundle/strict_profile_match/default_profile/host/script

@@ -0,0 +1,9 @@
+for target in classic classic_with_workspace_id custom_host; do
+  title "Target $target matches by host, not the default profile"
+  trace errcode $CLI bundle run -t $target show_auth
+done
+
+for target in classic_other_workspace custom_host_without_workspace_id; do
+  title "Target $target is rejected"
+  trace errcode $CLI bundle validate -t $target
+done

acceptance/bundle/strict_profile_match/default_profile/no_host/databricks.yml

@@ -0,0 +1,15 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  no_host:
+    default: true
+  no_host_with_workspace_id:
+    workspace:
+      workspace_id: "$WORKSPACE_ID"
+  no_host_other_workspace:
+    workspace:
+      workspace_id: "2222222222"

acceptance/bundle/strict_profile_match/default_profile/no_host/out.test.toml

@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]

acceptance/bundle/strict_profile_match/default_profile/no_host/output.txt

@@ -0,0 +1,19 @@
+
+=== Target no_host uses the default profile
+>>> errcode [CLI] bundle run -t no_host show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target no_host_with_workspace_id uses the default profile
+>>> errcode [CLI] bundle run -t no_host_with_workspace_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target no_host_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t no_host_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: profile workspace_classic_id does not have workspace_id 2222222222. Config: workspace_id=2222222222, profile=workspace_classic_id, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: no_host_other_workspace
+
+Found 1 error
+
+Exit code: 1

acceptance/bundle/strict_profile_match/default_profile/no_host/script

@@ -0,0 +1,7 @@
+for target in no_host no_host_with_workspace_id; do
+  title "Target $target uses the default profile"
+  trace errcode $CLI bundle run -t $target show_auth
+done
+
+title "Target no_host_other_workspace is rejected"
+trace errcode $CLI bundle validate -t no_host_other_workspace

acceptance/bundle/strict_profile_match/default_profile/script.prepare

@@ -0,0 +1,2 @@
+# The usual three profiles with workspace_classic_id as the default profile.
+{ printf '[__settings__]\ndefault_profile = workspace_classic_id\n\n'; cat .databrickscfg; } > out && mv out .databrickscfg

acceptance/bundle/strict_profile_match/disabled/databricks.yml

@@ -0,0 +1,7 @@
+bundle:
+  name: strict-profile-match
+
+targets:
+  custom_host_other_workspace:
+    workspace:
+      host: $CUSTOM_HOST/?o=2222222222

acceptance/bundle/strict_profile_match/disabled/out.test.toml

@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]

acceptance/bundle/strict_profile_match/disabled/output.txt

@@ -0,0 +1,22 @@
+
+=== Without strict mode, the environment token is used for a custom host of another workspace
+>>> errcode [CLI] bundle validate -t custom_host_other_workspace
+Name: strict-profile-match
+Target: custom_host_other_workspace
+Workspace:
+  Host: [CUSTOM_HOST]/?o=2222222222
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/strict-profile-match/custom_host_other_workspace
+
+Validation OK!
+
+=== The variable is read as a boolean, so false leaves strict mode off
+>>> errcode env DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH=false [CLI] bundle validate -t custom_host_other_workspace
+Name: strict-profile-match
+Target: custom_host_other_workspace
+Workspace:
+  Host: [CUSTOM_HOST]/?o=2222222222
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/strict-profile-match/custom_host_other_workspace
+
+Validation OK!

acceptance/bundle/strict_profile_match/disabled/script

@@ -0,0 +1,7 @@
+unset DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH
+
+title "Without strict mode, the environment token is used for a custom host of another workspace"
+trace errcode $CLI bundle validate -t custom_host_other_workspace
+
+title "The variable is read as a boolean, so false leaves strict mode off"
+trace errcode env DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH=false $CLI bundle validate -t custom_host_other_workspace

acceptance/bundle/strict_profile_match/host/databricks.yml

@@ -0,0 +1,33 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  classic_with_workspace_id:
+    workspace:
+      host: $CLASSIC_HOST/?o=$WORKSPACE_ID
+  classic_other_workspace:
+    workspace:
+      host: $CLASSIC_HOST/?o=2222222222
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
+  custom_host_workspace_id_field:
+    workspace:
+      host: $CUSTOM_HOST
+      workspace_id: "$WORKSPACE_ID"
+  custom_host_without_workspace_id:
+    workspace:
+      host: $CUSTOM_HOST
+  custom_host_other_workspace:
+    workspace:
+      host: $CUSTOM_HOST/?o=2222222222
+  unknown_host:
+    workspace:
+      host: https://unknown.test

acceptance/bundle/strict_profile_match/host/out.test.toml

@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]

acceptance/bundle/strict_profile_match/host/output.txt

@@ -0,0 +1,68 @@
+
+=== Target classic matches one profile
+>>> errcode [CLI] bundle run -t classic show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_with_workspace_id matches one profile
+>>> errcode [CLI] bundle run -t classic_with_workspace_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target custom_host matches one profile
+>>> errcode [CLI] bundle run -t custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== Target custom_host_workspace_id_field matches one profile
+>>> errcode [CLI] bundle run -t custom_host_workspace_id_field show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t classic_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no profile for host [DATABRICKS_URL] has workspace_id 2222222222. Config: host=[DATABRICKS_URL], workspace_id=2222222222, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic_other_workspace
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target custom_host_without_workspace_id is rejected
+>>> errcode [CLI] bundle validate -t custom_host_without_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: host [CUSTOM_HOST] requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host. Config: host=[CUSTOM_HOST], config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_without_workspace_id
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target custom_host_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t custom_host_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no profile for host [CUSTOM_HOST] has workspace_id 2222222222. Config: host=[CUSTOM_HOST], workspace_id=2222222222, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_other_workspace
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target unknown_host is rejected
+>>> errcode [CLI] bundle validate -t unknown_host
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no workspace profile matches host https://unknown.test. Config: host=https://unknown.test, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: unknown_host
+Workspace:
+  Host: https://unknown.test
+
+Found 1 error
+
+Exit code: 1

acceptance/bundle/strict_profile_match/host/script

@@ -0,0 +1,9 @@
+for target in classic classic_with_workspace_id custom_host custom_host_workspace_id_field; do
+  title "Target $target matches one profile"
+  trace errcode $CLI bundle run -t $target show_auth
+done
+
+for target in classic_other_workspace custom_host_without_workspace_id custom_host_other_workspace unknown_host; do
+  title "Target $target is rejected"
+  trace errcode $CLI bundle validate -t $target
+done