fix(kernel): reject conflicting static token auth

Author: vuanhphung

lib/kernel/KernelAuth.ts

@@ -640,8 +640,9 @@ export function buildKernelConnectionOptions(options: ConnectionOptions): Kernel
   }
 
   if (authType === 'static-token') {
-    const { staticToken, enableTokenFederation, federationClientId } = options as {
+    const { staticToken, token, enableTokenFederation, federationClientId } = options as {
       staticToken?: string;
+      token?: string;
       enableTokenFederation?: boolean;
       federationClientId?: string;
     };
@@ -650,6 +651,12 @@ export function buildKernelConnectionOptions(options: ConnectionOptions): Kernel
         "kernel backend: a non-empty token must be supplied via `staticToken` when using `authType: 'static-token'`.",
       );
     }
+    if (token !== undefined || oauth.oauthClientId !== undefined || oauth.oauthClientSecret !== undefined) {
+      throw new HiveDriverError(
+        'kernel backend: cannot supply `staticToken` alongside `token` or ' +
+          '`oauthClientId`/`oauthClientSecret` on the same connection. Pick one auth mode.',
+      );
+    }
     return {
       ...base,
       authMode: 'Pat',

tests/unit/kernel/auth-static-token.test.ts

@@ -16,6 +16,7 @@ import { expect } from 'chai';
 import expectNativeConnectionOptions from './_helpers/nativeOptions';
 import { buildKernelConnectionOptions } from '../../../lib/kernel/KernelAuth';
 import AuthenticationError from '../../../lib/errors/AuthenticationError';
+import HiveDriverError from '../../../lib/errors/HiveDriverError';
 
 describe('KernelAuth — static-token auth options builder', () => {
   it('maps a static token to the native bearer-token mode', () => {
@@ -88,4 +89,22 @@ describe('KernelAuth — static-token auth options builder', () => {
       ).to.throw(AuthenticationError, /non-empty token.*`staticToken`/);
     }
   });
+
+  it('rejects conflicting token and OAuth credentials', () => {
+    for (const conflicting of [
+      { token: 'dapi-pat' },
+      { oauthClientId: 'oauth-client' },
+      { oauthClientSecret: 'oauth-secret' },
+    ]) {
+      expect(() =>
+        buildKernelConnectionOptions({
+          host: 'example.cloud.databricks.com',
+          path: '/sql/1.0/warehouses/abc',
+          authType: 'static-token',
+          staticToken: 'header.payload.signature',
+          ...conflicting,
+        } as any),
+      ).to.throw(HiveDriverError, /cannot supply `staticToken` alongside/);
+    }
+  });
 });