Fix auth logout failing to clear token for workspace profiles with account ID#4853
Draft
mihaimitrea-db wants to merge 1 commit intomainfrom
Draft
Fix auth logout failing to clear token for workspace profiles with account ID#4853mihaimitrea-db wants to merge 1 commit intomainfrom
mihaimitrea-db wants to merge 1 commit intomainfrom
Conversation
…ale account_id logout derived the token-cache key by checking whether `account_id` was set on the profile, but a workspace profile can carry a stale `account_id` from an earlier account-level login. This caused logout to build an account-style cache key (`host/oidc/accounts/<id>`) that did not match the workspace-style key the SDK actually wrote, so the cached token was never deleted. Use `config.HostType()` instead to decide the cache-key shape, which matches the SDK's own OAuth routing logic and correctly treats workspace hosts as workspace profiles regardless of leftover account metadata. Co-authored-by: Isaac
mihaimitrea-db
changed the title
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: 4a4b68e
17 interesting tests: 10 SKIP, 7 RECOVERED
Top 46 slowest tests (at least 2 minutes):
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix
auth logoutfailing to clear cached tokens for workspace profiles that carry anaccount_idin~/.databrickscfg.Background
The CLI's auth flow uses the host type (workspace vs. account) to decide the shape of the token-cache key. Workspace hosts get a plain
hostkey; account/unified hosts gethost/oidc/accounts/<id>. However,auth logoutwas making this decision based on whetheraccount_idwas non-empty on the profile. A workspace profile that had anaccount_idwould get an account-style cache key that didn't match the key the CLI actually wrote, so the token was never deleted and the profile stayed valid after logout.Changes
hostCacheKeyAndMatchFnnow populates aconfig.Configwith the full profile fields and callsconfig.HostType()to decide the cache-key shape, matching the CLI own routing logic. Workspace hosts are treated as workspace profiles regardless of leftover account metadata.Why
The previous
account_id != ""check was a proxy for "is this an account profile" that breaks when config entries carry account IDs.HostType()is the authoritative answer the CLI already provides.Tests
existing workspace profile with stale account id) to theTestLogouttable incmd/auth/logout_test.go.acceptance/cmd/auth/logout/stale-account-id-workspace-host) that sets up a workspace profile with a staleaccount_id, runsauth logout, and verifies both the profile-keyed and host-keyed token cache entries are removed.go test ./cmd/authpasses.