mirror of
https://github.com/block/buzz.git
synced 2026-10-27 20:41:57 +00:00
4cd82f5132
Posted by Brain, Wes Billman’s AI assistant, on behalf of `wesbillman`. ## Summary Add an opt-in `databricks::DatabricksConnection` over the existing PKCE/coordinator and v2 catalog machinery. It accepts an explicit HTTPS workspace origin, absolute caller-owned cache root, and browser opener; it does not start an agent or infer credentials/host from the environment. - Validate both OAuth endpoints on the actual discovery response used for grants; native HTTP redirects are disabled and requests have a 30-second timeout. - Keep strict cache/single-flight state in a separate namespace. Connect is explicit/user-initiated; catalog lookup and its one 401 refresh stay headless. Tokens are not exposed by the connection API. - Preserve existing legacy constructors, endpoint/redirect policy, cache layout, intents, and catalog filtering/pagination/partial/default semantics. No internal host default, credential migration, app integration or release configuration changes. ### Intentional shared changes OAuth success/discovery JSON is capped at 1 MiB; error JSON at 16 KiB. Oversized/malformed responses are infrastructure failures, while bounded client-error `invalid_grant` retains its existing classification. OAuth diagnostics omit raw bodies/URLs/opener/callback details. Overflowing token expiry returns an infrastructure failure. These changes affect legacy callers too and have synthetic regression coverage. See [the reuse contract](crates/buzz-agent/DATABRICKS_REUSE.md) for API, compatibility and caller obligations. Total operation deadlines, stale-result fencing, private root ownership, nonlogging opener behavior and credential-removal UX remain the caller’s responsibility. ### Related issue Related discovery work: #6918. Searched existing Databricks PRs and OAuth issues; no duplicate of this strict opt-in API was found among those results. This is a new reuse boundary, not a claim of a live credential leak. ### Testing Published head: `cf33eb2f4f267d5808e068e35127d5504f0bc674`, based on main `78618804ec86a014524ad7d1fb55928e8f5c3edf`. Two implementation/doc commits were transplanted from a release-derived local base to exclude unrelated release files. `git range-diff` reports both patches unchanged; independent source review of the transplant found no blocker. **At the published head:** normal pre-push hooks passed: branch skew, push-head scope, file-size checks, Rust test lane and desktop Tauri Clippy/tests. The fallback Rust lane actually ran `buzz-agent --lib`: 542 passed / 1 ignored, NOT the full package integration suite. Hosted full package/repository CI remains pending. The first push attempt was interrupted by the command runner’s 300-second limit; the second completed normally with all hooks enabled. **At reviewed implementation checkpoint `8cb3b72d4`:** 16 strict, 27 auth, 32 catalog and 63 coordinator/OAuth/CLI tests passed, independently rerun; 18 author-selected mutations and four independent reviewer mutations failed tests with passing restored controls. The subsequent `539319411` delta changed only two doc-comment blocks. These earlier test/mutation results are not silently attributed to the rebased head. Synthetic coverage includes HTTPS grants/catalog, off-origin endpoint and redirect rejection, cancellation/socket/listener cleanup, host/root/legacy namespace isolation, bounded declared/chunked bodies and exact-limit controls, redaction with positive log capture, malformed expiry, legacy endpoint/redirect controls, and real CLI cached-auth aliases. Desktop native checks used fail-closed sidecar stubs: compile/test evidence, **not** a runnable or packaged app. No real provider credentials, browser sign-in, app launch, or agent cutover was performed. Cross-platform execution and real-provider acceptance remain separate gates. No merge or downstream adoption is requested by this PR. --------- Signed-off-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz> Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>
49 lines
2.1 KiB
Rust
49 lines
2.1 KiB
Rust
//! CLI compatibility: the real auth subcommand uses the legacy cache layout.
|
|
//! No ACP, browser, external network, or user cache. Every child has a fresh root.
|
|
#![cfg(unix)]
|
|
|
|
use sha2::{Digest, Sha256};
|
|
use std::time::Duration;
|
|
|
|
#[tokio::test]
|
|
async fn cli_signin_aliases_reuse_legacy_cache_without_runtime_configuration() {
|
|
for provider in ["databricks", "databricks_v2", "databricks-v2"] {
|
|
let root = tempfile::tempdir().unwrap();
|
|
let host = "https://workspace.invalid";
|
|
let key = format!("{host}/oidc/.well-known/oauth-authorization-server|databricks-cli|all-apis,offline_access");
|
|
let dir = root.path().join("buzz-agent/oauth/databricks");
|
|
std::fs::create_dir_all(&dir).unwrap();
|
|
let cache = dir.join(format!("{}.json", hex::encode(Sha256::digest(key))));
|
|
let content = serde_json::json!({"access_token":"synthetic-cli-cache", "refresh_token":null, "expires_at":4_000_000_000u64}).to_string();
|
|
std::fs::write(&cache, &content).unwrap();
|
|
let output = tokio::time::timeout(
|
|
Duration::from_secs(5),
|
|
tokio::process::Command::new(env!("CARGO_BIN_EXE_buzz-agent"))
|
|
.args(["auth", provider])
|
|
.env_clear()
|
|
.env("BUZZ_AGENT_CONFIG_DIR", root.path())
|
|
.env("HOME", root.path())
|
|
.env("DATABRICKS_HOST", host)
|
|
.kill_on_drop(true)
|
|
.output(),
|
|
)
|
|
.await
|
|
.unwrap()
|
|
.unwrap();
|
|
assert!(
|
|
output.status.success(),
|
|
"{}",
|
|
String::from_utf8_lossy(&output.stderr)
|
|
);
|
|
assert!(output.stdout.is_empty(), "auth must not emit ACP frames");
|
|
let stderr = String::from_utf8(output.stderr).unwrap();
|
|
assert!(stderr.contains("Authenticated. Token cached"));
|
|
assert!(!stderr.contains("Opening browser"));
|
|
assert_eq!(std::fs::read_to_string(&cache).unwrap(), content);
|
|
assert!(!root
|
|
.path()
|
|
.join("buzz-agent/oauth/databricks-strict")
|
|
.exists());
|
|
}
|
|
}
|