Skip to content

Add a non-interactive device code login - #7220

Merged
maksim-zuev-db merged 29 commits into
mainfrom
device-code-agent-login
Nov 3, 2026
Merged

Add a non-interactive device code login#7220
maksim-zuev-db merged 29 commits into
mainfrom
device-code-agent-login

Conversation

@maksim-zuev-db

@maksim-zuev-db maksim-zuev-db commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Changes

When stdin is not a terminal, auth login --use-device-code runs in two steps. The first step stores the device code as a pending login and prints the URL and the user code. Running the same command with the hidden --user-code and --confirmation-code flags exchanges the device code and saves the login. In a terminal, the login stays interactive.

A new login for the same profile or host replaces its pending login. The second step checks the user code, and the host, client ID and scopes the login was started with. auth logout also deletes pending logins. Every auth login, not only the device code login, now rejects a profile name that ends with #device-code, because the token of that profile would share its key with the pending login of another profile.

The pending login is a new PendingLogin field of storage.Entry, stored under the cache key with a #device-code suffix. Piped stdin no longer completes the login: it starts the two-step login instead.

Why

An AI agent or a script that runs the login as a one-off command cannot type the confirmation code into a running auth login.

Tests

Acceptance tests under device-code/non-interactive and logout/pending-device-code-login, unit tests for the stores and IsInputTTY, and termtest tests for the second step in a terminal. The device-code/nominal and device-code/wrong-code acceptance tests piped the code into stdin, so they move to termtest tests.

No changelog fragment: --use-device-code is still behind DATABRICKS_CLI_DEVICE_CODE.

This pull request and its description were written by Isaac.

@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Commit: 275c55c62 | Workflow run

Regression test report

Selected 6 changed tests (limit=20, 0 not selected)

6 tests: regression=6 unreleased=0 coverage=0 failing=0

test branch main (3aa5c96) latest (v1.23.0)
TestAccept/cmd/auth/login/device-code/non-interactive/concurrent ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/errors ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/flags ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/nominal ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/unsupported-host ✅ ❌ ❌
TestAccept/cmd/auth/logout/pending-device-code-login ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/concurrent: branch ✅ | main (3aa5c96) ❌ | latest (v1.23.0) ❌

main (3aa5c96):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/concurrent/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveconcurrent3171167257/002/output.txt
        @@ -3,56 +3,4 @@
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
         
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -
        ->>> cache_keys
        -[
        -  "test#device-code"
        -]
        -
        ->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --user-code does not match the pending login for profile test. Check the user code. If you started a newer login, complete it with its user code. Run the same command without --user-code and --confirmation-code to start a new login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Logins for different targets are independent
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -
        ->>> cache_keys
        -[
        -  "a#device-code",
        -  "b#device-code",
        -  "[DATABRICKS_URL]",
        -  "[DATABRICKS_URL]#device-code",
        -  "test"
        -]
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-0004 --confirmation-code FTFA-QQKY
        -Profile b was successfully saved
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0005 --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
        -Profile a was successfully saved
        -
        ->>> cache_keys
        -[
        -  "a",
        -  "b",
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1119: 
        LOG.first: Using a browser on another device, visit:
        LOG.first: http://127.0.0.1:40085/device/verification
        LOG.first: 
        LOG.first: And enter the code:
        LOG.first: WDJB-0001
        LOG.first: 
        LOG.first: Once finished, enter the confirmation code provided in your browser.
        LOG.first: Confirmation code: Error: reading confirmation code: EOF

latest (v1.23.0):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/concurrent/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveconcurrent4178915134/002/output.txt
        @@ -3,56 +3,4 @@
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
         
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -
        ->>> cache_keys
        -[
        -  "test#device-code"
        -]
        -
        ->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --user-code does not match the pending login for profile test. Check the user code. If you started a newer login, complete it with its user code. Run the same command without --user-code and --confirmation-code to start a new login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Logins for different targets are independent
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -
        ->>> cache_keys
        -[
        -  "a#device-code",
        -  "b#device-code",
        -  "[DATABRICKS_URL]",
        -  "[DATABRICKS_URL]#device-code",
        -  "test"
        -]
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-0004 --confirmation-code FTFA-QQKY
        -Profile b was successfully saved
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0005 --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
        -Profile a was successfully saved
        -
        ->>> cache_keys
        -[
        -  "a",
        -  "b",
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1119: 
        LOG.first: Using a browser on another device, visit:
        LOG.first: http://127.0.0.1:41555/device/verification
        LOG.first: 
        LOG.first: And enter the code:
        LOG.first: WDJB-0001
        LOG.first: 
        LOG.first: Once finished, enter the confirmation code provided in your browser.
        LOG.first: Confirmation code: Error: reading confirmation code: EOF
TestAccept/cmd/auth/login/device-code/non-interactive/errors: branch ✅ | main (3aa5c96) ❌ | latest (v1.23.0) ❌

main (3aa5c96):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors275031371/002/output.txt
        @@ -5,105 +5,276 @@
         Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-0001
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --confirmation-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --use-device-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Profile name that marks a pending login
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test#device-code --use-device-code
        -Error: profile name "test#device-code" must not end with #device-code, which marks pending device code logins
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-0002
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Account host
         
         >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --user-code
         
        -=== Profile scoped to resources
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        ->>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        -=== No pending login
        +Global Flags:
... (143 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.23.0):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors2737669329/002/output.txt
        @@ -5,105 +5,276 @@
         Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-0001
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --confirmation-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --use-device-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Profile name that marks a pending login
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test#device-code --use-device-code
        -Error: profile name "test#device-code" must not end with #device-code, which marks pending device code logins
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-0002
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Account host
         
         >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --user-code
         
        -=== Profile scoped to resources
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        ->>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        -=== No pending login
        +Global Flags:
... (143 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)
TestAccept/cmd/auth/login/device-code/non-interactive/flags: branch ✅ | main (3aa5c96) ❌ | latest (v1.23.0) ❌

main (3aa5c96):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/flags/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveflags2528393508/002/output.txt
        @@ -8,29 +8,7 @@
         And enter the code:
         WDJB-0001
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0001 and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        ->>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -Profile scoped was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Serverless compute is configured in the second step
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-0002
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0002 and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-0002 --confirmation-code FTFA-QQKY
        -Profile serverless was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

latest (v1.23.0): same output as main (3aa5c96)

TestAccept/cmd/auth/login/device-code/non-interactive/nominal: branch ✅ | main (3aa5c96) ❌ | latest (v1.23.0) ❌

main (3aa5c96):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal1806992456/002/output.txt
        @@ -8,86 +8,7 @@
         And enter the code:
         WDJB-0001
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0001 and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        -=== The first step stores the device code and saves no profile
        -
        ->>> find.py home
        -home/.databricks/token-cache.json
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]#device-code"
        -]
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth token --host [DATABRICKS_URL]
        -json.access_token = "oauth-token";
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]"
        -]
        -
        -=== Start the login with a profile
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-0002
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0002 and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth profiles
        -Name            Host                    Valid
        -test (Default)  [DATABRICKS_URL]  YES
        -
        -=== Start the login again with the host from the saved profile
        -
        ->>> [CLI] auth login --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-0003
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-0003 and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

latest (v1.23.0): same output as main (3aa5c96)

TestAccept/cmd/auth/login/device-code/unsupported-host: branch ✅ | main (3aa5c96) ❌ | latest (v1.23.0) ❌

main (3aa5c96):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/unsupported-host/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codeunsupported-host3948316001/002/output.txt
        @@ -2,7 +2,7 @@
         === No host
         
         >>> musterr [CLI] auth login --profile new-profile --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         === Account host

latest (v1.23.0): same output as main (3aa5c96)

TestAccept/cmd/auth/logout/pending-device-code-login: branch ✅ | main (3aa5c96) ❌ | latest (v1.23.0) ❌

main (3aa5c96):

acceptance_test.go:1341: Diff:
        --- cmd/auth/logout/pending-device-code-login/output.txt
        +++ /tmp/TestAcceptcmdauthlogoutpending-device-code-login3813817286/002/output.txt
        @@ -5,6 +5,7 @@
         
         === Token cache keys after logout — the host keys are kept, staging shares them
         [
        +  "dev#device-code",
           "[DATABRICKS_URL]",
           "[DATABRICKS_URL]#device-code",
           "pat#device-code",
        @@ -18,7 +19,10 @@
         
         === Token cache keys after logout — no profile uses the host anymore
         [
        -  "pat#device-code"
        +  "dev#device-code",
        +  "[DATABRICKS_URL]#device-code",
        +  "pat#device-code",
        +  "staging#device-code"
         ]
         
         === Logout pat, a profile that auth login did not create
        @@ -26,4 +30,9 @@
         No tokens to clear for profile "pat". Use --delete to remove it from the config file.
         
         === Token cache keys after logout — the pending login of pat is removed
        -[]
        +[
        +  "dev#device-code",
        +  "[DATABRICKS_URL]#device-code",
        +  "pat#device-code",
        +  "staging#device-code"
        +]

latest (v1.23.0): same output as main (3aa5c96)

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: 275c55c

Run: 41447016437

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 281 21 4:17
✅​ aws-windows-latest-4core-16gb 283 19 3:45
✅​ azure linux-2core-8gb 280 21 4:09
✅​ azure-windows-latest-4core-16gb 282 19 3:46
✅​ gcp linux-2core-8gb 281 21 4:19
✅​ gcp-windows-latest-4core-16gb 283 19 3:45
Top 4 slowest tests (at least 2 minutes):
duration env testname
3:40 azure-windows-latest-4core-16gb TestAccept
3:39 gcp-windows-latest-4core-16gb TestAccept
3:38 aws-windows-latest-4core-16gb TestAccept
2:02 aws linux-2core-8gb TestAccept

@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from 4ff0b1e to 1b2be13 Compare October 28, 2026 14:05
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Closed
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-split-steps to device-code-interactive-tests October 28, 2026 14:06
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Merged
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from 1b2be13 to 26349d5 Compare October 28, 2026 14:35
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from 26349d5 to 90d5979 Compare October 28, 2026 14:45
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Closed
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from cf4b0e9 to adfe6a4 Compare October 28, 2026 15:42
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Merged
@maksim-zuev-db
maksim-zuev-db removed this pull request from stack #7223 October 28, 2026 15:48
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-interactive-tests to device-code-pending-login-storage October 28, 2026 15:48
@maksim-zuev-db
maksim-zuev-db removed this pull request from stack #7236 October 28, 2026 15:57
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-pending-login-storage to device-code-interactive-tests October 28, 2026 15:57
@maksim-zuev-db
maksim-zuev-db requested review from simonfaltum and removed request for simonfaltum October 28, 2026 16:03
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from adfe6a4 to b80d829 Compare October 29, 2026 12:15
@github-actions github-actions Bot added DABs DABs related issues AIR Databricks AI Runtime CLI labels Oct 29, 2026
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from b80d829 to 64abb91 Compare October 29, 2026 12:19
@maksim-zuev-db
maksim-zuev-db removed this pull request from stack #7237 October 29, 2026 12:22
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-interactive-tests to device-code-split-steps October 29, 2026 12:22
@maksim-zuev-db maksim-zuev-db removed DABs DABs related issues AIR Databricks AI Runtime CLI labels Oct 29, 2026
maksim-zuev-db and others added 17 commits October 30, 2026 17:12
@maksim-zuev-db Isaac
Pass the context to NewDeviceCodeLogin in the non-interactive login
8b5aec3 
NewDeviceCodeLogin now takes a context.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Use require and assert in TestMemoryStore_PendingLoginUsesCopies
a87ed03 
Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Keep pending device code logins apart from the tokens
8a9d64e 
A pending login was a token store entry under the cache key with a
#device-code suffix, which a profile can also be named. A pending login for
profile a then replaced the token of profile a#device-code, auth token for
that profile failed with a nil pointer dereference, and logging out of a
deleted it.

The stores now keep pending logins in their own namespace through a new
PendingLoginStore interface, under the plain cache key: the pending_logins
map of the token cache file, the databricks-cli-pending-login keyring
service, and a separate map in the memory store. Entry holds a token
again, and deleting a missing pending login no longer rewrites the token
cache file on every login and logout.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Complete a device code login only with the settings that started it
77faeda 
The second step of the non-interactive login used the host, --client-id
and --scopes of its own command. The token gets the scopes of the device
authorization, so a second step without the --scopes of the first saved a
profile whose scopes did not match its token, and a different host or
client sent the device code to a server or for a client that did not
issue it.

The pending login now stores the host, client ID and scopes, and the second
step fails before the token exchange if any of them differs.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Skip the workspace picker in the non-interactive device code login
e3c67b7 
The second step of the non-interactive login asked for the workspace when
it ran in a terminal and the host had an account ID but no workspace ID,
although neither step is meant to prompt. It now shows the hint that a
login without a terminal shows instead, and saves the profile without a
workspace ID.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Revert "Keep pending device code logins apart from the tokens"
43207fa 
This reverts commit 1af032a. Pending logins are token store entries
under the cache key with a #device-code suffix again, and keep the host,
client ID and scopes that a later commit added. The README describes the
settings check in its own paragraph.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Revert "Skip the workspace picker in the non-interactive device code …
05dd7de 
…login"

This reverts commit bda3307. The picker only prompted when the second
step ran in a terminal for a host whose metadata has an account ID but no
workspace ID, and the prompt can be skipped, so the extra branch is not
worth it.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Treat a token store entry without a token as a missing token
959b693 
A pending device code login is stored under the cache key with a
#device-code suffix, which a profile can also be named. Looking up the
token of such a profile found the pending login, and auth token failed
with a nil pointer dereference when it read the refresh token. The entry
is now reported as storage.ErrNotFound.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Reject profile names that end with #device-code in auth login
41a45d3 
The pending device code login of profile a is stored under the token store
key a#device-code, which is also the key of the token of profile
a#device-code. A login for a then replaced that token, and every login and
logout of a deleted it. auth login now rejects such profile names, both at
the profile name prompt and when they are passed with --profile.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Start a new device code login after the token requests are rate limited
1508d4a 
The server answers further token requests for a device code with HTTP 429
after too many confirmation codes were sent for it. The second step of the
non-interactive login kept the pending login and returned the error
without a hint, so rerunning the command got the same error. The token
exchange error now matches ErrDeviceCodeRateLimited, and the second step
deletes the pending login and tells how to start a new one, as it does for
an invalid device code.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Compare the canonical host when completing a device code login
c7b2135 
The second step of the non-interactive login found the pending login with
the cache key, which uses the canonical host, but compared the host it was
started with as passed. Starting the login with adb-1.azuredatabricks.net
and completing it with https://adb-1.azuredatabricks.net failed with "was
started with a different host". The login now keeps the canonical host.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Tell that --user-code does not match instead of blaming a newer login
64d5acc 
The second step of the non-interactive login said that a newer login
replaced the pending one whenever --user-code did not match it, also when
the user code was mistyped or swapped with the confirmation code. The error
now says that the user code does not match, and mentions a newer login as
one possible cause.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Say which prompts the non-interactive device code login skips
49bc70d 
The second step can still show the workspace picker when it runs in a
terminal, so the comment no longer says that neither step prompts at all.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Do not rewrite the token cache file when deleting a missing key
2931613 
Every successful login now deletes the key of its pending device code
login, which is missing unless a non-interactive device code login was
started. Deleting a missing key rewrote token-cache.json anyway, so
logins without device code wrote the file one more time. Deleting a
missing key now leaves the file as it is.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Delete the pending device code login of any profile in auth logout
8856bdb 
auth logout only cleared the token cache for profiles with auth_type
databricks-cli, so a device code login started for another profile, such
as a PAT profile, survived the logout and could still complete. The docs
say that logout removes the profile's pending login. Logout now deletes
it for every profile, and still leaves the tokens of other profiles alone.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Copy the scopes of a pending login in the memory store
b69120e 
The memory store copied the PendingLogin struct, but its Scopes slice
still shared the backing array with the caller, so changing the caller's
slice after Put changed the stored entry.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Use cmdio.MockDiscard in the device code login completion tests
33e396a 
Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from b6cd53d to 33e396a Compare November 2, 2026 09:32
maksim-zuev-db and others added 6 commits November 2, 2026 10:20
@maksim-zuev-db Isaac
Ignore a token store error in the logout of a non-login profile
7f4e35a 
The logout of a profile that auth login did not create, e.g. a PAT
profile, failed when the token store could not delete its pending device
code login, e.g. with an unavailable keyring, and --delete then kept the
profile. Such a profile does not use the token store otherwise, so the
error is now only logged.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Keep the pending device code login after a rate limited token request
03ff5f9 
Completing a non-interactive device code login deleted the pending login
when the server rate limited the token request, so an approved login had
to be started again. A rate limit can be lifted, so the pending login is
now kept, and the error asks to rerun the command later.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Compare the scopes of a pending device code login in any order
7d8de6f 
Completing a non-interactive device code login failed with "started with
different scopes" when --scopes listed the same scopes in another order
than the first step. The scopes are now compared as a set.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Delete the pending device code login only when it completes
dd9cf58 
Every successful login, including the browser login, deleted the pending
device code login of its profile or host, which added a token store
write, and a keyring call in secure mode, to every login. The pending
login is now deleted when its device code is exchanged, because the
server no longer accepts the device code afterwards. Other logins for the
same target keep it.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Issue a new user code for every device code login in the fake server
a12cb57 
The fake server issued the same user code for every login, so the
acceptance tests edited token-cache.json with update_file.py to tell
logins apart. It now issues WDJB0001, WDJB0002, ... in order, like the
real server issues a new user code for every login, and the tests use the
codes it issues.

The test of a device code the server no longer knows restores the
pending login from before its device code was exchanged, instead of
replacing the device code in the cache file.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Simplify the checks of the non-interactive device code login
275c55c 
- Sort the scopes once when the login is set up, instead of sorting both
  lists in every comparison.
- Read --use-device-code from the command in
  validateDeviceCodeCompletionFlags instead of passing it in.

Co-authored-by: Isaac <no-reply@databricks.com>
simonfaltum
simonfaltum approved these changes Nov 3, 2026
View reviewed changes

@simonfaltum simonfaltum left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking findings from this pass. Reviewed the two-step login, token storage, logout cleanup, and previous review feedback. Focused auth unit tests and all eight device-code/logout acceptance tests pass; CI is green.

The legacy profile-name collision discussed in the earlier thread remains a nonblocking edge case: pending-login operations can still affect an existing profile whose name ends in #device-code. The new validation prevents future logins under those names.

@maksim-zuev-db
maksim-zuev-db added this pull request to the merge queue Nov 3, 2026
Merged via the queue into main with commit df305f2 Nov 3, 2026
27 checks passed
@maksim-zuev-db
maksim-zuev-db deleted the device-code-agent-login branch November 3, 2026 10:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@simonfaltum simonfaltum simonfaltum approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@maksim-zuev-db @eng-dev-ecosystem-bot @simonfaltum