Skip to content

Improve error message on auth host mismatch#5661

Closed
radakam wants to merge 1 commit into
mainfrom
cli-7598-return-better-error-message-on-auth-host-mismatch
Closed

Improve error message on auth host mismatch#5661
radakam wants to merge 1 commit into
mainfrom
cli-7598-return-better-error-message-on-auth-host-mismatch

Conversation

@radakam

@radakam radakam commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Changes

Turn the bundle host/profile mismatch error into an actionable, located diagnostic.

  • libs/databrickscfg/ops.go: extract detection into a typed HostMismatchError (configured host, profile host, profile name, suggested profile). ValidateConfigAndProfileHost returns it; its Error() string is byte-for-byte unchanged, so the existing enforcement path and its tests don't move.
  • cmd/root/bundle.go: in configureBundle, match the typed error (errors.AsType) and render a diag.Diagnostic with workspace.host (and workspace.profile when it's set in the files) locations + a multi-line Detail.

Before:

Error: cannot resolve bundle auth configuration: the host in the profile (https://non.existing.subdomain.databricks.test) doesn’t match the host configured in the bundle ([DATABRICKS_TARGET]). The profile "DEFAULT" has host="[DATABRICKS_TARGET]" that matches host in the bundle. To select it, pass "-p DEFAULT"

After:

Error: workspace host does not match the selected profile
  at workspace.host
  in databricks.yml:11:13
     databricks.yml:5:9

The host configured in workspace.host ([DATABRICKS_TARGET]) does not match the host of profile "profile_name" (https://non.existing.subdomain.databricks.test) used for authentication.

Profile "DEFAULT" matches the bundle host. To use it, set workspace.profile to "DEFAULT" or pass -p DEFAULT on the command line.

Why

Fixes DECO-7598. The previous message was single-line and never said where the conflicting host came from. (The "suggest a matching profile" hint already existed; this change keeps it but makes the whole error multi-line and points at the config locations.)

Two decisions worth a reviewer's attention:

  • Why configureBundle, not a validate mutator? configureBundle is the one place the workspace client is first built for every bundle command (deploy/destroy/validate/run), and it already logs the error there — before the Initialize mutator pipeline runs. Putting the rendering anywhere later would be dead code.
  • Why a typed error instead of rewriting the string? Detection stays in one place (databrickscfg), and the bundle layer (which has the dyn config tree) adds locations/Detail on top. No string-matching on error text.

Scope notes: the message is unchanged for non-bundle callers that hit the libs path directly (they still get Error()). The original panic in the ticket is already gone on this path (uses WorkspaceClientE + logdiag) and is tracked separately by DECO-4237.

Tests

  • libs/databrickscfg/ops_test.go: unit tests for HostMismatchError (match, mismatch with/without a suggested profile).
  • cmd/root/bundle_test.go: updated the two mismatch expectations to the new diagnostic (locations + detail).
  • acceptance/auth/bundle_and_profile: regenerated golden — covers bundle validate with -p and -t/-p, showing both the "suggested profile" and "no suggestion" variants.
  • ./task fmt, ./task checks, ./task lint-q clean; go test for the touched packages passes.

When workspace.host does not match the host of the selected profile,
render a located, multi-line diagnostic (file:line:col) that names the
profile and both hosts and suggests a matching profile when one exists,
instead of an opaque "cannot resolve bundle auth configuration" error.

Detection is centralized in a typed databrickscfg.HostMismatchError, and
the rich diagnostic is rendered at the configureBundle choke point so it
applies to all bundle commands.
@radakam radakam temporarily deployed to test-trigger-is June 19, 2026 11:51 — with GitHub Actions Inactive
@radakam radakam temporarily deployed to test-trigger-is June 19, 2026 11:51 — with GitHub Actions Inactive
@eng-dev-ecosystem-bot

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: b359606

Run: 27824048587

Env 💚​RECOVERED 🙈​SKIP ✅​pass 🙈​skip Time
💚​ aws linux 7 13 265 1011 7:01
💚​ aws windows 7 13 267 1009 8:44
💚​ aws-ucws linux 7 13 361 925 6:36
💚​ aws-ucws windows 7 13 363 923 11:33
💚​ azure linux 1 15 268 1009 6:45
💚​ azure windows 1 15 270 1007 8:28
💚​ azure-ucws linux 1 15 366 921 7:22
💚​ azure-ucws windows 1 15 368 919 11:33
💚​ gcp linux 1 15 264 1012 7:21
💚​ gcp windows 1 15 266 1010 8:20
20 interesting tests: 13 SKIP, 7 RECOVERED
Test Name aws linux aws windows aws-ucws linux aws-ucws windows azure linux azure windows azure-ucws linux azure-ucws windows gcp linux gcp windows
💚​ TestAccept 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R
🙈​ TestAccept/bundle/invariant/no_drift 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/permissions 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
💚​ TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions 💚​R 💚​R 💚​R 💚​R 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
💚​ TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/DATABRICKS_BUNDLE_ENGINE=direct 💚​R 💚​R 💚​R 💚​R
💚​ TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/DATABRICKS_BUNDLE_ENGINE=terraform 💚​R 💚​R 💚​R 💚​R
💚​ TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions 💚​R 💚​R 💚​R 💚​R 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
💚​ TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/DATABRICKS_BUNDLE_ENGINE=direct 💚​R 💚​R 💚​R 💚​R
💚​ TestAccept/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/DATABRICKS_BUNDLE_ENGINE=terraform 💚​R 💚​R 💚​R 💚​R
🙈​ TestAccept/bundle/resources/postgres_branches/basic 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/postgres_branches/recreate 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/postgres_branches/replace_existing 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/postgres_branches/update_protected 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/postgres_branches/without_branch_id 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/postgres_endpoints/basic 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/postgres_projects/update_display_name 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/synced_database_tables/basic 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/ssh/connection 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
Top 26 slowest tests (at least 2 minutes):
duration env testname
5:03 azure-ucws windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
4:49 aws-ucws windows TestAccept
4:16 gcp linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
4:02 gcp windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
4:01 gcp windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:53 gcp linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:30 aws windows TestAccept
3:22 azure linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:19 azure windows TestAccept
3:14 azure windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:14 azure-ucws linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:14 aws windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:12 aws-ucws windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:11 gcp windows TestAccept
3:11 aws linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:10 azure-ucws windows TestAccept
3:08 aws-ucws windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:06 azure-ucws windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
3:01 aws linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
3:00 aws-ucws linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
2:53 aws windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
2:47 azure windows TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform
2:44 aws-ucws linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
2:43 azure linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
2:34 azure-ucws linux TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=direct
2:13 gcp linux TestSecretsPutSecretStringValue

@radakam radakam closed this Jun 19, 2026
@radakam radakam deleted the cli-7598-return-better-error-message-on-auth-host-mismatch branch June 19, 2026 12:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants