[Internal] Resolve token_audience from token_federation_default_oidc_audiences in host metadata

[tanmay-db]

Summary

Read the token_federation_default_oidc_audiences list from the /.well-known/databricks-config discovery endpoint and use the first element as the token_audience when not explicitly configured. This removes the need for explicit audience configuration and replaces the TODO for adding an explicit audience to the metadata endpoint.

Why

Today, the SDK resolves the OIDC token audience through a fallback chain: an explicitly configured token_audience, or for account-level hosts, the account_id. There was a TODO in the code to add explicit audience support from the metadata discovery endpoint.

The discovery endpoint now returns a token_federation_default_oidc_audiences field (a list of audience strings). This PR reads that field and uses it as the primary source for token_audience, which is more reliable than the account_id heuristic and works correctly for all host types (workspace, account, unified).

What changed

Interface changes

• HostMetadata.token_federation_default_oidc_audiences: Optional[List[str]] — New field on the HostMetadata dataclass, parsed from the discovery endpoint response. Included in from_dict() and as_dict().

Behavioral changes

• When token_audience is not explicitly configured and token_federation_default_oidc_audiences is present in host metadata, the SDK now sets token_audience to the first element of that list.
• This takes priority over the existing account_id fallback (which only applies to account hosts without workspace_id).
• An explicitly configured token_audience is never overwritten.

Internal changes

• Removed the # TODO: Add explicit audience to the metadata discovery endpoint. comment (now implemented).

How is this tested?

4 new unit tests in tests/test_config.py:

• token_federation_default_oidc_audiences sets token_audience (first element) when not explicitly configured.
• token_federation_default_oidc_audiences takes priority over the account_id fallback for account hosts.
• Explicitly configured token_audience is not overwritten by token_federation_default_oidc_audiences.
• Falls back to account_id when token_federation_default_oidc_audiences is absent and no workspace_id.

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-py

Inputs:

• PR number: 1387
• Commit SHA: 998e2636b36eb31f8a453586f6fd9adab3ac935c

Checks will be approved automatically on success.