Reject an empty host at the login host prompt by maksim-zuev-db · Pull Request #7195 · databricks/cli

maksim-zuev-db · 2026-10-27T13:50:50Z

Changes

databricks auth login and databricks auth token no longer accept an empty host.

A host that is empty after trimming spaces and stripping the trailing slash and the query params
(e.g. " ", /, ?o=123) fails with invalid host "<input>". The check is in normalizeLoginHost,
used by setHost and the --skip-workspace block, so it covers --host, the positional argument,
profile hosts and the prompt. It replaces the device code specific checks from Prompt for the host instead of failing when device code login has none #7179 (errDeviceCodeNeedsHost).
The host prompt runs the same check, so an empty, spaces-only or e.g. ?o=123 input shows the error
under the prompt and asks again.

Behavior changes:

An empty host after "Enter a host" in the login profile picker no longer starts discovery login.
auth login --skip-workspace --host '?a=123' fails. On main this started discovery login.

Why

Follow-up to a review comment on #7179. An empty host made login and token resolve the host from
DATABRICKS_HOST, save a profile without a host key, or fail later with host must start with 'https://': .

Tests

TestPromptForHostRejectsEmptyHost, TestPromptForHostRejectsHostEmptyAfterNormalization, TestSetHost,
TestLoginDeviceCodeHostEmptyAfterNormalization, TestLoginSkipWorkspaceHostEmptyAfterNormalization,
and prompt baselines for Validate.
Acceptance tests cmd/auth/login/invalid-host and cmd/auth/token/invalid-host.

This pull request and its description were written by Isaac.

eng-dev-ecosystem-bot · 2026-10-27T14:38:30Z

Integration test report

Commit: 02bfdf4

Run: 41096442653

	Env	✅pass	🙈skip	Time
✅	aws linux-2core-8gb	281	17	5:28
✅	aws-windows-latest-4core-16gb	283	15	5:18
✅	azure linux-2core-8gb	280	17	5:20
✅	azure-windows-latest-4core-16gb	282	15	3:29
✅	gcp linux-2core-8gb	281	17	5:27
✅	gcp-windows-latest-4core-16gb	283	15	4:33

Top 6 slowest tests (at least 2 minutes):

duration	env	testname
5:11	aws-windows-latest-4core-16gb	TestAccept
4:28	gcp-windows-latest-4core-16gb	TestAccept
3:47	aws linux-2core-8gb	TestAccept
3:45	gcp linux-2core-8gb	TestAccept
3:40	azure linux-2core-8gb	TestAccept
3:23	azure-windows-latest-4core-16gb	TestAccept

simonfaltum

Left a few comments inline. The main one is in login.go: removing the post-setHost empty check lets device code login continue with an empty host when the input normalizes to "" (e.g. / or ?o=123).

One more outside the diff: promptForAccountID (cmd/auth/auth.go:67) has the same problem for the account ID. An empty answer leaves AccountID == "", ToOAuthArgument then picks up DATABRICKS_ACCOUNT_ID through ConfigAttributes (or OAuth fails later), and the profile can be saved without account_id. Probably fine as a follow-up.

simonfaltum

Thanks for the fixes, the first-round points look addressed. A few more comments inline, nothing blocking.

The glyph change was my suggestion, my bad. It changes every prompt that uses Validate, so I think it should be rolled back here (see the comment on prompt.go).

[nit] In the description, "auth login --skip-workspace --host '?a=123' fails instead of starting discovery login (already the case on main)" reads like a contradiction. On main the host is empty after the query params are extracted, so shouldUseDiscovery returns true and login goes on to discovery. "On main this started discovery login" would be clearer.

Pressing Enter at the "Databricks host" prompt left the host empty, so login fell back to DATABRICKS_HOST or failed later with an unrelated error. The prompt now refuses an empty answer, which replaces the device code specific empty host checks. Co-authored-by: Isaac <no-reply@databricks.com>

Co-authored-by: Isaac <no-reply@databricks.com>

A host pasted with surrounding spaces failed later with an unrelated URL error, and a host of only spaces got past the empty host check. Co-authored-by: Isaac <no-reply@databricks.com>

setHost strips a trailing "/" and the query params, so "/" or "?o=123" became an empty host after the prompt check. Login and auth token then resolved the host from DATABRICKS_HOST or failed later. Checking in setHost covers the prompt, --host, the positional argument, and profile hosts, and keeps the hint from the removed errDeviceCodeNeedsHost. Co-authored-by: Isaac <no-reply@databricks.com>

WaitFor matched the error printed for the first empty answer, so the test passed even if a whitespace-only host was accepted. Golden steps compare the rendered screen after each Enter. Co-authored-by: Isaac <no-reply@databricks.com>

The prompt glyph ran Validate on every render, so a prompt that rejects empty input, such as the login host prompt, opened with a red cross before anything was typed. The glyph is now blank until the first edit or Enter, then shows a cross while the input is invalid and a checkmark once it is valid. Co-authored-by: Isaac <no-reply@databricks.com>

Mention auth token, and that an empty host after "Enter a host" no longer starts discovery login. Co-authored-by: Isaac <no-reply@databricks.com>

With --skip-workspace, login stripped the query params from the host before setHost ran, so a host like "?a=123" became empty and login went to discovery instead of failing. Both places now share normalizeHost, which does the empty host check. The error is now `invalid host "<input>"`. The previous hint to pass the host as an argument or with --host did not help, because the error only happens when a host was given. Co-authored-by: Isaac <no-reply@databricks.com>

cmd/configure and libs/databrickscfg already have a normalizeHost. Co-authored-by: Isaac <no-reply@databricks.com>

The glyph change affects every prompt that uses Validate, including the databricks configure host prompt, so it does not belong in this PR. The baseline tests added with it pass with the old glyph and stay. Co-authored-by: Isaac <no-reply@databricks.com>

ExtractHostQueryParams also handles ?w=, ?workspace_id= and ?account_id=, not just ?o= and ?a=. Co-authored-by: Isaac <no-reply@databricks.com>

A "/" host made the subtest name end in "//", which is awkward to target from the command line. TestLoginSkipWorkspaceHostEmptyAfterNormalization had landed between the two positional argument tests. Co-authored-by: Isaac <no-reply@databricks.com>

Only the host prompt trimmed spaces, so --host " ", a positional argument or a profile host of only spaces passed the empty host check and failed later with "host must start with 'https://'". A leading space also made url.Parse fail, so ?o= never ended up in WorkspaceID. promptForHost still trims its result because the profile picker passes the host to getProfileName before it is normalized. Co-authored-by: Isaac <no-reply@databricks.com>

The prompt only rejected blank input, so "/" or "?o=123" passed and then failed in setHost. In auth login, the "Enter a host" picker path first asked for a profile name and then failed, and in auth token the command exited instead of asking again. Running normalizeLoginHost in Validate keeps the prompt open with the error under it. Co-authored-by: Isaac <no-reply@databricks.com>

The invalid host error is user-visible output of both commands, and the auth token path was not exercised end to end. Co-authored-by: Isaac <no-reply@databricks.com>

github-actions · 2026-10-30T17:20:20Z

Commit: 02bfdf4f3 | Workflow run

Regression test report

Selected 2 changed tests (limit=20, 0 not selected)

2 tests: regression=2 unreleased=0 coverage=0 failing=0

test	branch	main (`a7e6114`)	latest (v1.23.0)
TestAccept/cmd/auth/login/invalid-host	✅	❌	❌
TestAccept/cmd/auth/token/invalid-host	✅	❌	❌

TestAccept/cmd/auth/login/invalid-host: branch ✅ | main (a7e6114) ❌ | latest (v1.23.0) ❌

main (a7e6114):

acceptance_test.go:1341: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1341
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1082
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:641
        	Error:      	Not equal: 
        	            	expected: "\n>>> musterr [CLI] auth login --host ?o=123 --profile test\nError: invalid host \"?o=123\"\n"
        	            	actual  : "\n>>> musterr [CLI] auth login --host ?o=123 --profile test\nPlease continue the authentication process in your browser:\n[DATABRICKS_URL]/oidc/v1/authorize?client_id=databricks-cli&code_challenge=dT4btRUDcnXiB8FZjYQplC7dVTEkifSE7OJJ8Gg7Cvc&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A8020&response_type=code&scope=offline_access+all-apis&state=-6k5eqY6gRRlls5Y-BPWqg\n\nError: Test script killed due to a timeout (2m0s)\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -2,3 +2,6 @@
        	            	 >>> musterr [CLI] auth login --host ?o=123 --profile test
        	            	-Error: invalid host "?o=123"
        	            	+Please continue the authentication process in your browser:
        	            	+[DATABRICKS_URL]/oidc/v1/authorize?client_id=databricks-cli&code_challenge=dT4btRUDcnXiB8FZjYQplC7dVTEkifSE7OJJ8Gg7Cvc&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A8020&response_type=code&scope=offline_access+all-apis&state=-6k5eqY6gRRlls5Y-BPWqg
        	            	 
        	            	+Error: Test script killed due to a timeout (2m0s)
        	            	+
        	Test:       	TestAccept/cmd/auth/login/invalid-host
        	Messages:   	cmd/auth/login/invalid-host/output.txt vs /tmp/TestAcceptcmdauthlogininvalid-host3904021222/002/output.txt
FAIL

latest (v1.23.0):

acceptance_test.go:1341: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1341
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1082
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:641
        	Error:      	Not equal: 
        	            	expected: "\n>>> musterr [CLI] auth login --host ?o=123 --profile test\nError: invalid host \"?o=123\"\n"
        	            	actual  : "\n>>> musterr [CLI] auth login --host ?o=123 --profile test\nPlease continue the authentication process in your browser:\n[DATABRICKS_URL]/oidc/v1/authorize?client_id=databricks-cli&code_challenge=d6o8x8u0jVwEzu2psGeqWzbeMvlnRJL3IwukNvybsBE&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A8021&response_type=code&scope=offline_access+all-apis&state=fn4O7276HkqzEuoiArOGXA\n\nError: Test script killed due to a timeout (2m0s)\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -2,3 +2,6 @@
        	            	 >>> musterr [CLI] auth login --host ?o=123 --profile test
        	            	-Error: invalid host "?o=123"
        	            	+Please continue the authentication process in your browser:
        	            	+[DATABRICKS_URL]/oidc/v1/authorize?client_id=databricks-cli&code_challenge=d6o8x8u0jVwEzu2psGeqWzbeMvlnRJL3IwukNvybsBE&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A8021&response_type=code&scope=offline_access+all-apis&state=fn4O7276HkqzEuoiArOGXA
        	            	 
        	            	+Error: Test script killed due to a timeout (2m0s)
        	            	+
        	Test:       	TestAccept/cmd/auth/login/invalid-host
        	Messages:   	cmd/auth/login/invalid-host/output.txt vs /tmp/TestAcceptcmdauthlogininvalid-host118980448/002/output.txt
FAIL

TestAccept/cmd/auth/token/invalid-host: branch ✅ | main (a7e6114) ❌ | latest (v1.23.0) ❌

main (a7e6114):

acceptance_test.go:1341: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1341
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1082
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:641
        	Error:      	Not equal: 
        	            	expected: "\n>>> musterr [CLI] auth token --host ?o=123\nError: invalid host \"?o=123\"\n"
        	            	actual  : "\n>>> musterr [CLI] auth token --host ?o=123\nError: host must start with 'https://': \n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -2,3 +2,3 @@
        	            	 >>> musterr [CLI] auth token --host ?o=123
        	            	-Error: invalid host "?o=123"
        	            	+Error: host must start with 'https://': 
        	            	 
        	Test:       	TestAccept/cmd/auth/token/invalid-host
        	Messages:   	cmd/auth/token/invalid-host/output.txt vs /tmp/TestAcceptcmdauthtokeninvalid-host699813879/002/output.txt

latest (v1.23.0): same output as main (a7e6114)

maksim-zuev-db requested a review from simonfaltum October 27, 2026 14:00

maksim-zuev-db marked this pull request as ready for review October 27, 2026 14:00

maksim-zuev-db requested review from a team as code owners October 27, 2026 14:00

simonfaltum reviewed Oct 27, 2026

View reviewed changes

maksim-zuev-db force-pushed the login-reject-empty-host branch from 49c8f84 to f80c59f Compare October 27, 2026 17:09

maksim-zuev-db requested a review from simonfaltum October 27, 2026 18:04

maksim-zuev-db mentioned this pull request Oct 28, 2026

Reject existing profile names after "Create a new profile" #7196

Merged

simonfaltum reviewed Oct 29, 2026

View reviewed changes

Comment thread cmd/auth/auth.go Resolved

Comment thread cmd/auth/login.go Resolved

Comment thread cmd/auth/login.go Resolved

Comment thread cmd/auth/login.go Resolved

Comment thread libs/cmdio/prompt.go Resolved

Comment thread cmd/auth/login_device_code_test.go Resolved

maksim-zuev-db and others added 15 commits October 30, 2026 16:52

Add a changelog fragment for the empty host prompt fix

ff6a7d0

Co-authored-by: Isaac <no-reply@databricks.com>

Trim spaces around the host entered at the login host prompt

a1e6c28

A host pasted with surrounding spaces failed later with an unrelated URL error, and a host of only spaces got past the empty host check. Co-authored-by: Isaac <no-reply@databricks.com>

Check the screen in the empty host prompt test

4c03a5a

WaitFor matched the error printed for the first empty answer, so the test passed even if a whitespace-only host was accepted. Golden steps compare the rendered screen after each Enter. Co-authored-by: Isaac <no-reply@databricks.com>

Update the changelog fragment for the review fixes

16b6e86

Mention auth token, and that an empty host after "Enter a host" no longer starts discovery login. Co-authored-by: Isaac <no-reply@databricks.com>

Rename normalizeHost to normalizeLoginHost

ff84264

cmd/configure and libs/databrickscfg already have a normalizeHost. Co-authored-by: Isaac <no-reply@databricks.com>

Revert the blank prompt glyph

57f8e02

The glyph change affects every prompt that uses Validate, including the databricks configure host prompt, so it does not belong in this PR. The baseline tests added with it pass with the old glyph and stay. Co-authored-by: Isaac <no-reply@databricks.com>

List all query params in the normalizeLoginHost comment

8211b9a

ExtractHostQueryParams also handles ?w=, ?workspace_id= and ?account_id=, not just ?o= and ?a=. Co-authored-by: Isaac <no-reply@databricks.com>

Add acceptance tests for an invalid host in auth login and auth token

02bfdf4

The invalid host error is user-visible output of both commands, and the auth token path was not exercised end to end. Co-authored-by: Isaac <no-reply@databricks.com>

maksim-zuev-db force-pushed the login-reject-empty-host branch from 50e1992 to 02bfdf4 Compare October 30, 2026 17:09

Navigation Menu

Repository navigation

Reject an empty host at the login host prompt - #7195

Reject an empty host at the login host prompt#7195
maksim-zuev-db wants to merge 15 commits into
mainfrom
login-reject-empty-host

maksim-zuev-db commented Oct 27, 2026 •

edited

Loading

Uh oh!

eng-dev-ecosystem-bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

simonfaltum left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

simonfaltum left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

maksim-zuev-db commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Why

Tests

Uh oh!

eng-dev-ecosystem-bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Integration test report

Uh oh!

simonfaltum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

simonfaltum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026

Regression test report

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

maksim-zuev-db commented Oct 27, 2026 •

edited

Loading

eng-dev-ecosystem-bot commented Oct 27, 2026 •

edited

Loading