Add auth logout command with --profile and --force flags#4613
Open
mihaimitrea-db wants to merge 8 commits intomainfrom
Open
Add auth logout command with --profile and --force flags#4613mihaimitrea-db wants to merge 8 commits intomainfrom
mihaimitrea-db wants to merge 8 commits intomainfrom
Conversation
mihaimitrea-db
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: b8fed18
15 interesting tests: 7 KNOWN, 7 SKIP, 1 RECOVERED
Top 25 slowest tests (at least 2 minutes):
|
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Implement the initial version of databricks auth logout which removes a profile from ~/.databrickscfg and clears associated OAuth tokens from the token cache. This iteration supports explicit profile selection via --profile and a --force flag to skip the confirmation prompt. Interactive profile selection will be added in a follow-up. Token cache cleanup is best-effort: the profile-keyed token is always removed, and the host-keyed token is removed only when no other profile references the same host.
Replace plain fmt.Sprintf confirmation prompt with a structured template using cmdio.RenderWithTemplate. The warning now uses color and bold formatting to clearly highlight the profile name, config path, and consequences before prompting for confirmation.
Resolve config path from the profiler instead of hardcoding fallbacks. Delete the profile before clearing the token cache so a config write failure does not leave tokens removed. Fix token cleanup for account and unified profiles by computing the correct OIDC cache key (host/oidc/accounts/<account_id>). Drop the nil profiler guard, add a success message on logout, and extract backupConfigFile in ops.go to remove duplication. Consolidate token cleanup tests into a table-driven test covering shared hosts, unique hosts, account, and unified profiles.
Merge shared-host token deletion verification into one main parametrized test by addding the hostBasedKey and isSharedKey parameters to each case. This replaces the TestLogoutTokenCacheCleanup test with an assertion: host-based keys are preserved when another profile shares the same host, and deleted otherwise.
mihaimitrea-db
force-pushed
the
mihaimitrea-db/stack/auth_logout
branch
from
0b2d46f to
5f039b9
Compare
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Rewrite the test to use inline config seeds and explicit expected state. Add cases for deleting the last non-default profile, deleting a unified host profile with multiple keys, and deleting the DEFAULT section.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
simonfaltum
approved these changes
Mar 2, 2026
Member
simonfaltum
left a comment
simonfaltum
left a comment
There was a problem hiding this comment.
Looks good! Maybe add an extra test but can also be done in a follow up at a later stage
Comment on lines
+170
to
+178
| configFile.DeleteSection(profileName) | ||
|
|
||
| section := configFile.Section(ini.DefaultSection) | ||
| if len(section.Keys()) == 0 && section.Comment == "" { | ||
| section.Comment = defaultComment | ||
| } | ||
|
|
||
| if err := backupConfigFile(ctx, configFile); err != nil { | ||
| return err |
Member
There was a problem hiding this comment.
super nit: It might be worth checking if the section exist before we delete it, and if it doesn't exist then means we could theoretically create a .bak and rewrite the file even if the profile was never in the config.. I don't think it will happen unless someone starts calling this from other places though
Member
There was a problem hiding this comment.
Maybe add a test for DeleteProfile with a non-existent profile
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🥞 Stacked PR
Use this link to review incremental changes.
Implement the initial version of databricks auth logout which removes a profile from ~/.databrickscfg and clears associated OAuth tokens from the token cache.
This iteration supports explicit profile selection via --profile and a --force flag to skip the confirmation prompt. Interactive profile selection will be added in a follow-up.
Token cache cleanup is best-effort: the profile-keyed token is always removed, and the host-keyed token is removed only when no other profile references the same host.
Changes
Why
There is currently no way to log out of a Databricks profile from the CLI. Users must manually edit ~/.databrickscfg and locate/delete token cache entries. This command provides a safe, single-step logout that handles both config and token cleanup.
Open issue from users requesting this feature: #1639
Tests