api: route per-call against unified hosts

NEXT_CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### CLI
 
+* `databricks api` now works against unified hosts. Adds `--account` to scope a call to the account API and `--workspace-id` to override the workspace routing identifier per call. A `?o=<workspace-id>` query parameter on the path (the SPOG URL convention used by the Databricks UI) is also recognized as a per-call workspace override, so URLs pasted from the browser route correctly.
+
 ### Bundles
 
 ### Dependency updates

acceptance/cmd/api/account-flag/output.txt

@@ -0,0 +1,15 @@
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}

acceptance/cmd/api/account-flag/script

@@ -0,0 +1,2 @@
+$CLI api get /api/2.0/clusters/list --account
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "!X-Databricks-Org-Id"

acceptance/cmd/api/account-path/output.txt

@@ -0,0 +1,15 @@
+{}
+
+>>> print_requests.py --get //api/2.0/accounts/abc-123/network-policies
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/accounts/abc-123/network-policies"
+}

acceptance/cmd/api/account-path/script

@@ -0,0 +1,2 @@
+$CLI api get /api/2.0/accounts/abc-123/network-policies
+trace print_requests.py --get //api/2.0/accounts/abc-123/network-policies | contains.py "!X-Databricks-Org-Id"

acceptance/cmd/api/test.toml

@@ -0,0 +1,46 @@
+RecordRequests = true
+IncludeRequestHeaders = ["Authorization", "User-Agent", "X-Databricks-Org-Id"]
+
+[Env]
+# MSYS2 (Git Bash on Windows) auto-converts a leading "/" argument to a
+# Windows path (e.g. /api/2.0/... becomes C:/Program Files/Git/api/2.0/...).
+# Disable that so the CLI receives the path verbatim.
+MSYS_NO_PATHCONV = "1"
+
+# Normalize OS-dependent and CI-only User-Agent segments so the recorded
+# requests are stable across local macOS/Linux runs and GitHub Actions.
+[[Repls]]
+Old = '(linux|darwin|windows)'
+New = '[OS]'
+
+[[Repls]]
+Old = " cicd/[A-Za-z0-9.-]+"
+New = ""
+
+[[Repls]]
+Old = " upstream/[A-Za-z0-9.-]+"
+New = ""
+
+[[Repls]]
+Old = " upstream-version/[A-Za-z0-9.-]+"
+New = ""
+
+# Common stubs for paths used across variants. Each returns an empty JSON
+# object; the variants assert on the *recorded request* (out.requests.txt),
+# not on the response body, so any well-formed JSON is fine.
+
+[[Server]]
+Pattern = "GET /api/2.0/clusters/list"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "GET /api/2.0/accounts/abc-123/network-policies"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "GET /api/2.0/accounts/abc-123/oauth2/published-app-integrations"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "GET /api/2.0/preview/accounts/access-control/rule-sets"
+Response.Body = '{}'

acceptance/cmd/api/workspace-id-flag/output.txt

@@ -0,0 +1,18 @@
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Org-Id": [
+      "999"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}

acceptance/cmd/api/workspace-id-flag/script

@@ -0,0 +1,2 @@
+$CLI api get /api/2.0/clusters/list --workspace-id 999
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Org-Id" "999"

acceptance/cmd/api/workspace-id-from-query/output.txt

@@ -0,0 +1,21 @@
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Org-Id": [
+      "999"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list",
+  "q": {
+    "o": "999"
+  }
+}

acceptance/cmd/api/workspace-id-from-query/script

@@ -0,0 +1,2 @@
+$CLI api get "/api/2.0/clusters/list?o=999"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Org-Id" "999"

acceptance/cmd/api/workspace-id-none/output.txt

@@ -0,0 +1,15 @@
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}

acceptance/cmd/api/workspace-id-none/script

@@ -0,0 +1,13 @@
+# Profile with workspace_id = none overrides the host-metadata back-fill.
+# The CLI must strip the sentinel before the header decision; the recorded
+# request should not carry the routing identifier.
+sethome "./home"
+cat > "./home/.databrickscfg" <<EOF
+[spog-account]
+host         = $DATABRICKS_HOST
+token        = $DATABRICKS_TOKEN
+workspace_id = none
+EOF
+
+$CLI api get /api/2.0/clusters/list --profile spog-account
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "!X-Databricks-Org-Id"

acceptance/cmd/api/workspace-id-none/test.toml

@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]

acceptance/cmd/api/workspace-path/output.txt

@@ -0,0 +1,18 @@
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Org-Id": [
+      "[NUMID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}

acceptance/cmd/api/workspace-path/script

@@ -0,0 +1,2 @@
+$CLI api get /api/2.0/clusters/list
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Org-Id"

acceptance/cmd/api/workspace-proxy-regression/output.txt

@@ -0,0 +1,18 @@
+{}
+
+>>> print_requests.py --get //api/2.0/preview/accounts/access-control/rule-sets
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Org-Id": [
+      "[NUMID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/accounts/access-control/rule-sets"
+}

acceptance/cmd/api/workspace-proxy-regression/script

@@ -0,0 +1,5 @@
+# Workspace-routed proxy under accounts/. The deny-list must keep this from
+# being misclassified as account-scope, so the routing identifier should be
+# present on the recorded request.
+$CLI api get /api/2.0/preview/accounts/access-control/rule-sets
+trace print_requests.py --get //api/2.0/preview/accounts/access-control/rule-sets | contains.py "X-Databricks-Org-Id"