[coverage] Conformance findings: AUTH-019

Ouverte
  • Quelque chose ne va pas ?
#546 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
66/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
go
Domaine
databases

Piste de recherche

Start by reading the Go driver’s OAuth M2M scope handling and locate the tests for TestOAuthM2MTokenRequestUsesConfiguredScopes; the issue does not name their paths. Compare configured, whitespace-padded, blank, and unset scopes against the expected token request in the issue. Done when both Thrift and SEA send one sql token for sloppy scopes, and blank or unset scopes request all-apis and complete successfully.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Summary

Surfaced by the multi-language coverage fan-out while conformance-testing these SPEC-IDs against databricks/databricks-sql-go. Each finding is committed as an expected-failure (xfail) test in the coverage PR — the test asserts the CORRECT (post-fix) behavior and stays red until THIS driver (databricks/databricks-sql-go) is fixed, then flips green as a tripwire.

Findings

  • AUTH-019 [thrift]: Thrift OAuth M2M forwards configured scopes verbatim: inner whitespace is not split and duplicates are not dropped (" sql sql " -> two sql tokens), and a whitespace-only entry is sent as-is so the token endpoint rejects the client_credentials grant with invalid_scope instead of falling back to all-apis
    • failing test: TestOAuthM2MTokenRequestUsesConfiguredScopes (see the coverage PR diff under tests/)
  • AUTH-019 [sea]: SEA/kernel OAuth M2M forwards configured scopes verbatim: a scope entry's inner whitespace is not split and duplicates are not dropped, so " sql sql " is sent as two sql tokens instead of one
    • failing test: TestOAuthM2MTokenRequestUsesConfiguredScopes (see the coverage PR diff under tests/)
  • AUTH-019: OAuth M2M forwards configured scopes verbatim: a scope entry's inner whitespace is not split and duplicates are not dropped (" sql sql " is sent as two sql tokens on both thrift and sea), and on the Thrift path a whitespace-only entry is sent as-is so the workspace token endpoint rejects the client_credentials grant with invalid_scope instead of falling back to all-apis (the kernel/SEA path handles the blank entry correctly)

Reproduce & Expected

AUTH-019 — Verifies that the driver's OAuth scopes option decides what the client-credentials (M2M) token request asks for, instead of always requesting all-apis, so a service principal whose secret is scoped…

Reproduce:

SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user
SELECT CURRENT_USER() AS user

Expected (per the shared spec):

  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • result has exactly 1 row(s)
  • full assertion contract:
result:
- label: configured_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - sql
- label: configured_scopes
  row_count: 1
- label: sloppy_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - sql
- label: sloppy_scopes
  row_count: 1
- label: blank_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - all-apis
- label: blank_scopes
  row_count: 1
- label: unset_scopes
  oauth_token_request_scope_tokens:
    grant_type: client_credentials
    equals:
    - all-apis
- label: unset_scopes
  row_count: 1
protocol:
  thrift:
  - call_min:
      method: OpenSession
      min: 1
  sea:
  - call_min:
      operation: CreateSession
      min: 1

Context

Langage dominant
Go
Étoiles
54
Forks
71
Merge moyen
16 h 3 min
PR mergées (30 j)
21

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de databricks/databricks-sql-go

Toutes les issues de databricks/databricks-sql-go

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.