CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed by al-conductorone · Pull Request #58 · ConductorOne/baton-databricks

al-conductorone · 2026-08-27T20:43:14Z

Adds the missing Users row to the capabilities list, adds the docs-team input form, removes a stale config field reference that pointed at nothing, and fixes a heading typo. Note: the closed PR's plan to strip out personal-access-token setup was intentionally not revived, since that authentication method is now supported.

…d-group ref; fix readme typo

linear-code · 2026-08-27T20:43:17Z

CXH-2351

github-actions · 2026-08-27T20:46:00Z

 | Groups | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 | Roles | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 | Service principals | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
+| Users | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |


🟡 Suggestion: The capabilities table marks Groups as provisionable unconditionally, but README.md and the new docs/docs-info.md both state that account-group provisioning only works with the OAuth (client-id/secret) flow — a workspace token cannot provision groups. Since this PR is the docs cleanup pass, consider adding that caveat here so connector.mdx matches the other two docs.

github-actions · 2026-08-27T20:46:20Z

Connector PR Review: CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base ef6c2aae70ca.
Review mode: incremental since 838efe12
View review run

Review Summary

The new commit rewords the `docs/connector.mdx` provisioning note to scope the restriction to **account** groups and to state that workspace-scoped groups remain provisionable with a workspace token — this addresses the prior finding, and it matches `groupBuilder.Grant`/`Revoke`, which route through the workspace plane when the parent is a workspace (`pkg/connector/groups.go:301-311`). The full PR diff was scanned for security and correctness: removing `BaseURLField` from both field groups in `pkg/config/config.go` (and the regenerated `config_schema.json`) is safe because the field stays in `configFields` and is CLI-only/hidden, so `--base-url` still reaches `cfg.BaseUrl` at `pkg/connector/connector.go:202`. No security or correctness issues found; two documentation-accuracy suggestions remain.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

- `docs/connector.mdx:23` — The new Users/Provision capability row has the same auth caveat as groups: account user create/delete goes through the account plane, which workspace tokens do not authenticate. (medium confidence) - `docs/docs-info.md:14` — Sentence starts scoped to "account groups" but ends with the broader "cannot provision groups", reintroducing the claim just corrected in `connector.mdx`. (high confidence)

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

Suggestions:

In `docs/connector.mdx`:
- Around line 17-24: The capabilities table now advertises a Users row with Provision
  checked and no auth caveat, but `userBuilder.CreateAccount` and `userBuilder.Delete`
  call `client.CreateUser(ctx, "", ...)` / `client.DeleteUser(ctx, "", ...)` with an empty
  workspace ID (pkg/connector/users.go:209 and :235), which targets the account plane, and
  `TokenAuth.Apply` sets no Authorization header for account-plane hosts
  (pkg/databricks/auth.go:51-68). Extend the existing Note block so it also states that
  creating and deleting account users requires OAuth authentication and is not available
  with a workspace token.

In `docs/docs-info.md`:
- Around line 14: The sentence reads "Provisioning of account groups is only available with
  OAuth. A workspace token cannot provision groups, because the Databricks API does not
  allow it from a workspace token." The second clause is broader than the first and
  contradicts the corrected wording in docs/connector.mdx:23 — workspace-scoped groups can
  be provisioned with a workspace token (pkg/connector/groups.go:301-311). Change "cannot
  provision groups" to "cannot provision account groups", and optionally add that
  workspace-scoped groups are still provisionable.

github-actions

No blocking issues found.

…DME/docs-info Add OAuth-only caveat for group provisioning and correct the workspace-token option to reflect that one or more tokens may be supplied, paired positionally with deployment names.

github-actions · 2026-08-27T20:52:45Z

 The Databricks connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).

+<Note>
+Group provisioning requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning groups from a workspace token.


🟡 Suggestion: This drops the "account" qualifier that README.md and docs/docs-info.md both use, so it reads broader than the actual limitation. groupBuilder.Grant/Revoke (pkg/connector/groups.go:275, :414) route through the workspace plane when workspaceId != "", which a workspace token can reach — it's account-level groups that are unreachable, since prepareClientAuth only gets workspace-scoped auth for that method (pkg/connector/connector.go:215). Consider scoping the note to account groups.

Suggested change

Group provisioning requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning groups from a workspace token.

Provisioning **account groups** requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning account groups from a workspace token.

github-actions

No blocking issues found.

Match README.md and docs/docs-info.md, which limit the OAuth-only restriction to account groups. Workspace-scoped groups are provisioned through the workspace plane (groupBuilder.Grant/Revoke), which a workspace token can reach; only account-plane groups need OAuth.

github-actions · 2026-08-28T11:25:29Z

 The Databricks connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).

+<Note>
+Provisioning **account groups** requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning account groups from a workspace token. Workspace-scoped groups can still be provisioned with a workspace token.


🟡 Suggestion: The note now correctly scopes the group restriction to account groups, but the new Users | Provision row above has the same auth caveat: userBuilder.CreateAccount/Delete call CreateUser/DeleteUser with an empty workspace ID (pkg/connector/users.go:209,235), i.e. the account plane, and TokenAuth.Apply sets no Authorization header for account-plane hosts (pkg/databricks/auth.go:51-68). Consider extending the note to say account user create/delete also requires OAuth. (medium confidence)

github-actions · 2026-08-28T11:25:35Z

+   > Yes:
+   >
+   > - **User accounts**: create and delete account users.
+   > - **Entitlements**: grant and revoke role and membership assignments on accounts, workspaces, groups, service principals, and roles.


🟡 Suggestion: This sentence starts scoped ("account groups") but ends broad ("A workspace token cannot provision groups"), which is the same over-broad claim that was just corrected in docs/connector.mdx:23 — workspace-scoped groups are provisionable over the workspace plane (pkg/connector/groups.go:301-311). Suggest "cannot provision account groups" for consistency. (high confidence)

github-actions

No blocking issues found.

FeliLucero1 · 2026-08-28T17:02:51Z

 | Groups | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 | Roles | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 | Service principals | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
+| Users | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |


[Docs] Provision checkmark is misleading for Users (in scope — this row is new)

This checkmark implies grant/revoke access, but Users only get CAPABILITY_ACCOUNT_PROVISIONING + CAPABILITY_RESOURCE_DELETE (create/delete the account) — no entitlements/grants at all (SkipEntitlementsAndGrants). Every other row's Provision ✓ means real grant/revoke, so this one reads wrong. docs-info.md added in this same PR actually gets the distinction right — worth mirroring, e.g. ✓ Create, Delete here instead of a bare checkmark, or at least a footnote. I'd fix this before merge since it's new/PR-introduced, not preexisting.

FeliLucero1 · 2026-08-28T17:02:51Z

@@ -14,10 +14,15 @@ sidebarTitle: "Databricks"
 | Groups | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |


[Docs] No AUTO-GENERATED guard on this table (not blocking — preexisting, not this PR's job)

Heads up, this whole capability table has no AUTO-GENERATED marker/verification like ~17 other baton-* connectors do, which is basically how the missing Users row happened in the first place. Nothing to fix in this PR, but might be worth a follow-up ticket so CI catches this next time instead of relying on manual review.

FeliLucero1 · 2026-08-28T17:02:51Z

 			Fields: []field.SchemaField{
 				AccountIdField, DatabricksClientIdField, DatabricksClientSecretField,
-				HostnameField, AccountHostnameField, WorkspacesField, BaseURLField, ExcludeWorkspacesField,
+				HostnameField, AccountHostnameField, WorkspacesField, ExcludeWorkspacesField,


[Config] fyi on base-url removal (not blocking, informational only)

This fix is correct — checked that config_schema.json matches go generate output exactly. Just a heads up: baton-sdk's fieldGroupToV1 doesn't filter Hidden/ExportTarget fields the way the top-level fields list does, so if a future hidden/CLI-only field gets added to one of these group Fields lists without manual exclusion, it'll recreate this exact dangling-reference bug. No action needed now, just something to keep in mind.

add users capability row, docs-info form; drop dangling base-url fiel…

6dbda3c

…d-group ref; fix readme typo

al-conductorone requested a review from btipling August 27, 2026 20:43

al-conductorone assigned btipling Aug 27, 2026

al-conductorone requested a review from a team August 27, 2026 20:43

github-actions Bot reviewed Aug 27, 2026

View reviewed changes

docs: align connector.mdx group-provisioning and PAT wording with REA…

838efe1

…DME/docs-info Add OAuth-only caveat for group provisioning and correct the workspace-token option to reflect that one or more tokens may be supplied, paired positionally with deployment names.

github-actions Bot reviewed Aug 27, 2026

View reviewed changes

github-actions Bot reviewed Aug 28, 2026

View reviewed changes

FeliLucero1 reviewed Aug 28, 2026

View reviewed changes

luisina-santos approved these changes Aug 28, 2026

View reviewed changes

mateoHernandez123 approved these changes Aug 28, 2026

View reviewed changes

Navigation Menu

Uh oh!

CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed - #58

CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed#58
al-conductorone wants to merge 3 commits into
mainfrom
cxh-2351-docs-and-config-surface-cleanup

al-conductorone commented Aug 27, 2026

Uh oh!

linear-code Bot commented Aug 27, 2026

Uh oh!

github-actions Bot Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Aug 27, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Aug 28, 2026

Uh oh!

github-actions Bot Aug 28, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

FeliLucero1 Aug 28, 2026

Uh oh!

FeliLucero1 Aug 28, 2026

Uh oh!

FeliLucero1 Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	Group provisioning requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning groups from a workspace token.
	Provisioning account groups requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning account groups from a workspace token.

		@@ -14,10 +14,15 @@ sidebarTitle: "Databricks"
		\| Groups \| <Icon icon="square-check" iconType="solid" color="#c937ae"/> \| <Icon icon="square-check" iconType="solid" color="#c937ae"/> \|

Uh oh!

Conversation

al-conductorone commented Aug 27, 2026

Uh oh!

linear-code Bot commented Aug 27, 2026

Uh oh!

github-actions Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Connector PR Review: CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed

Review Summary

Security Issues

Correctness Issues

Suggestions

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

FeliLucero1 Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

FeliLucero1 Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

FeliLucero1 Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Aug 27, 2026 •

edited

Loading