olai_http/databricks/
mod.rs

1//! Databricks Unified Auth implementation.
2//!
3//! Supports PAT, OAuth M2M (service principal client_credentials), notebook context auth,
4//! Azure MSI fallback, GCP SA token exchange, env-oidc, file-oidc, and `.databrickscfg` profile
5//! loading — following the Databricks Unified Auth spec.
6//!
7//! # Auth resolution order (in [`DatabricksBuilder::build`])
8//!
9//! 1. Explicit `with_credentials(provider)` override.
10//! 2. PAT / static token (`DATABRICKS_TOKEN` / `with_token()`).
11//!    Also covers: notebook context auth (≥ 13.3 LTS injects `DATABRICKS_TOKEN`
12//!    automatically) and self-hosted UC static tokens.
13//! 3. OAuth M2M — `DATABRICKS_CLIENT_ID` + `DATABRICKS_CLIENT_SECRET` →
14//!    POST `{host}/oidc/v1/token` with `grant_type=client_credentials`.
15//! 4. `env-oidc` — reads OIDC JWT from an environment variable
16//!    (`DATABRICKS_OIDC_TOKEN_ENV` names the var; defaults to `DATABRICKS_OIDC_TOKEN`).
17//!    JWT `exp` claim is decoded to drive token refresh.
18//! 5. `file-oidc` — reads OIDC JWT from a file (`DATABRICKS_OIDC_TOKEN_FILEPATH`).
19//!    File is re-read on each fetch so kubelet-rotated tokens are picked up automatically.
20//!    JWT `exp` claim is decoded to drive token refresh.
21//! 6. Azure MSI fallback — if `DATABRICKS_AZURE_RESOURCE_ID` is set, uses
22//!    Azure IMDS to obtain an Azure AD token for the Databricks App ID
23//!    (`2ff814a6-3304-4ab8-85cb-cd0e6f879c1d`) and uses it directly as the
24//!    Databricks bearer token.
25//! 7. GCP SA token exchange — if `GOOGLE_APPLICATION_CREDENTIALS` is set,
26//!    exchanges a GCP service-account JWT for a Databricks OIDC token via
27//!    `{host}/oidc/v1/token` with
28//!    `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`.
29//!
30//! Set `DATABRICKS_AUTH_TYPE` (or call `with_auth_type()`) to force a specific auth method.
31//! `.databrickscfg` profile values are loaded as the lowest-priority source via
32//! `DATABRICKS_CONFIG_FILE` / `DATABRICKS_CONFIG_PROFILE`.
33
34mod builder;
35pub(crate) mod cfg_file;
36pub(crate) mod credential;
37
38pub use builder::{DatabricksBuilder, DatabricksConfig, DatabricksConfigKey};
39pub use credential::DatabricksCredential;
olai_http/databricks/mod.rs

olai_http/databricks/
mod.rs
