Detect mismatch between host defined in config and env variable (#2549)

## Changes
* Adds a mismatch check when host is defined in config and as an env
variable
* `https://` prefix is ignored during validation on host mismatch, both
in env and profiles

## Why
If I defined both DATABRICKS_TOKEN and DATABRICKS_HOST I expect this
token to be used only for requests to DATABRICKS_HOST, while now we have
it added to `w.CurrentUser.Me` requests to the hosts defined in the
config

## Tests
Added acceptance tests

<!-- If your PR needs to be included in the release notes for next
release,
add a separate entry in NEXT_CHANGELOG.md as part of your PR. -->

Author: ilyakuz-db

NEXT_CHANGELOG.md

@@ -11,5 +11,6 @@
 * Added support for volumes in deployment bind/unbind commands ([#2527](https://github.com/databricks/cli/pull/2527))
 * Added support for dashboards in deployment bind/unbind commands ([#2516](https://github.com/databricks/cli/pull/2516))
 * Added support for registered models in deployment bind/unbind commands ([#2556](https://github.com/databricks/cli/pull/2556))
+* Added a mismatch check when host is defined in config and as an env variable ([#2549](https://github.com/databricks/cli/pull/2549))
 
 ### API Changes

acceptance/auth/bundle_and_env/.databrickscfg

@@ -0,0 +1,5 @@
+[DEFAULT]
+host = https://bar.com
+
+[profile_with_matching_host]
+host = $DATABRICKS_HOST

acceptance/auth/bundle_and_env/databricks.yml

@@ -0,0 +1,11 @@
+bundle:
+  name: test-auth
+
+targets:
+  match:
+    default: true
+    workspace:
+      host: $DATABRICKS_HOST
+  not_match:
+    workspace:
+      host: https://foo.com

acceptance/auth/bundle_and_env/output.txt

@@ -0,0 +1,35 @@
+
+=== Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation not OK (env-defined host doesn't match bundle host)
+>>> errcode [CLI] bundle validate -t not_match
+Error: cannot resolve bundle auth configuration: config host mismatch: DATABRICKS_HOST is defined as [DATABRICKS_HOST], but CLI configured to use https://foo.com
+
+Name: test-auth
+Target: not_match
+Workspace:
+  Host: https://foo.com
+
+Found 1 error
+
+Exit code: 1
+
+=== Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation OK (env-defined host matches bundle host)
+>>> errcode [CLI] bundle validate -t match
+Name: test-auth
+Target: match
+Workspace:
+  Host: [DATABRICKS_HOST]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-auth/match
+
+Validation OK!
+
+=== Bundle commands load bundle configuration with -p flag with DATABRICKS_HOST defined, host in profile matches bundle host but env-defined host doesn't
+>>> errcode [CLI] bundle validate -t match -p profile_with_matching_host
+Name: test-auth
+Target: match
+Workspace:
+  Host: [DATABRICKS_HOST]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-auth/match
+
+Validation OK!

acceptance/auth/bundle_and_env/script

@@ -0,0 +1,15 @@
+# Replace placeholder with an actual host URL
+envsubst < databricks.yml > out.yml && mv out.yml databricks.yml
+envsubst < .databrickscfg > out && mv out .databrickscfg
+
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+title "Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation not OK (env-defined host doesn't match bundle host)"
+trace errcode $CLI bundle validate -t not_match
+
+title "Bundle commands load bundle configuration with DATABRICKS_HOST defined, validation OK (env-defined host matches bundle host)"
+trace errcode $CLI bundle validate -t match
+
+export DATABRICKS_HOST="https://baz.com"
+title "Bundle commands load bundle configuration with -p flag with DATABRICKS_HOST defined, host in profile matches bundle host but env-defined host doesn't"
+trace errcode $CLI bundle validate -t match -p profile_with_matching_host

acceptance/auth/bundle_and_env/test.toml

@@ -0,0 +1,5 @@
+# Some of the clouds have DATABRICKS_HOST variable setup without https:// prefix
+# In the result, output is replaced with DATABRICKS_URL variable instead of DATABRICKS_HOST
+[[Repls]]
+Old='DATABRICKS_URL'
+New='DATABRICKS_HOST'

acceptance/bundle/debug/out.stderr.txt

@@ -17,7 +17,6 @@
 10:07:59 Debug: Apply pid=12345 mutator=<func>
 10:07:59 Info: Phase: initialize pid=12345
 10:07:59 Debug: Apply pid=12345 mutator=validate:AllResourcesHaveValues
-10:07:59 Debug: Apply pid=12345 mutator=validate:interpolation_in_auth_config
 10:07:59 Debug: Apply pid=12345 mutator=RewriteSyncPaths
 10:07:59 Debug: Apply pid=12345 mutator=SyncDefaultPath
 10:07:59 Debug: Apply pid=12345 mutator=SyncInferRoot

acceptance/bundle/variables/host/output.txt

@@ -7,19 +7,14 @@ Warning: Variable interpolation is not supported for fields that configure authe
 Interpolation is not supported for the field workspace.host. Please set
 the DATABRICKS_HOST environment variable if you wish to configure this field at runtime.
 
-Error: failed during request visitor: parse "https://${var.host}": invalid character "{" in host name
+Error: cannot resolve bundle auth configuration: config host mismatch: DATABRICKS_HOST is defined as [DATABRICKS_URL], but CLI configured to use ${var.host}
 
 {
   "bundle": {
     "environment": "default",
     "name": "host",
     "target": "default"
   },
-  "sync": {
-    "paths": [
-      "."
-    ]
-  },
   "targets": null,
   "variables": {
     "host": {
@@ -41,7 +36,7 @@ Warning: Variable interpolation is not supported for fields that configure authe
 Interpolation is not supported for the field workspace.host. Please set
 the DATABRICKS_HOST environment variable if you wish to configure this field at runtime.
 
-Error: failed during request visitor: parse "https://${var.host}": invalid character "{" in host name
+Error: cannot resolve bundle auth configuration: config host mismatch: DATABRICKS_HOST is defined as [DATABRICKS_URL], but CLI configured to use ${var.host}
 
 Name: host
 Target: default

bundle/config/validate/interpolation_in_auth_config.go

@@ -1,10 +1,12 @@
 package config
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 
 	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/workspace"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/marshal"
@@ -148,9 +150,34 @@ func (w *Workspace) Client() (*databricks.WorkspaceClient, error) {
 		}
 	}
 
+	if w.Host != "" && w.Profile == "" {
+		err := validateConfigAndEnvHost(cfg)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	return databricks.NewWorkspaceClient((*databricks.Config)(cfg))
 }
 
+func validateConfigAndEnvHost(cfg *config.Config) error {
+	var hostEnvName, hostEnvVal string
+	for _, attr := range config.ConfigAttributes {
+		if attr.Name == "host" {
+			hostEnvVal, hostEnvName = attr.ReadEnv()
+			break
+		}
+	}
+	if hostEnvName == "" || hostEnvVal == "" {
+		return nil
+	}
+
+	if !workspace.MatchHost(hostEnvVal, cfg.Host) {
+		return fmt.Errorf("config host mismatch: %s is defined as %s, but CLI configured to use %s", hostEnvName, hostEnvVal, cfg.Host)
+	}
+	return nil
+}
+
 func init() {
 	arg0 := os.Args[0]