Auth: resolve positional arg as profile name first (#4840)

## Why

Running `databricks auth login logfood` treats `logfood` as a host URL,
which fails confusingly. Running `databricks auth token e2-logfood` (a
typo) falls through to host resolution, producing a misleading DNS
error. The three auth commands handle positional arguments
inconsistently: login only accepts hosts, token tries profile-first,
logout tries profile-first.

## Changes

All three auth commands now share a `resolvePositionalArg` function that
resolves positional arguments as profile names first. If no profile
matches and the argument doesn't look like a profile name, it returns a
clear error.

Before: `databricks auth login logfood` tries to resolve `logfood` as a
hostname and fails.
Now: `databricks auth login logfood` loads the `logfood` profile and
logs into its configured host.

Before: `databricks auth token e2-logfood` produces a confusing
DNS/OAuth error.
Now: `databricks auth token e2-logfood` produces `no profile named
"e2-logfood" found`.

The usage strings show `[PROFILE]` as the positional argument,
reinforcing that profile is the primary concept. Host URLs still work as
a silent fallback for backwards compatibility.

Also removes the local `--profile` flag from `auth logout` in favor of
the global persistent flag, restoring `-p` shorthand consistency.

## Test plan

- [x] New unit tests for `resolvePositionalArg` (7 table-driven cases)
- [x] New unit tests for `resolveHostToProfile` (4 cases)
- [x] New token test for non-host non-profile error message
- [x] Updated logout tests for new resolution flow
- [x] `make checks` passes
- [x] `make lintfull` passes
- [x] `go test ./cmd/auth/` passes

Author: simonfaltum

NEXT_CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Notable Changes
 
 ### CLI
+* Auth commands now accept a profile name as a positional argument ([#4840](https://github.com/databricks/cli/pull/4840))
 
 ### Bundles
 

acceptance/cmd/auth/login/host-arg-overrides-profile/out.databrickscfg

@@ -3,15 +3,8 @@
 [override-test]
 host = https://old-host.cloud.databricks.com
 
-=== Login with positional host argument (should override profile)
->>> [CLI] auth login [DATABRICKS_URL] --profile override-test
-Profile override-test was successfully saved
+=== Login with --host flag (should error on conflict)
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile override-test
+Error: --profile "override-test" has host "https://old-host.cloud.databricks.com", which conflicts with --host "[DATABRICKS_URL]". Use --profile only to select a profile
 
-=== Profile after login (host should be updated)
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-[override-test]
-host         = [DATABRICKS_URL]
-workspace_id = [NUMID]
-auth_type    = databricks-cli
+Exit code: 1

acceptance/cmd/auth/login/host-arg-overrides-profile/output.txt

@@ -9,17 +9,7 @@ EOF
 title "Initial profile with old host\n"
 cat "./home/.databrickscfg"
 
-# Use a fake browser that performs a GET on the authorization URL
-# and follows the redirect back to localhost.
-export BROWSER="browser.py"
-
-# Login with profile but provide a different host as positional argument
-# The positional argument should override the profile's host
-title "Login with positional host argument (should override profile)"
-trace $CLI auth login $DATABRICKS_HOST --profile override-test
-
-title "Profile after login (host should be updated)\n"
-cat "./home/.databrickscfg"
-
-# Track the .databrickscfg file that was created to surface changes.
-mv "./home/.databrickscfg" "./out.databrickscfg"
+# Login with --profile and --host where the profile has a different host.
+# This should error because the profile's host conflicts with --host.
+title "Login with --host flag (should error on conflict)"
+trace $CLI auth login --host $DATABRICKS_HOST --profile override-test

acceptance/cmd/auth/login/host-arg-overrides-profile/script

@@ -94,7 +94,7 @@ func newLoginCommand(authArguments *auth.AuthArguments) *cobra.Command {
 		defaultConfigPath = "%USERPROFILE%\\.databrickscfg"
 	}
 	cmd := &cobra.Command{
-		Use:   "login [HOST]",
+		Use:   "login [PROFILE]",
 		Short: "Log into a Databricks workspace or account",
 		Long: fmt.Sprintf(`Log into a Databricks workspace or account.
 
@@ -109,9 +109,12 @@ information, see:
 If no host is provided, the CLI opens login.databricks.com where you can
 authenticate and select a workspace.
 
-The host can be provided as a positional argument, via --host, or from an
-existing profile. The host URL may include query parameters to set the
-workspace and account ID:
+The positional argument is resolved as a profile name first. If no profile
+with that name exists and the argument looks like a URL, it is used as a
+host. The positional argument cannot be combined with --host or --profile;
+use the flags directly to specify both.
+
+The host URL may include query parameters to set the workspace and account ID:
 
   databricks auth login --host "https://<host>?o=<workspace_id>&account_id=<id>"
 
@@ -149,6 +152,26 @@ a new profile is created.
 			return errors.New("please either configure serverless or cluster, not both")
 		}
 
+		// The positional argument is a shorthand that resolves to either a
+		// profile or a host. It cannot be combined with explicit flags.
+		// Use "databricks auth login --host X --profile Y" instead.
+		if len(args) > 0 && (authArguments.Host != "" || profileName != "") {
+			return fmt.Errorf("argument %q cannot be combined with --host or --profile. Use the --host and --profile flags instead", args[0])
+		}
+		if len(args) == 1 {
+			resolvedProfile, resolvedHost, err := resolvePositionalArg(ctx, args[0], profile.DefaultProfiler)
+			if err != nil {
+				return err
+			}
+			if resolvedProfile != "" {
+				profileName = resolvedProfile
+				args = nil
+			} else {
+				authArguments.Host = resolvedHost
+				args = nil
+			}
+		}
+
 		// If the user has not specified a profile name, prompt for one.
 		if profileName == "" {
 			var err error

cmd/auth/login.go

@@ -992,3 +992,25 @@ auth_type = databricks-cli
 	assert.Equal(t, "fresh-account", savedProfile.AccountID, "account_id should be saved from introspection")
 	assert.Equal(t, "222222", savedProfile.WorkspaceID, "workspace_id should be updated to fresh introspection value")
 }
+
+func TestLoginRejectsPositionalArgWithHostFlag(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	authArgs := &auth.AuthArguments{Host: "https://example.com"}
+	cmd := newLoginCommand(authArgs)
+	cmd.Flags().String("profile", "", "")
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"myprofile"})
+	err := cmd.Execute()
+	assert.ErrorContains(t, err, `argument "myprofile" cannot be combined with --host or --profile`)
+}
+
+func TestLoginRejectsPositionalArgWithProfileFlag(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	authArgs := &auth.AuthArguments{}
+	cmd := newLoginCommand(authArgs)
+	cmd.Flags().String("profile", "", "")
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--profile", "myprofile", "https://example.com"})
+	err := cmd.Execute()
+	assert.ErrorContains(t, err, `argument "https://example.com" cannot be combined with --host or --profile`)
+}

cmd/auth/login_test.go

@@ -66,26 +66,35 @@ the profile is an error.
 	}
 
 	var force bool
-	var profileName string
 	var deleteProfile bool
 	cmd.Flags().BoolVar(&force, "force", false, "Skip confirmation prompt")
-	cmd.Flags().StringVar(&profileName, "profile", "", "The profile to log out of")
 	cmd.Flags().BoolVar(&deleteProfile, "delete", false, "Delete the profile from the config file")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		ctx := cmd.Context()
 		profiler := profile.DefaultProfiler
 
-		// Resolve the positional argument to a profile name.
-		if profileName != "" && len(args) == 1 {
-			return errors.New("providing both --profile and a positional argument is not supported")
+		profileFlag := cmd.Flag("profile")
+		profileName := profileFlag.Value.String()
+
+		// The positional argument is a shorthand that resolves to either a
+		// profile or a host. It cannot be combined with explicit flags.
+		if profileFlag.Changed && len(args) == 1 {
+			return fmt.Errorf("argument %q cannot be combined with --profile. Use the --profile flag instead", args[0])
 		}
-		if profileName == "" && len(args) == 1 {
-			resolved, err := resolveLogoutArg(ctx, args[0], profiler)
+		if len(args) == 1 {
+			resolvedProfile, resolvedHost, err := resolvePositionalArg(ctx, args[0], profiler)
 			if err != nil {
 				return err
 			}
-			profileName = resolved
+			if resolvedProfile != "" {
+				profileName = resolvedProfile
+			} else {
+				profileName, err = resolveHostToProfile(ctx, resolvedHost, profiler)
+				if err != nil {
+					return err
+				}
+			}
 		}
 
 		if profileName == "" {
@@ -289,55 +298,3 @@ func hostCacheKeyAndMatchFn(p profile.Profile) (string, profile.ProfileMatchFunc
 
 	return host, profile.WithHost(host)
 }
-
-// resolveLogoutArg resolves a positional argument to a profile name. It first
-// tries to match the argument as a profile name, then as a host URL. If the
-// host matches multiple profiles in a non-interactive context, it returns an
-// error listing the matching profile names.
-func resolveLogoutArg(ctx context.Context, arg string, profiler profile.Profiler) (string, error) {
-	// Try as profile name first.
-	candidateProfile, err := loadProfileByName(ctx, arg, profiler)
-	if err != nil {
-		return "", err
-	}
-	if candidateProfile != nil {
-		return arg, nil
-	}
-
-	// Try as host URL.
-	canonicalHost := (&config.Config{Host: arg}).CanonicalHostName()
-	hostProfiles, err := profiler.LoadProfiles(ctx, profile.WithHost(canonicalHost))
-	if err != nil {
-		return "", err
-	}
-
-	switch len(hostProfiles) {
-	case 1:
-		return hostProfiles[0].Name, nil
-	case 0:
-		allProfiles, err := profiler.LoadProfiles(ctx, profile.MatchAllProfiles)
-		if err != nil {
-			return "", fmt.Errorf("no profile found matching %q", arg)
-		}
-		names := strings.Join(allProfiles.Names(), ", ")
-		return "", fmt.Errorf("no profile found matching %q. Available profiles: %s", arg, names)
-	default:
-		// Multiple profiles match the host.
-		if cmdio.IsPromptSupported(ctx) {
-			selected, err := profile.SelectProfile(ctx, profile.SelectConfig{
-				Label:             fmt.Sprintf("Multiple profiles found for %q. Select one to log out of", arg),
-				Profiles:          hostProfiles,
-				StartInSearchMode: len(hostProfiles) > 5,
-				ActiveTemplate:    `▸ {{.PaddedName | bold}}{{if .AccountID}} (account: {{.AccountID}}){{else}} ({{.Host}}){{end}}`,
-				InactiveTemplate:  `  {{.PaddedName}}{{if .AccountID}} (account: {{.AccountID | faint}}){{else}} ({{.Host | faint}}){{end}}`,
-				SelectedTemplate:  `{{ "Selected profile" | faint }}: {{ .Name | bold }}`,
-			})
-			if err != nil {
-				return "", err
-			}
-			return selected, nil
-		}
-		names := strings.Join(hostProfiles.Names(), ", ")
-		return "", fmt.Errorf("multiple profiles found matching host %q: %s. Please specify the profile name directly", arg, names)
-	}
-}

cmd/auth/logout.go

@@ -8,6 +8,7 @@ import (
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
@@ -262,95 +263,14 @@ func TestLogoutNoTokensWithDelete(t *testing.T) {
 	assert.Empty(t, profiles)
 }
 
-func TestLogoutResolveArgMatchesProfileName(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	profiler := profile.InMemoryProfiler{
-		Profiles: profile.Profiles{
-			{Name: "dev", Host: "https://dev.cloud.databricks.com", AuthType: "databricks-cli"},
-			{Name: "staging", Host: "https://staging.cloud.databricks.com", AuthType: "databricks-cli"},
-		},
-	}
-
-	resolved, err := resolveLogoutArg(ctx, "dev", profiler)
-	require.NoError(t, err)
-	assert.Equal(t, "dev", resolved)
-}
-
-func TestLogoutResolveArgMatchesHostWithOneProfile(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	profiler := profile.InMemoryProfiler{
-		Profiles: profile.Profiles{
-			{Name: "dev", Host: "https://dev.cloud.databricks.com", AuthType: "databricks-cli"},
-			{Name: "staging", Host: "https://staging.cloud.databricks.com", AuthType: "databricks-cli"},
-		},
-	}
-
-	resolved, err := resolveLogoutArg(ctx, "https://dev.cloud.databricks.com", profiler)
-	require.NoError(t, err)
-	assert.Equal(t, "dev", resolved)
-}
-
-func TestLogoutResolveArgMatchesHostWithMultipleProfiles(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	profiler := profile.InMemoryProfiler{
-		Profiles: profile.Profiles{
-			{Name: "dev1", Host: "https://shared.cloud.databricks.com", AuthType: "databricks-cli"},
-			{Name: "dev2", Host: "https://shared.cloud.databricks.com", AuthType: "databricks-cli"},
-		},
-	}
-
-	_, err := resolveLogoutArg(ctx, "https://shared.cloud.databricks.com", profiler)
-	assert.ErrorContains(t, err, "multiple profiles found matching host")
-	assert.ErrorContains(t, err, "dev1")
-	assert.ErrorContains(t, err, "dev2")
-}
-
-func TestLogoutResolveArgMatchesNothing(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	profiler := profile.InMemoryProfiler{
-		Profiles: profile.Profiles{
-			{Name: "dev", Host: "https://dev.cloud.databricks.com", AuthType: "databricks-cli"},
-			{Name: "staging", Host: "https://staging.cloud.databricks.com", AuthType: "databricks-cli"},
-		},
-	}
-
-	_, err := resolveLogoutArg(ctx, "https://unknown.cloud.databricks.com", profiler)
-	assert.ErrorContains(t, err, `no profile found matching "https://unknown.cloud.databricks.com"`)
-	assert.ErrorContains(t, err, "dev")
-	assert.ErrorContains(t, err, "staging")
-}
-
-func TestLogoutResolveArgCanonicalizesHost(t *testing.T) {
-	profiler := profile.InMemoryProfiler{
-		Profiles: profile.Profiles{
-			{Name: "dev", Host: "https://dev.cloud.databricks.com", AuthType: "databricks-cli"},
-		},
-	}
-
-	cases := []struct {
-		name string
-		arg  string
-	}{
-		{name: "canonical URL", arg: "https://dev.cloud.databricks.com"},
-		{name: "trailing slash", arg: "https://dev.cloud.databricks.com/"},
-		{name: "no scheme", arg: "dev.cloud.databricks.com"},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := cmdio.MockDiscard(t.Context())
-			resolved, err := resolveLogoutArg(ctx, tc.arg, profiler)
-			require.NoError(t, err)
-			assert.Equal(t, "dev", resolved)
-		})
-	}
-}
-
 func TestLogoutProfileFlagAndPositionalArgConflict(t *testing.T) {
+	parent := &cobra.Command{Use: "root"}
+	parent.PersistentFlags().StringP("profile", "p", "", "~/.databrickscfg profile")
 	cmd := newLogoutCommand()
-	cmd.SetArgs([]string{"myprofile", "--profile", "other"})
-	err := cmd.Execute()
-	assert.ErrorContains(t, err, "providing both --profile and a positional argument is not supported")
+	parent.AddCommand(cmd)
+	parent.SetArgs([]string{"logout", "myprofile", "--profile", "other"})
+	err := parent.Execute()
+	assert.ErrorContains(t, err, `argument "myprofile" cannot be combined with --profile`)
 }
 
 func TestLogoutDeleteClearsDefaultProfile(t *testing.T) {