Repository navigation
Stop rejecting unknown grant privileges in validate and PyDABs - #7315
Merged
janniklasrose merged 4 commits intoNov 3, 2026
Merged
janniklasrose merged 4 commits into
janniklasrose merged 4 commits into
Conversation
The platform accepts grant privileges that the SDK's catalog.Privilege enum does not yet list (e.g. CREATE_SECRET, see #6770). Both consumers of that enum rejected them: - `bundle validate` warned, and `--strict` errored, because the enum validation allowlist is reflected from the SDK's Values(). - PyDABs generated a strict `Privilege(Enum)` and `_transform` raised ValueError on unknown strings. Exclude catalog.Privilege from the validation generator so no `grants[*].privileges[*]` pattern is checked, and generate Privilege as an open enum in PyDABs: a `_missing_` hook turns unknown strings into cached pseudo-members and `PrivilegeParam` gains `| str`. The JSON schema keeps the enum, so completion is unchanged in both. Co-authored-by: Isaac <no-reply@databricks.com>
Co-authored-by: Isaac <no-reply@databricks.com>
Move the schema grant in the enum acceptance test below the jobs so output.txt no longer differs from main by line numbers only. Drop the "platform adds privileges faster" wording from the changelog fragment and the issue link from the PyDABs codegen comment. Co-authored-by: Isaac <no-reply@databricks.com>
…nt-privilege-enum Resolved bundle/internal/validation/generated/enum_fields.go by taking main and re-running ./task generate-validation. Re-ran ./task pydabs-codegen; it produced no further changes. Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
Commit: Regression test reportSelected 1 changed tests (limit=20, 0 not selected) 2 tests: regression=2 unreleased=0 coverage=0 failing=0
TestAccept/bundle/validate/enum/DMS=: branch ✅ | main (c0e1859) ❌ | latest (v1.23.0) ❌main (c0e1859): latest (v1.23.0): TestAccept/bundle/validate/enum/DMS=true: branch ✅ | main (c0e1859) ❌ | latest (v1.23.0) ❌main (c0e1859): latest (v1.23.0): |
Collaborator
Integration test reportCommit: 270275e
Top 6 slowest tests (at least 2 minutes):
|
pietern
approved these changes
Nov 3, 2026
janniklasrose
deleted the
janniklasrose/stop-warning-and-erroring-on-grant-privilege-enum
branch
November 3, 2026 15:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
The platform accepts grant privileges that the SDK's
catalog.Privilegeenum does not yet list (e.g.CREATE_SECRET, see #6770). The enum values flow from the OpenAPI spec into the SDK and from there into two CLI consumers, both of which rejected platform-valid values:bundle validatewarned, and--stricterrored, because the enum validation allowlist (bundle/internal/validation/generated/enum_fields.go) is reflected from the SDK'sValues().class Privilege(Enum)and_transformraisedValueErroron unknown strings.This PR relaxes both while keeping the enum (and completion) in the JSON schema and PyDABs:
bundle/internal/validation/enum.go: excludecatalog.Privilegefrom the generator, so noresources.*.grants[*].privileges[*]pattern is checked. Regenerated with./task generate-validation; the diff is exactly the 10 privilege entries.python/codegen/codegen/generated_enum.py: newOPEN_ENUMS = {"catalog.Privilege"}. Open enums are generated with a_missing_hook that turns unknown strings into pseudo-members cached in_value2member_map_(the stdlibFlagpattern, so identity/equality andfrom_dict→as_dictround-trips hold), andPrivilegeParamgains| strso the dict form type-checks for unknown values.main.pyfails if anOPEN_ENUMSkey is not a known schema. Regenerated with./task pydabs-codegen; the diff is exactly the 10*/_models/privilege.pymodules.Deploy was never affected:
catalog.Privilegeistype Privilege stringin Go, so unknown values already passed through both engines.Why not wait for an SDK bump?
The allowlist is only as current as the SDK, which lags the platform by design. Privileges are an area where the platform adds values frequently, so an SDK bump fixes today's gap and reopens tomorrow's. Dropping the client-side check for this one field removes the recurring breakage; the general enum validation stays in place for everything else.
Tests
acceptance/bundle/validate/enum: added a schema grant withINVALID_PRIVILEGE; the regenerated output shows no warning for it while the other enum warnings still fire.python/codegen/codegen_tests/test_generated_enum.py: open vs closed enum code generation.python/databricks_tests/core/test_open_enum.py: known value, unknown value accepted, cached identity, non-string rejected, dict round-trip.pyrightclean, Sphinx docs build with-W.This pull request and its description were written by Isaac.