Skip to content

Modify permissions to use SDK types where available #4686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
denik merged 29 commits into from
Mar 11, 2026
Merged

Modify permissions to use SDK types where available #4686

Show file tree
Hide file tree
Changes from 27 commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
27fe479
Add plan for simplifying permissions types
denik Mar 6, 2026
858a559
Replace per-resource permission types with shared Permission type
denik Mar 6, 2026
26c9f1d
Use aliases_patch.py for backward-compat permission aliases
denik Mar 6, 2026
4b19872
rm settings.local
denik Mar 9, 2026
a8221a8
update jsonschema_for_docs.json
denik Mar 9, 2026
d980f7a
rm PLAN
denik Mar 9, 2026
9314ddd
Add backward-compat aliases for *PermissionLevel types in Python
denik Mar 9, 2026
61b08e8
Add NEXT_CHANGELOG entry for #4686
denik Mar 9, 2026
0b214a4
Use resource-specific SDK permission level types for bundle resources
denik Mar 9, 2026
d0569b5
undo yaml
denik Mar 9, 2026
15367de
Define named non-generic permission types for each resource
denik Mar 10, 2026
5ff1674
rm settings
denik Mar 10, 2026
300c081
Use IamPermission for generic iam.PermissionLevel; drop named slice t…
denik Mar 10, 2026
e493014
Replace resources.Permission[iam.PermissionLevel] with resources.IamP…
denik Mar 10, 2026
b824f3c
Fix exhaustruct lint: add ForceSendFields to AccessControlRequest
denik Mar 10, 2026
660aef2
Fix toAccessControlRequests to dereference pointer-to-slice
denik Mar 10, 2026
419012d
update refschema
denik Mar 10, 2026
c622af0
Restore formatting and revert unrelated ssh changes
denik Mar 10, 2026
79441e2
Remove unused ToAccessControlRequest methods and wrapper boilerplate
denik Mar 10, 2026
7731212
Rename Permission -> PermissionT, IamPermission -> Permission to mini…
denik Mar 10, 2026
adfb3a0
Remove accidentally committed files
denik Mar 10, 2026
71f5667
Update annotations.yml for Permission rename
denik Mar 10, 2026
b26d2aa
Regenerate schema after Permission rename
denik Mar 10, 2026
5a7137c
Restore descriptions for resources.Permission in annotations
denik Mar 10, 2026
d82dc72
update next changelog
denik Mar 10, 2026
bff60d4
Remove unnecessary Permission aliases and clean up _flatten_spec in P…
denik Mar 10, 2026
1f1ae53
Revert unnecessary Python codegen changes
denik Mar 10, 2026
9260735
add NEXT_CHANGELOG
denik Mar 11, 2026
c16028d
Merge branch 'main' into denik/simpler-permissions
denik Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions NEXT_CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

### Bundles
* Modify grants to use SDK types ([#4666](https://github.com/databricks/cli/pull/4666))
* Modify permissions to use SDK types where available ([#4686](https://github.com/databricks/cli/pull/4686))

@kanterov kanterov Mar 10, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this a user-visible change now? We can clarify that we re-ordered Python enums


### Dependency updates
- Bump databricks-sdk-go from v0.112.0 to v0.117.0.
Expand Down
40 changes: 20 additions & 20 deletions acceptance/bundle/refschema/out.fields.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,10 @@ resources.alerts.*.lifecycle_state sql.AlertLifecycleState ALL
resources.alerts.*.modified_status string INPUT
resources.alerts.*.owner_user_name string ALL
resources.alerts.*.parent_path string ALL
resources.alerts.*.permissions []resources.AlertPermission INPUT
resources.alerts.*.permissions[*] resources.AlertPermission INPUT
resources.alerts.*.permissions []resources.Permission INPUT
resources.alerts.*.permissions[*] resources.Permission INPUT
resources.alerts.*.permissions[*].group_name string INPUT
resources.alerts.*.permissions[*].level resources.AlertPermissionLevel INPUT
resources.alerts.*.permissions[*].level iam.PermissionLevel INPUT
resources.alerts.*.permissions[*].service_principal_name string INPUT
resources.alerts.*.permissions[*].user_name string INPUT
resources.alerts.*.query_text string ALL
Expand Down Expand Up @@ -166,7 +166,7 @@ resources.apps.*.pending_deployment.update_time string ALL
resources.apps.*.permissions []resources.AppPermission INPUT
resources.apps.*.permissions[*] resources.AppPermission INPUT
resources.apps.*.permissions[*].group_name string INPUT
resources.apps.*.permissions[*].level resources.AppPermissionLevel INPUT
resources.apps.*.permissions[*].level apps.AppPermissionLevel INPUT
resources.apps.*.permissions[*].service_principal_name string INPUT
resources.apps.*.permissions[*].user_name string INPUT
resources.apps.*.resources []apps.AppResource ALL
Expand Down Expand Up @@ -397,7 +397,7 @@ resources.clusters.*.num_workers int ALL
resources.clusters.*.permissions []resources.ClusterPermission INPUT
resources.clusters.*.permissions[*] resources.ClusterPermission INPUT
resources.clusters.*.permissions[*].group_name string INPUT
resources.clusters.*.permissions[*].level resources.ClusterPermissionLevel INPUT
resources.clusters.*.permissions[*].level compute.ClusterPermissionLevel INPUT
resources.clusters.*.permissions[*].service_principal_name string INPUT
resources.clusters.*.permissions[*].user_name string INPUT
resources.clusters.*.policy_id string ALL
Expand Down Expand Up @@ -561,10 +561,10 @@ resources.dashboards.*.lifecycle_state dashboards.LifecycleState ALL
resources.dashboards.*.modified_status string INPUT
resources.dashboards.*.parent_path string ALL
resources.dashboards.*.path string ALL
resources.dashboards.*.permissions []resources.DashboardPermission INPUT
resources.dashboards.*.permissions[*] resources.DashboardPermission INPUT
resources.dashboards.*.permissions []resources.Permission INPUT
resources.dashboards.*.permissions[*] resources.Permission INPUT
resources.dashboards.*.permissions[*].group_name string INPUT
resources.dashboards.*.permissions[*].level resources.DashboardPermissionLevel INPUT
resources.dashboards.*.permissions[*].level iam.PermissionLevel INPUT
resources.dashboards.*.permissions[*].service_principal_name string INPUT
resources.dashboards.*.permissions[*].user_name string INPUT
resources.dashboards.*.published bool REMOTE STATE
Expand Down Expand Up @@ -628,10 +628,10 @@ resources.database_instances.*.parent_instance_ref.effective_lsn string ALL
resources.database_instances.*.parent_instance_ref.lsn string ALL
resources.database_instances.*.parent_instance_ref.name string ALL
resources.database_instances.*.parent_instance_ref.uid string ALL
resources.database_instances.*.permissions []resources.DatabaseInstancePermission INPUT
resources.database_instances.*.permissions[*] resources.DatabaseInstancePermission INPUT
resources.database_instances.*.permissions []resources.Permission INPUT
resources.database_instances.*.permissions[*] resources.Permission INPUT
resources.database_instances.*.permissions[*].group_name string INPUT
resources.database_instances.*.permissions[*].level resources.DatabaseInstancePermissionLevel INPUT
resources.database_instances.*.permissions[*].level iam.PermissionLevel INPUT
resources.database_instances.*.permissions[*].service_principal_name string INPUT
resources.database_instances.*.permissions[*].user_name string INPUT
resources.database_instances.*.pg_version string ALL
Expand Down Expand Up @@ -663,7 +663,7 @@ resources.experiments.*.name string ALL
resources.experiments.*.permissions []resources.MlflowExperimentPermission INPUT
resources.experiments.*.permissions[*] resources.MlflowExperimentPermission INPUT
resources.experiments.*.permissions[*].group_name string INPUT
resources.experiments.*.permissions[*].level resources.MlflowExperimentPermissionLevel INPUT
resources.experiments.*.permissions[*].level ml.ExperimentPermissionLevel INPUT
resources.experiments.*.permissions[*].service_principal_name string INPUT
resources.experiments.*.permissions[*].user_name string INPUT
resources.experiments.*.tags []ml.ExperimentTag ALL
Expand Down Expand Up @@ -926,7 +926,7 @@ resources.jobs.*.performance_target jobs.PerformanceTarget ALL
resources.jobs.*.permissions []resources.JobPermission INPUT
resources.jobs.*.permissions[*] resources.JobPermission INPUT
resources.jobs.*.permissions[*].group_name string INPUT
resources.jobs.*.permissions[*].level resources.JobPermissionLevel INPUT
resources.jobs.*.permissions[*].level jobs.JobPermissionLevel INPUT
resources.jobs.*.permissions[*].service_principal_name string INPUT
resources.jobs.*.permissions[*].user_name string INPUT
resources.jobs.*.queue *jobs.QueueSettings ALL
Expand Down Expand Up @@ -2103,7 +2103,7 @@ resources.model_serving_endpoints.*.name string INPUT STATE
resources.model_serving_endpoints.*.permissions []resources.ModelServingEndpointPermission INPUT
resources.model_serving_endpoints.*.permissions[*] resources.ModelServingEndpointPermission INPUT
resources.model_serving_endpoints.*.permissions[*].group_name string INPUT
resources.model_serving_endpoints.*.permissions[*].level resources.ModelServingEndpointPermissionLevel INPUT
resources.model_serving_endpoints.*.permissions[*].level serving.ServingEndpointPermissionLevel INPUT
resources.model_serving_endpoints.*.permissions[*].service_principal_name string INPUT
resources.model_serving_endpoints.*.permissions[*].user_name string INPUT
resources.model_serving_endpoints.*.rate_limits []serving.RateLimit INPUT STATE
Expand Down Expand Up @@ -2154,7 +2154,7 @@ resources.models.*.permission_level ml.PermissionLevel REMOTE
resources.models.*.permissions []resources.MlflowModelPermission INPUT
resources.models.*.permissions[*] resources.MlflowModelPermission INPUT
resources.models.*.permissions[*].group_name string INPUT
resources.models.*.permissions[*].level resources.MlflowModelPermissionLevel INPUT
resources.models.*.permissions[*].level ml.RegisteredModelPermissionLevel INPUT
resources.models.*.permissions[*].service_principal_name string INPUT
resources.models.*.permissions[*].user_name string INPUT
resources.models.*.tags []ml.ModelTag ALL
Expand Down Expand Up @@ -2479,7 +2479,7 @@ resources.pipelines.*.notifications[*].email_recipients[*] string ALL
resources.pipelines.*.permissions []resources.PipelinePermission INPUT
resources.pipelines.*.permissions[*] resources.PipelinePermission INPUT
resources.pipelines.*.permissions[*].group_name string INPUT
resources.pipelines.*.permissions[*].level resources.PipelinePermissionLevel INPUT
resources.pipelines.*.permissions[*].level pipelines.PipelinePermissionLevel INPUT
resources.pipelines.*.permissions[*].service_principal_name string INPUT
resources.pipelines.*.permissions[*].user_name string INPUT
resources.pipelines.*.photon bool ALL
Expand Down Expand Up @@ -2634,10 +2634,10 @@ resources.postgres_projects.*.lifecycle resources.Lifecycle INPUT
resources.postgres_projects.*.lifecycle.prevent_destroy bool INPUT
resources.postgres_projects.*.modified_status string INPUT
resources.postgres_projects.*.name string REMOTE
resources.postgres_projects.*.permissions []resources.DatabaseProjectPermission INPUT
resources.postgres_projects.*.permissions[*] resources.DatabaseProjectPermission INPUT
resources.postgres_projects.*.permissions []resources.Permission INPUT
resources.postgres_projects.*.permissions[*] resources.Permission INPUT
resources.postgres_projects.*.permissions[*].group_name string INPUT
resources.postgres_projects.*.permissions[*].level resources.DatabaseProjectPermissionLevel INPUT
resources.postgres_projects.*.permissions[*].level iam.PermissionLevel INPUT
resources.postgres_projects.*.permissions[*].service_principal_name string INPUT
resources.postgres_projects.*.permissions[*].user_name string INPUT
resources.postgres_projects.*.pg_version int INPUT STATE
Expand Down Expand Up @@ -2884,7 +2884,7 @@ resources.sql_warehouses.*.odbc_params.protocol string REMOTE
resources.sql_warehouses.*.permissions []resources.SqlWarehousePermission INPUT
resources.sql_warehouses.*.permissions[*] resources.SqlWarehousePermission INPUT
resources.sql_warehouses.*.permissions[*].group_name string INPUT
resources.sql_warehouses.*.permissions[*].level resources.SqlWarehousePermissionLevel INPUT
resources.sql_warehouses.*.permissions[*].level sql.WarehousePermissionLevel INPUT
resources.sql_warehouses.*.permissions[*].service_principal_name string INPUT
resources.sql_warehouses.*.permissions[*].user_name string INPUT
resources.sql_warehouses.*.spot_instance_policy sql.SpotInstancePolicy ALL
Expand Down
7 changes: 4 additions & 3 deletions bundle/config/mutator/resourcemutator/apply_bundle_permissions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"github.com/databricks/cli/libs/diag"
"github.com/databricks/cli/libs/dyn"
"github.com/databricks/cli/libs/dyn/convert"
"github.com/databricks/databricks-sdk-go/service/iam"
)

var (
Expand Down Expand Up @@ -151,7 +152,7 @@ func (m *bundlePermissions) Apply(ctx context.Context, b *bundle.Bundle) diag.Di

func validatePermissions(b *bundle.Bundle) error {
for _, p := range b.Config.Permissions {
if !slices.Contains(allowedLevels, p.Level) {
if !slices.Contains(allowedLevels, string(p.Level)) {
return fmt.Errorf("invalid permission level: %s, allowed values: [%s]", p.Level, strings.Join(allowedLevels, ", "))
}
}
Expand All @@ -172,7 +173,7 @@ func convertPermissions(
) []resources.Permission {
var permissions []resources.Permission
for _, p := range bundlePermissions {
level, ok := lm[p.Level]
level, ok := lm[string(p.Level)]
// If there is no bundle permission level defined in the map, it means
// it's not applicable for the resource, therefore skipping
if !ok {
Expand All @@ -184,7 +185,7 @@ func convertPermissions(
}

permissions = append(permissions, resources.Permission{
Level: level,
Level: iam.PermissionLevel(level),
UserName: p.UserName,
GroupName: p.GroupName,
ServicePrincipalName: p.ServicePrincipalName,
Expand Down
4 changes: 2 additions & 2 deletions bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,8 +132,8 @@ func TestApplyBundlePermissions(t *testing.T) {
require.Contains(t, b.Config.Resources.ModelServingEndpoints["endpoint_2"].Permissions, resources.ModelServingEndpointPermission{Level: "CAN_QUERY", ServicePrincipalName: "TestServicePrincipal"})

require.Len(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, 2)
require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.DashboardPermission{Level: "CAN_MANAGE", UserName: "TestUser"})
require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.DashboardPermission{Level: "CAN_READ", GroupName: "TestGroup"})
require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.Permission{Level: "CAN_MANAGE", UserName: "TestUser"})
require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.Permission{Level: "CAN_READ", GroupName: "TestGroup"})

require.Len(t, b.Config.Resources.Apps["app_1"].Permissions, 2)
require.Contains(t, b.Config.Resources.Apps["app_1"].Permissions, resources.AppPermission{Level: "CAN_MANAGE", UserName: "TestUser"})
Expand Down
2 changes: 1 addition & 1 deletion bundle/config/mutator/resourcemutator/run_as.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ func setPipelineOwnersToRunAsIdentity(b *bundle.Bundle) {
(runAs.UserName != "" && p.UserName == runAs.UserName)
})
pipeline.Permissions = append(pipeline.Permissions, resources.PipelinePermission{
Level: "IS_OWNER",
Level: pipelines.PipelinePermissionLevelIsOwner,
ServicePrincipalName: runAs.ServicePrincipalName,
UserName: runAs.UserName,
})
Expand Down
2 changes: 1 addition & 1 deletion bundle/config/resources/alerts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ type Alert struct {
BaseResource
sql.AlertV2 //nolint AlertV2 also defines Id and URL field with the same json tag "id" and "url"

Permissions []AlertPermission `json:"permissions,omitempty"`
Permissions []Permission `json:"permissions,omitempty"`

// Filepath points to the local .dbalert.json file containing the alert definition.
// If specified, any fields that are part of the .dbalert.json file schema will not be allowed in
Expand Down
2 changes: 1 addition & 1 deletion bundle/config/resources/dashboard.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ type Dashboard struct {
BaseResource
DashboardConfig

Permissions []DashboardPermission `json:"permissions,omitempty"`
Permissions []Permission `json:"permissions,omitempty"`

// FilePath points to the local `.lvdash.json` file containing the dashboard definition.
// This is inlined into serialized_dashboard during deployment. The file_path is kept around
Expand Down
2 changes: 1 addition & 1 deletion bundle/config/resources/database_instance.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ type DatabaseInstance struct {
BaseResource
database.DatabaseInstance

Permissions []DatabaseInstancePermission `json:"permissions,omitempty"`
Permissions []Permission `json:"permissions,omitempty"`
}

func (d *DatabaseInstance) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
Expand Down
Loading