Add custom scopes support in OAuth authentication methods

config/config.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"reflect"
+	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -63,6 +64,8 @@ const (
 	InvalidConfig ConfigType = "INVALID_CONFIG"
 )
 
+var defaultScopes = []string{"all-apis"}
+
 // Config represents configuration for Databricks Connectivity
 type Config struct {
 	// Credentials holds an instance of Credentials Strategy to authenticate with Databricks REST APIs.
@@ -135,6 +138,27 @@ type Config struct {
 	ClientID     string `name:"client_id" env:"DATABRICKS_CLIENT_ID" auth:"oauth" auth_types:"oauth-m2m"`
 	ClientSecret string `name:"client_secret" env:"DATABRICKS_CLIENT_SECRET" auth:"oauth,sensitive" auth_types:"oauth-m2m"`
 
+	// WARNING: This feature is still in development and may not work as expected.
+	//
+	// WARNING: Scopes support is EXPERIMENTAL and we don't guarantee backward
+	// compatibility for this feature. Don't use this in production workloads.
+	//
+	// Scopes is a list of OAuth scopes to request when authenticating.
+	// If not specified, defaults to ["all-apis"] for backwards compatibility.
+	// For U2M authentication, "offline_access" is automatically appended to
+	// include a refresh token (disable via DisableOAuthRefreshToken).
+	//
+	// Note: Setting scopes via environment variables is not supported.
+	// Note: The slice is sorted in-place during config resolution.
+	// Note: U2M flow's token cache does not support scopes yet.
+	Scopes []string `name:"scopes" auth:"-"`
+
+	// DisableOAuthRefreshToken controls whether the offline_access scope is requested
+	// during U2M OAuth authentication.
+	// offline_access is requested by default, causing a refresh token to be included
+	// in the OAuth token.
+	DisableOAuthRefreshToken bool `name:"disable_oauth_refresh_token" env:"DATABRICKS_DISABLE_OAUTH_REFRESH_TOKEN" auth:"-"`
+
 	// Path to the Databricks CLI (version >= 0.100.0).
 	DatabricksCliPath string `name:"databricks_cli_path" env:"DATABRICKS_CLI_PATH" auth_types:"databricks-cli"`
 
@@ -445,6 +469,11 @@ func (c *Config) EnsureResolved() error {
 			},
 		}
 	}
+	// Sort scopes in-place for better de-duplication in the refresh token cache,
+	// once scopes are supported in its cache key.
+	if len(c.Scopes) > 0 {
+		sort.Strings(c.Scopes)
+	}
 	c.resolved = true
 	return nil
 }
@@ -460,6 +489,13 @@ func (c *Config) CanonicalHostName() string {
 	return c.Host
 }
 
+func (c *Config) GetScopes() []string {
+	if len(c.Scopes) == 0 {
+		return defaultScopes
+	}
+	return c.Scopes
+}
+
 func (c *Config) wrapDebug(err error) error {
 	debug := ConfigAttributes.DebugString(c)
 	if debug == "" {

config/config_attribute.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"reflect"
 	"strconv"
+	"strings"
 )
 
 type Source struct {
@@ -69,6 +70,16 @@ func (a *ConfigAttribute) SetS(cfg *Config, v string) error {
 			return err
 		}
 		return a.Set(cfg, vv)
+	case reflect.Slice:
+		rawParts := strings.Split(v, ",")
+		var parts []string
+		for _, part := range rawParts {
+			trimmed := strings.TrimSpace(part)
+			if trimmed != "" {
+				parts = append(parts, trimmed)
+			}
+		}
+		return a.Set(cfg, parts)
 	default:
 		return fmt.Errorf("cannot set %s of unknown type %s",
 			a.Name, reflectKind(a.Kind))
@@ -85,6 +96,8 @@ func (a *ConfigAttribute) Set(cfg *Config, i interface{}) error {
 		field.SetBool(i.(bool))
 	case reflect.Int:
 		field.SetInt(int64(i.(int)))
+	case reflect.Slice:
+		field.Set(reflect.ValueOf(i.([]string)))
 	default:
 		// must extensively test with providerFixture to avoid this one
 		return fmt.Errorf("cannot set %s of unknown type %s", a.Name, reflectKind(a.Kind))

config/config_file_test.go

@@ -3,6 +3,8 @@ package config
 import (
 	"testing"
 
+	"github.com/databricks/databricks-sdk-go/internal/env"
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -22,3 +24,43 @@ func TestConfigFileLoad(t *testing.T) {
 		assert.Equal(t, "%Y#X$Z", section.Key("password").String())
 	}
 }
+
+func TestConfigFile_Scopes(t *testing.T) {
+	tests := []struct {
+		name     string
+		profile  string
+		expected []string
+	}{
+		{
+			name:     "empty defaults to all-apis",
+			profile:  "scope-empty",
+			expected: []string{"all-apis"},
+		},
+		{
+			name:     "single scope",
+			profile:  "scope-single",
+			expected: []string{"clusters"},
+		},
+		{
+			name:     "multiple scopes sorted",
+			profile:  "scope-multiple",
+			expected: []string{"clusters", "files:read", "iam:read", "jobs", "mlflow", "model-serving", "pipelines"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			env.CleanupEnvironment(t)
+			t.Setenv("HOME", "testdata")
+
+			cfg := &Config{Profile: tt.profile}
+			err := cfg.EnsureResolved()
+			if err != nil {
+				t.Fatalf("EnsureResolved failed: %v", err)
+			}
+			if diff := cmp.Diff(tt.expected, cfg.GetScopes()); diff != "" {
+				t.Errorf("GetScopes mismatch (-expected +actual):\n%s", diff)
+			}
+		})
+	}
+}

config/testdata/.databrickscfg

@@ -54,3 +54,14 @@ password = '%Y#X$Z' # comment
 host = https://dbc-XXXXXXXX-YYYY.cloud.databricks.com/
 username = abc
 password = %Y#X$Z # comment
+
+[scope-empty]
+host = https://example.cloud.databricks.com
+
+[scope-single]
+host = https://example.cloud.databricks.com
+scopes = clusters
+
+[scope-multiple]
+host = https://example.cloud.databricks.com
+scopes = clusters, jobs, pipelines, iam:read, files:read, mlflow, model-serving