feat(cli): add --support flag for DataHub Cloud support team login

Adds `--support` flag (used with `--sso`) that navigates to
`/support/authenticate` instead of `/authenticate`, enabling the
support team to log into customer instances for debugging.

Usage: datahub init --sso --support --host https://customer.acryl.io/gms

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

metadata-ingestion/src/datahub/cli/resources/INIT_AGENT_CONTEXT.md

@@ -70,6 +70,17 @@ playwright install chromium
 `--sso` is mutually exclusive with `--token`, `--username`, and `--password`.
 If Playwright is not installed, the command prints step-by-step install instructions and exits.
 
+### Support login (DataHub Cloud)
+
+For the support team debugging customer instances, add `--support` to use the
+`/support/authenticate` login path:
+
+```bash
+datahub init --sso --support --host https://customer.acryl.io/gms
+```
+
+`--support` requires `--sso`.
+
 ## Environment variables
 
 | Variable            | CLI equivalent |

metadata-ingestion/src/datahub/cli/sso_cli.py

@@ -34,14 +34,19 @@ def _check_playwright_ready() -> None:
 
 
 def browser_sso_login(
-    frontend_url: str, token_duration: str, timeout_ms: int = 120_000
+    frontend_url: str,
+    token_duration: str,
+    timeout_ms: int = 120_000,
+    support: bool = False,
 ) -> Tuple[str, str]:
     """Open browser for SSO login, extract session, generate access token.
 
     Args:
         frontend_url: The DataHub frontend URL (e.g. http://localhost:9002).
         token_duration: Token validity duration (e.g. ONE_HOUR).
         timeout_ms: How long to wait for SSO login to complete, in milliseconds.
+        support: If True, use /support/authenticate path for DataHub Cloud
+            support team access to customer instances.
 
     Returns:
         Tuple of (token_name, access_token).
@@ -53,15 +58,19 @@ def browser_sso_login(
 
     from playwright.sync_api import sync_playwright
 
-    click.echo("Opening browser for SSO login...")
+    auth_path = "/support/authenticate" if support else "/authenticate"
+    if support:
+        click.echo("Opening browser for support SSO login...")
+    else:
+        click.echo("Opening browser for SSO login...")
     click.echo("Complete the login in your browser.\n")
 
     with sync_playwright() as p:
         browser = p.chromium.launch(headless=False)
         context = browser.new_context()
         page = context.new_page()
 
-        page.goto(f"{frontend_url}/authenticate")
+        page.goto(f"{frontend_url}{auth_path}")
 
         # Wait for the actor cookie, which signals successful SSO login.
         actor_urn = None

metadata-ingestion/src/datahub/entrypoints.py

@@ -280,6 +280,12 @@ def _validate_init_inputs(
     default=False,
     help="Open browser for SSO login (requires: pip install 'acryl-datahub[sso]' && playwright install chromium)",
 )
+@click.option(
+    "--support",
+    is_flag=True,
+    default=False,
+    help="Use support login path for DataHub Cloud customer debugging (use with --sso)",
+)
 @click.option(
     "--agent-context",
     is_flag=True,
@@ -295,6 +301,7 @@ def init(
     token_duration: Optional[str] = None,
     force: bool = False,
     sso: bool = False,
+    support: bool = False,
     agent_context: bool = False,
 ) -> None:
     """Configure which DataHub instance to connect to.
@@ -329,6 +336,11 @@ def init(
         datahub init --sso --host https://example.com/gms \\
             --token-duration ONE_MONTH
 
+    \b
+    Support Login (DataHub Cloud — customer debugging):
+        datahub init --sso --support \\
+            --host https://customer.acryl.io/gms
+
     \b
     Environment Variables (for automation):
         export DATAHUB_GMS_URL=http://localhost:8080
@@ -356,6 +368,10 @@ def init(
         click.echo(text)
         return
 
+    # Validate: --support requires --sso
+    if support and not sso:
+        raise click.UsageError("--support requires --sso")
+
     # Show deprecation warning if --use-password used
     if use_password:
         click.echo(
@@ -417,7 +433,9 @@ def init(
         from datahub.cli.sso_cli import browser_sso_login
 
         frontend_url = guess_frontend_url_from_gms_url(host_value)
-        _, token_value = browser_sso_login(frontend_url, effective_duration)
+        _, token_value = browser_sso_login(
+            frontend_url, effective_duration, support=support
+        )
         click.echo(f"✓ Generated token (expires: {effective_duration})")
     elif should_generate_token or use_password:
         # Generate token from credentials

metadata-ingestion/tests/unit/cli/test_init_cli.py

@@ -635,7 +635,9 @@ def test_sso_calls_browser_login_and_writes_config(
         assert "localhost:8080" in config_content
 
         # Verify frontend URL derivation: 8080 -> 9002
-        mock_browser_login.assert_called_once_with("http://localhost:9002", "ONE_MONTH")
+        mock_browser_login.assert_called_once_with(
+            "http://localhost:9002", "ONE_MONTH", support=False
+        )
 
     def test_sso_with_custom_duration(self, temp_config: Path, clean_env: None) -> None:
         """Test --sso respects --token-duration."""
@@ -654,7 +656,9 @@ def test_sso_with_custom_duration(self, temp_config: Path, clean_env: None) -> N
             )
 
         assert result.exit_code == 0
-        mock_browser_login.assert_called_once_with("http://localhost:9002", "ONE_MONTH")
+        mock_browser_login.assert_called_once_with(
+            "http://localhost:9002", "ONE_MONTH", support=False
+        )
 
     def test_sso_with_acryl_cloud_url(self, temp_config: Path, clean_env: None) -> None:
         """Test --sso with Acryl Cloud URL derives correct frontend URL."""
@@ -673,9 +677,47 @@ def test_sso_with_acryl_cloud_url(self, temp_config: Path, clean_env: None) -> N
         assert result.exit_code == 0
         # For acryl.io, frontend URL is the base without /gms
         mock_browser_login.assert_called_once_with(
-            "https://my-instance.acryl.io", "ONE_HOUR"
+            "https://my-instance.acryl.io", "ONE_HOUR", support=False
         )
 
+    def test_sso_support_flag(self, temp_config: Path, clean_env: None) -> None:
+        """Test --sso --support passes support=True to browser_sso_login."""
+        runner = CliRunner()
+        with patch("datahub.cli.sso_cli.browser_sso_login") as mock_browser_login:
+            mock_browser_login.return_value = ("name", "token-value")
+            result = runner.invoke(
+                init,
+                [
+                    "--sso",
+                    "--support",
+                    "--host",
+                    "https://customer.acryl.io/gms",
+                ],
+            )
+
+        assert result.exit_code == 0
+        mock_browser_login.assert_called_once_with(
+            "https://customer.acryl.io", "ONE_HOUR", support=True
+        )
+
+    def test_support_without_sso_errors(
+        self, temp_config: Path, clean_env: None
+    ) -> None:
+        """Test --support without --sso raises an error."""
+        runner = CliRunner()
+        result = runner.invoke(
+            init,
+            [
+                "--support",
+                "--host",
+                "http://localhost:8080",
+                "--token",
+                "my-token",
+            ],
+        )
+        assert result.exit_code != 0
+        assert "--support requires --sso" in result.output
+
 
 class TestTokenDuration:
     """Tests for configurable token duration."""