Modify permissions to use SDK types where available#4686
Open
Modify permissions to use SDK types where available#4686
Conversation
denik
requested review from
andrewnester,
anton-107,
pietern,
shreyas-goenka and
simonfaltum
as code owners
denik
added a commit
that referenced
this pull request
Mar 9, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
denik
changed the title
Collaborator
|
Commit: 1f1ae53
21 interesting tests: 7 SKIP, 7 RECOVERED, 5 flaky, 2 FAIL
Top 19 slowest tests (at least 2 minutes):
|
denik
added a commit
that referenced
this pull request
Mar 10, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
denik
force-pushed
the
denik/simpler-permissions
branch
from
a39e224 to
04f0df6
Compare
Analogous to simpler-grant: replace 12 resource-specific permission types with iam.AccessControlRequest from the SDK directly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove 12 per-resource permission structs (JobPermission, PipelinePermission, etc.) and corresponding PermissionLevel enum types in favor of shared resources.Permission - Remove IPermission interface and reflection-based dispatch in dresources/permissions.go - Replace with static permissionResourceToObjectType map and direct type assertion - Update annotations.yml and annotations_openapi_overrides.yml to remove obsolete entries - Regenerate JSON schema - Add backward-compat aliases (JobPermission, PipelinePermission, etc.) in Python __init__.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move jobs/pipelines permission aliases from packages.EXTRA_ALIASES to aliases_patch.ALIASES, consistent with how grant aliases are handled. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JobPermissionLevel = str and PipelinePermissionLevel = str preserve the exported names while reflecting that levels are now plain strings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the generic `[]resources.Permission[iam.PermissionLevel]` with per-resource typed `resources.Permissions[L]` using the SDK's own enum types (e.g. `jobs.JobPermissionLevel`, `pipelines.PipelinePermissionLevel`, etc.). This provides type safety and IDE autocomplete for valid permission levels per resource. A `PermissionsSlice` interface enables type-agnostic conversion to `iam.AccessControlRequest` without reflection. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ypes Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ermission Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
denik
force-pushed
the
denik/simpler-permissions
branch
from
294d6c4 to
c622af0
Compare
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
denik
changed the title
…mize diff Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ython codegen Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The spec is already flat with dotted keys; no logic changes needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kanterov
approved these changes
Mar 10, 2026
Collaborator
kanterov
left a comment
kanterov
left a comment
There was a problem hiding this comment.
//python/... LGTM
Other code I didn't check
|
|
||
| ### Bundles | ||
| * Modify grants to use SDK types ([#4666](https://github.com/databricks/cli/pull/4666)) | ||
| * Modify permissions to use SDK types where available ([#4686](https://github.com/databricks/cli/pull/4686)) |
Collaborator
There was a problem hiding this comment.
Is this a user-visible change now? We can clarify that we re-ordered Python enums
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not.
Why
Simplification. Supports autogeneration of resource, no need to manually provide allowed levels.
Similar change for grants: #4666