fix(kernel): forward redirect_ports list to kernel U2M (PECOBLR-4144)

databricks-sql-kernel #257 landed: the pyo3 Session now takes
redirect_ports (a list) and no longer accepts the single redirect_port
kwarg. Update the kernel auth bridge to emit redirect_ports for
databricks-oauth U2M, forwarding the databricks-sql-python app's FULL
registered port list (PYSQL_OAUTH_REDIRECT_PORT_RANGE, 8020-8024) so the
kernel binds the first free port — busy-port fallback, matching the
Thrift DatabricksOAuthProvider. A custom client_id + explicit port pins
that single port ([port]).

Bump KERNEL_REV to the merged #257 commit (45a0d6a) so kernel-e2e builds
against the kernel that exposes redirect_ports. Tests updated.

Co-authored-by: Isaac
Signed-off-by: eric-wang-1990 <e.wang@databricks.com>

Author: eric-wang-1990

KERNEL_REV

@@ -1 +1 @@
-eff8950428f4e6cc9975c663ec919f334962f7d0
+45a0d6ae1de2f203220913ba96c994ebb2d7aae4

src/databricks/sql/backend/kernel/auth_bridge.py

@@ -17,7 +17,7 @@
   provider.
 - **OAuth U2M** — for ``auth_type`` ``databricks-oauth`` (the browser
   authorization-code flow), the connector's ``databricks-sql-python``
-  app bundle (``client_id`` + ``redirect_port``, with the optional
+  app bundle (``client_id`` + ``redirect_ports`` list, with the optional
   ``oauth_client_id`` / ``oauth_redirect_port`` overriding it) is
   forwarded to the kernel's ``auth_type='oauth-u2m'`` and the kernel
   runs the browser flow itself. ``azure-oauth`` (Azure AD) is **not yet
@@ -162,7 +162,7 @@ def kernel_auth_kwargs(
        ``AccessTokenAuthProvider`` → extract the bearer token.
     3. **OAuth U2M** — ``auth_type`` is ``databricks-oauth`` → forward the
        connector's coupled ``databricks-sql-python`` bundle (``client_id``
-       + ``redirect_port``, defaulting scopes to ``PYSQL_OAUTH_SCOPES``
+       + ``redirect_ports`` list, defaulting scopes to ``PYSQL_OAUTH_SCOPES``
        when the caller supplies none) to the kernel's ``oauth-u2m``, so a
        bare U2M connection authenticates as ``databricks-sql-python`` —
        forwarding the connector's own OAuth app rather than the kernel's
@@ -255,15 +255,15 @@ def kernel_auth_kwargs(
     #    Only databricks-oauth reaches here (azure-oauth rejected up front).
     #    Forward the connector's own databricks-sql-python bundle instead of
     #    the kernel's databricks-sql-connector default, for parity with the
-    #    Thrift path. client_id + redirect_port are coupled per app (each
-    #    registers its own redirect URI): a caller port only overrides the
+    #    Thrift path. client_id + redirect ports are coupled per app (each
+    #    registers its own redirect URIs): a caller port only overrides the
     #    default when an explicit client_id is also supplied. A caller may
     #    override oauth_scopes; absent one we forward PYSQL_OAUTH_SCOPES as
-    #    the default. NB: the kernel's redirect_port is a single int, so
-    #    unlike the Thrift path (which hands DatabricksOAuthProvider the full
-    #    PYSQL_OAUTH_REDIRECT_PORT_RANGE and retries the next port when one is
-    #    bound) this path forwards only one port with no fallback. A caller
-    #    hitting a port collision must pass oauth_redirect_port explicitly.
+    #    the default. We forward the FULL PYSQL_OAUTH_REDIRECT_PORT_RANGE as
+    #    ``redirect_ports`` so the kernel binds the first free port (busy-port
+    #    fallback), mirroring the Thrift DatabricksOAuthProvider which retries
+    #    the next port when one is bound. A caller overriding client_id
+    #    supplies its own single registered port.
     if auth_type == "databricks-oauth":
         redirect_port = opts.get("oauth_redirect_port")
         # Honor a caller-supplied oauth_scopes (normalized to a list of
@@ -272,10 +272,10 @@ def kernel_auth_kwargs(
         kwargs = {
             "auth_type": "oauth-u2m",
             "client_id": client_id or PYSQL_OAUTH_CLIENT_ID,
-            "redirect_port": (
-                _coerce_redirect_port(redirect_port)
+            "redirect_ports": (
+                [_coerce_redirect_port(redirect_port)]
                 if client_id and redirect_port is not None
-                else PYSQL_OAUTH_REDIRECT_PORT_RANGE[0]
+                else list(PYSQL_OAUTH_REDIRECT_PORT_RANGE)
             ),
             "oauth_scopes": scopes if scopes is not None else list(PYSQL_OAUTH_SCOPES),
         }

tests/unit/test_kernel_auth_bridge.py

@@ -251,8 +251,9 @@ class TestKernelOAuthU2M:
     The kernel core default U2M app is ``databricks-sql-connector`` /
     ``sql offline_access`` / port 8030 (see PECOBLR-4039). The Python
     connector is an OVERRIDE: on the kernel path it forwards its OWN
-    coupled ``client_id`` + ``redirect_port`` bundle so it authenticates
-    as ``databricks-sql-python`` rather than the kernel default. A caller
+    coupled ``client_id`` + ``redirect_ports`` bundle (the full registered
+    port list, for busy-port fallback) so it authenticates as
+    ``databricks-sql-python`` rather than the kernel default. A caller
     may override ``oauth_scopes``; absent one, ``PYSQL_OAUTH_SCOPES`` is
     forwarded as the default.
 
@@ -271,7 +272,8 @@ def test_bare_databricks_oauth_forwards_full_python_bundle(self):
         assert kwargs == {
             "auth_type": "oauth-u2m",
             "client_id": PYSQL_OAUTH_CLIENT_ID,
-            "redirect_port": PYSQL_OAUTH_REDIRECT_PORT_RANGE[0],
+            # Full registered port list → the kernel binds the first free one.
+            "redirect_ports": list(PYSQL_OAUTH_REDIRECT_PORT_RANGE),
             "oauth_scopes": list(PYSQL_OAUTH_SCOPES),
         }
 
@@ -294,8 +296,9 @@ def test_azure_oauth_not_supported(self, opts):
             kernel_auth_kwargs(_FakeOAuthProvider(), opts)
 
     def test_u2m_custom_client_id_port_and_scopes_honored(self):
-        # A caller may override the coupled client_id + redirect_port and
-        # the oauth_scopes. All three are forwarded as supplied.
+        # A caller may override the coupled client_id + redirect port and the
+        # oauth_scopes. The single custom port is forwarded as a one-element
+        # redirect_ports list; all three are forwarded as supplied.
         kwargs = kernel_auth_kwargs(
             _FakeOAuthProvider(),
             {
@@ -308,14 +311,14 @@ def test_u2m_custom_client_id_port_and_scopes_honored(self):
         assert kwargs == {
             "auth_type": "oauth-u2m",
             "client_id": "custom-client",
-            "redirect_port": 9999,
+            "redirect_ports": [9999],
             "oauth_scopes": ["custom-scope", "offline_access"],
         }
 
     def test_u2m_custom_client_id_only_falls_back_to_connector_defaults(self):
         # A custom client_id without explicit scopes/port fills the
         # remaining two from the connector defaults — a custom client_id
-        # still uses PYSQL_OAUTH_SCOPES and the default redirect-port range.
+        # still uses PYSQL_OAUTH_SCOPES and the default redirect-port list.
         kwargs = kernel_auth_kwargs(
             _FakeOAuthProvider(),
             {
@@ -326,7 +329,7 @@ def test_u2m_custom_client_id_only_falls_back_to_connector_defaults(self):
         assert kwargs == {
             "auth_type": "oauth-u2m",
             "client_id": "custom-client",
-            "redirect_port": PYSQL_OAUTH_REDIRECT_PORT_RANGE[0],
+            "redirect_ports": list(PYSQL_OAUTH_REDIRECT_PORT_RANGE),
             "oauth_scopes": list(PYSQL_OAUTH_SCOPES),
         }
 
@@ -343,8 +346,8 @@ def test_u2m_redirect_port_coerced_to_int(self):
                 "oauth_redirect_port": "8021",
             },
         )
-        assert kwargs["redirect_port"] == 8021
-        assert isinstance(kwargs["redirect_port"], int)
+        assert kwargs["redirect_ports"] == [8021]
+        assert isinstance(kwargs["redirect_ports"][0], int)
 
     def test_u2m_redirect_port_non_numeric_raises_programming_error(self):
         # A garbled oauth_redirect_port is a caller error of the same class
@@ -362,18 +365,17 @@ def test_u2m_redirect_port_non_numeric_raises_programming_error(self):
             )
 
     def test_u2m_redirect_port_ignored_without_client_id(self):
-        # A bare oauth_redirect_port (no explicit client_id) must NOT be
-        # forwarded: it would be paired with the default databricks-sql-python
-        # app, whose registered redirect URIs only cover the default port
-        # range, so an arbitrary port would resolve to an unregistered URI
-        # and fail the U2M flow. This mirrors the Thrift path's coupling,
-        # where oauth_redirect_port_range is only overridden when both
+        # A bare oauth_redirect_port (no explicit client_id) must NOT replace
+        # the default list: it would be paired with the default
+        # databricks-sql-python app, so we keep forwarding that app's full
+        # registered port list. This mirrors the Thrift path's coupling, where
+        # oauth_redirect_port_range is only overridden when both
         # oauth_client_id and oauth_redirect_port are supplied.
         kwargs = kernel_auth_kwargs(
             _FakeOAuthProvider(),
             {"auth_type": "databricks-oauth", "oauth_redirect_port": 9999},
         )
-        assert kwargs["redirect_port"] == PYSQL_OAUTH_REDIRECT_PORT_RANGE[0]
+        assert kwargs["redirect_ports"] == list(PYSQL_OAUTH_REDIRECT_PORT_RANGE)
 
     def test_u2m_honors_custom_scopes(self):
         # A caller-supplied oauth_scopes is forwarded to the kernel, even