Invalidate cached OAuth tokens when profiles change

[mihaimitrea-db]

Changes

Store a fingerprint of the complete saved profile with cached OAuth credentials and validate it before token reuse or refresh. Legacy tokens without fingerprint metadata require one new login.

Why

Cached OAuth grants can become inconsistent with manually edited profile configuration. Failing closed prevents a token minted for one profile configuration from being reused with another.

Tests

• GOWORK=off ./task checks
• Full Go lint: zero issues
• Full unit suite: 9,497 tests passed
• Targeted profile-change and legacy-token acceptance tests passed with both deployment engines
• Full acceptance was blocked locally because jq 1.6 is installed and the suite requires jq 1.7
• Python formatting and lint were blocked because Ruff could not be downloaded due PyPI DNS failure; the new helper passed Python syntax validation

[eng-dev-ecosystem-bot]

Integration test report

Commit: edc6045

Run: 33187320964

	Env	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux	1	1	274	1209	4:12
💚​	aws windows	1	1	276	1207	3:56
💚​	azure linux	1	1	273	1209	4:27
💚​	azure windows	1	1	275	1207	4:00
💚​	gcp linux	1	1	274	1209	4:34
💚​	gcp windows	1	1	276	1207	3:43

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
3:55	azure windows	TestAccept
3:51	aws windows	TestAccept
3:38	gcp windows	TestAccept

[github-actions]

Approval status: pending

/cmd/auth/ - needs approval

5 files changed
Suggested: @simonfaltum
Also eligible: @renaudhartert-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @chrisst, @rauchy

/cmd/root/ - needs approval

Files: cmd/root/auth_test.go
Suggested: @simonfaltum
Also eligible: @renaudhartert-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @chrisst, @rauchy

/libs/auth/ - needs approval

9 files changed
Suggested: @simonfaltum
Also eligible: @renaudhartert-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @chrisst, @rauchy

/libs/databrickscfg/ - needs approval

5 files changed
Suggested: @simonfaltum
Also eligible: @renaudhartert-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @chrisst, @rauchy

General files (require maintainer)

12 files changed
Based on git history:

• @simonfaltum -- recent work in cmd/auth/, libs/auth/storage/, libs/databrickscfg/profile/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @lennartkats-db, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}