Skip to content

feat: add support for using CDP auth token directly#177

Merged
KaviarasuSakthivadivel merged 9 commits into
mainfrom
rlemma/support-cdp-auth
May 21, 2026
Merged

feat: add support for using CDP auth token directly#177
KaviarasuSakthivadivel merged 9 commits into
mainfrom
rlemma/support-cdp-auth

Conversation

@reblem

@reblem reblem commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

Adds support for using a CDP auth token directly instead of requiring a Core Salesforce token that must be exchanged for a CDP token. The CDP access token is accepted as a Bearer token via new cdpToken and tenantUrl connection properties, and validates the JWT eagerly.

@reblem reblem changed the title feat: add support for using CDP Auth Token directly feat: add support for using CDP auth token directly Apr 30, 2026
@codecov

codecov Bot commented Apr 30, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 82.27848% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.86%. Comparing base (9760106) to head (b723f14).

Files with missing lines Patch % Lines
...salesforce/datacloud/jdbc/DataCloudDatasource.java 44.44% 6 Missing and 4 partials ⚠️
...e/datacloud/jdbc/auth/DirectCdpTokenProcessor.java 92.72% 1 Missing and 3 partials ⚠️

❌ Your patch check has failed because the patch coverage (58.33%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files
@@             Coverage Diff              @@
##               main     #177      +/-   ##
============================================
+ Coverage     80.51%   80.86%   +0.35%     
- Complexity     1703     1728      +25     
============================================
  Files           122      123       +1     
  Lines          4941     5011      +70     
  Branches        520      528       +8     
============================================
+ Hits           3978     4052      +74     
+ Misses          735      727       -8     
- Partials        228      232       +4     
Components Coverage Δ
JDBC Core 80.86% <ø> (ø)
JDBC Main 57.42% <58.33%> (+16.72%) ⬆️
JDBC HTTP 90.55% <92.72%> (+0.25%) ⬆️
JDBC Utilities 65.25% <ø> (ø)
Spark Datasource ∅ <ø> (∅)
Files with missing lines Coverage Δ
...cloud/jdbc/interceptor/TokenProcessorSupplier.java 100.00% <100.00%> (+100.00%) ⬆️
...e/datacloud/jdbc/auth/DirectCdpTokenProcessor.java 92.72% <92.72%> (ø)
...salesforce/datacloud/jdbc/DataCloudDatasource.java 50.00% <44.44%> (+9.64%) ⬆️

... and 1 file with indirect coverage changes

Impacted file tree graph

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread jdbc/src/main/java/com/salesforce/datacloud/jdbc/DataCloudDatasource.java Outdated
reblem and others added 8 commits May 20, 2026 07:48
…asource

Both the OAuth and direct CDP-token flows built identical auth
interceptor, gRPC channel, stub provider, and DataCloudConnection
wiring. Merge them into a single createConnection that takes the
already-constructed collaborators (TokenProcessorSupplier, host,
userName, lakehouse supplier, dataspaces supplier).
- TokenProcessorSupplierTest: exercises all three constructors
  (DataCloudTokenProvider, DirectCdpTokenProcessor, raw supplier)
  asserting getToken / getAudience delegate correctly.
- DataCloudJDBCDriverTest: end-to-end DriverManager.getConnection
  via the cdpToken/tenantUrl branch, plus a negative case for an
  invalid JWT.
- DirectCdpTokenProcessorTest: add cases for the rebuild branch
  (cache cleared, cached-but-expired) and the wrap-on-rebuild-failure
  path. DirectCdpTokenProcessor is now at 100% line/branch coverage.
- TokenProcessorSupplierTest: add cases asserting SneakyThrows
  propagates supplier SQLExceptions through getToken / getAudience.
- Validate tenantUrl is a bare hostname (reject scheme/port/path/whitespace)
  so users get a clear error instead of an opaque gRPC connect failure
- Drive cached-token TTL from the JWT exp claim instead of a fixed 3600s
  default, with safe fallback when the JWT can't be parsed
- Drop the brittle reflection-based test that forced an unreachable rebuild
  failure; replace with focused secondsUntilJwtExpiry unit tests
- Collapse the duplicate TokenProcessorSupplier delegation test that
  re-exercised JWT parsing already covered in DirectCdpTokenProcessorTest
- Generate JWTs dynamically in tests so exp stays in the future
…thods

- Drop FALLBACK_EXPIRES_IN_SECONDS; expFromJwt() throws SQLException
  when the JWT is malformed or has no numeric exp claim. Bearer JWTs
  are required to carry exp; soft-falling-back to 1h was hiding bugs.
- buildDataCloudToken() throws SQLException if the supplied JWT is
  already expired, surfacing at ofDestructive instead of producing a
  dead-on-arrival token the server later rejects with an opaque 401.
- Fold the standalone validateToken() into buildDataCloudToken(): the
  tenant-id assertion lives next to the rest of construction.
- Rename getLakehouse() → getLakehouseName() to match the OAuth-path
  sibling DataCloudTokenProvider.getLakehouseName(), and update the
  caller in DataCloudDatasource.
@KaviarasuSakthivadivel KaviarasuSakthivadivel merged commit ecce116 into main May 21, 2026
19 of 23 checks passed
@KaviarasuSakthivadivel KaviarasuSakthivadivel deleted the rlemma/support-cdp-auth branch May 21, 2026 18:04
KaviarasuSakthivadivel pushed a commit that referenced this pull request May 26, 2026
🤖 I have created a release *beep* *boop*
---


##
[1.0.0](v0.42.2...v1.0.0)
(2026-05-22)


### ⚠ BREAKING CHANGES

* `DataCloudResultSet` is now a class instead of an interface;
`StreamingResultSet`, `DataCloudMetadataResultSet`, `SimpleResultSet`,
`ColumnAccessor` are removed; metadata int-column
`getDate`/`getTime`/`getTimestamp` throw `SQLException` (was
`UnsupportedOperationException`); `getTypeInfo()` boolean columns are
typed `BOOLEAN` instead of `VARCHAR` (`getObject` returns `Boolean`, not
`String`); `getColumnTypeName` on metadata result sets returns the JDBC
type name (`VARCHAR`/`SMALLINT`/`INTEGER`/`BOOLEAN`) instead of the
prior Hyper-flavored labels (`TEXT`/`SHORT`/`INTEGER`/`BOOL`);
`ps.setObject` with `Types.VARCHAR` rejects non-String/byte[] payloads;
integer-family and DECIMAL setters reject out-of-range values instead of
silently narrowing.

### Features

* add support for using CDP auth token directly
([#177](#177))
([ecce116](ecce116))
* Avatical Removal Part 3/3 - Remove Avatica dependency completely
([#166](#166))
([0e7d912](0e7d912))
* expose DataCloudStatement.getQueryStatus() with execution stats
([#178](#178))
([d4b1dcf](d4b1dcf))
* Expose query execution statistics in QueryStatus
([#164](#164))
([f01c77a](f01c77a))
* implement timezone and timestamp handling with JDBC 4.2 support
([#158](#158))
([d0301f5](d0301f5))
* Improve authentication error logging and retry handling
([#140](#140))
([0d42ad1](0d42ad1))
* Improve virtual thread compatibility
([#165](#165))
([18d9f38](18d9f38))


### Bug Fixes

* async interrupt race condition in SyncIteratorAdapter
([#170](#170))
([e81a0e6](e81a0e6))
* correct DatabaseMetaData.getTableTypes() to return table type names
([#162](#162))
([a5399bb](a5399bb))
* don't return garbage values instead of null under
arrow.enable_null_check_for_get=false
([#187](#187))
([a3f8712](a3f8712))
* JDBC spec compliance and small metadata bug fixes
([#171](#171))
([5a78b40](5a78b40))
* propagate caller ThreadLocals to follow-up gRPC calls in async
iterators
([#181](#181))
([7ac79f8](7ac79f8))
* support getObject(Class) with identity class type in QueryJDBCAccessor
([#186](#186))
([f47714f](f47714f))
* Upgrade 3PP versions and fix gRPC stream leak exposed by gRPC 1.80
([#168](#168))
([c0d2086](c0d2086))


### Code Refactoring

* unify ResultSet implementations on Arrow-backed path
([#175](#175))
([9760106](9760106))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants