auth describe: show U2M token storage location and source

[simonfaltum]

Why

Users have no way to tell where the CLI is storing their U2M (databricks-cli) token. As we move toward making secure storage the default at GA, users need to confirm whether their tokens live in the OS keyring or in ~/.databricks/token-cache.json, and which precedence level produced that choice. gh auth status does this with a (keyring) or (/path/to/hosts.yml) suffix; we want the same.

Changes

Before: databricks auth describe showed host, user, auth type, and a "Current configuration" block, with no information about U2M token storage.

Now: For profiles using auth_type = databricks-cli, output adds:

Token storage: plaintext, ~/.databricks/token-cache.json (from default)

or

Token storage: secure, OS keyring (service: databricks-cli) (from DATABRICKS_AUTH_STORAGE environment variable)

The (from ...) clause matches the existing config-attribute annotation style. Other auth types (PAT, M2M, OIDC, Azure, etc.) do not use the U2M cache and the line is omitted entirely (no field in JSON either).

JSON output adds a token_storage: { mode, location, source } object alongside details.

Implementation:

• libs/auth/storage/mode.go: ResolveStorageModeWithSource now returns a typed StorageSource (Default | Override | EnvVar | Config) instead of an opaque bool. StorageSource.String() produces user-facing labels matching config.Source.String() style.
• libs/auth/storage/cache.go: only existing in-repo caller updated to use source.Explicit().
• cmd/auth/describe.go: new tokenStorageInfo struct + resolveTokenStorageInfo helper. Templates conditionally render the new line. Only resolves when auth_type == "databricks-cli"; resolver errors are debug-logged and treated as "no info available" rather than failing describe.

No probing of either backend at describe time. The describe command already makes a live API call that validates the token works; double-probing would add a 3-second hang on Linux without Secret Service for no extra signal. Following up with a --check-token flag is a separate change if there's appetite for it.

Test plan

• Unit tests for StorageSource.String() and .Explicit()
• Updated TestResolveStorageModeWithSource for the new return type
• New TestResolveTokenStorageInfo table test covering U2M+default, U2M+env, and non-U2M
• New TestGetWorkspaceAuthStatus_U2M_PopulatesTokenStorage and TestGetWorkspaceAuthStatus_NonU2M_OmitsTokenStorage
• New acceptance tests at acceptance/cmd/auth/describe/u2m-plaintext-default/ and u2m-plaintext-env/
• Existing PAT acceptance test (default-profile/) still passes unchanged
• Manual smoke: built CLI, ran describe with U2M+default, U2M+secure-env, and PAT profiles. Output is correct in both text and JSON.
• ./task checks and ./task lint-q clean

Secure-storage acceptance tests are intentionally omitted: they would actually query the OS keyring on macOS (potential prompt) or hit the 3s timeout on Linux CI without Secret Service. Unit tests cover the secure path on any platform.

[github-actions]

Approval status: pending

/cmd/auth/ - needs approval

Files: cmd/auth/describe.go, cmd/auth/describe_test.go
Suggested: @mihaimitrea-db
Also eligible: @renaudhartert-db, @hectorcast-db, @parthban-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @chrisst, @rauchy

/libs/auth/ - needs approval

Files: libs/auth/storage/cache.go, libs/auth/storage/mode.go, libs/auth/storage/mode_test.go
Suggested: @mihaimitrea-db
Also eligible: @renaudhartert-db, @hectorcast-db, @parthban-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @chrisst, @rauchy

General files (require maintainer)

17 files changed
Based on git history:

• @denik -- recent work in ./, cmd/auth/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @renaudhartert-db) can approve all areas.
See OWNERS for ownership rules.}