ai: apply changes for #914 (1 review thread)

Addresses:
  - #3799256419 at src/databricks/sql/backend/kernel/auth_bridge.py:266

Signed-off-by: peco-engineer-bot[bot] <peco-engineer-bot[bot]@users.noreply.github.com>

Author: peco-engineer-bot[bot]

src/databricks/sql/backend/kernel/auth_bridge.py

@@ -247,7 +247,11 @@ def kernel_auth_kwargs(
     #    http://localhost:{port}, with scheme/host/path fixed. The
     #    connector registers a port *range* for its app but the kernel
     #    accepts a single port, so we forward the first (canonical)
-    #    registered port.
+    #    registered port. A caller-supplied port only overrides that
+    #    default when an explicit client_id is ALSO supplied — matching
+    #    the Thrift path's coupling (a bare oauth_redirect_port paired
+    #    with the default databricks-sql-python app would resolve to an
+    #    unregistered redirect URI and fail the flow).
     if auth_type in ("databricks-oauth", "azure-oauth"):
         is_azure = auth_type == "azure-oauth"
         default_client_id = (
@@ -265,7 +269,7 @@ def kernel_auth_kwargs(
             "client_id": client_id or default_client_id,
             "redirect_port": (
                 int(redirect_port)
-                if redirect_port is not None
+                if client_id and redirect_port is not None
                 else default_port_range[0]
             ),
             "oauth_scopes": (

tests/unit/test_kernel_auth_bridge.py

@@ -324,14 +324,34 @@ def test_u2m_custom_client_id_only_falls_back_to_connector_defaults(self):
 
     def test_u2m_redirect_port_coerced_to_int(self):
         # oauth_redirect_port may arrive as a string (e.g. from a DSN);
-        # the kernel binding wants an int.
+        # the kernel binding wants an int. The port override is coupled to
+        # an explicit client_id (see the coupling test below), so supply
+        # one here to exercise the coercion path.
         kwargs = kernel_auth_kwargs(
             _FakeOAuthProvider(),
-            {"auth_type": "databricks-oauth", "oauth_redirect_port": "8021"},
+            {
+                "auth_type": "databricks-oauth",
+                "oauth_client_id": "custom-client",
+                "oauth_redirect_port": "8021",
+            },
         )
         assert kwargs["redirect_port"] == 8021
         assert isinstance(kwargs["redirect_port"], int)
 
+    def test_u2m_redirect_port_ignored_without_client_id(self):
+        # A bare oauth_redirect_port (no explicit client_id) must NOT be
+        # forwarded: it would be paired with the default databricks-sql-python
+        # app, whose registered redirect URIs only cover the default port
+        # range, so an arbitrary port would resolve to an unregistered URI
+        # and fail the U2M flow. This mirrors the Thrift path's coupling,
+        # where oauth_redirect_port_range is only overridden when both
+        # oauth_client_id and oauth_redirect_port are supplied.
+        kwargs = kernel_auth_kwargs(
+            _FakeOAuthProvider(),
+            {"auth_type": "databricks-oauth", "oauth_redirect_port": 9999},
+        )
+        assert kwargs["redirect_port"] == PYSQL_OAUTH_REDIRECT_PORT_RANGE[0]
+
     @pytest.mark.parametrize("auth_type", ["databricks-oauth", "azure-oauth"])
     def test_u2m_forwards_custom_scopes(self, auth_type):
         kwargs = kernel_auth_kwargs(