refactor(kernel-auth): drop _coerce_bool; treat oauth_token_cache_enabled as Optional[bool]

oauth_token_cache_enabled is a typed connection kwarg like the connector's
other booleans (use_cloud_fetch, _use_arrow_native_complex_types, ...), none
of which coerce string inputs. Replace the one-off _coerce_bool with
`opts.get("oauth_token_cache_enabled") is True`: only a real True enables the
kernel's on-disk U2M token cache, and unset (None)/False forward an explicit
False so the kernel — whose own default is enabled — stays disabled by
default. Any non-bool value fails safe to disabled rather than silently
enabling.

Matches the nodejs connector's `tokenCacheEnabled ?? false` and removes the
inconsistency of coercing this one flag while every sibling boolean is passed
raw. Tests: the string-coercion cases are replaced by one asserting non-bool
inputs never enable the cache.

Signed-off-by: eric-wang-1990 <e.wang@databricks.com>

Author: eric-wang-1990

src/databricks/sql/backend/kernel/auth_bridge.py

@@ -460,16 +460,14 @@ def kernel_auth_kwargs(
                 else list(PYSQL_OAUTH_REDIRECT_PORT_RANGE)
             ),
             "oauth_scopes": scopes if scopes is not None else list(PYSQL_OAUTH_SCOPES),
-            # OAuth U2M token-cache enable/disable: when present in auth_options,
-            # forward to the kernel as token_cache_enabled on the U2M branch.
-            # Default disabled for backward compatibility when moving token
-            # persistence control to the kernel. This ensures callers must
-            # opt-in to on-disk persistence rather than silently enabling it.
-            # Coerced via _coerce_bool so a string DSN/env value like "False"
-            # is not treated as truthy (bool("False") is True).
-            "token_cache_enabled": _coerce_bool(
-                opts.get("oauth_token_cache_enabled")
-            ),
+            # OAuth U2M on-disk token cache. A typed Optional[bool], like the
+            # connector's other boolean options; only a real ``True`` enables
+            # it. The kernel's own default is *enabled*, so unset (None) must be
+            # forwarded as an explicit ``False`` — disabled, in-memory only —
+            # matching the Thrift posture so moving persistence control to the
+            # kernel never silently starts writing tokens to disk. Opt-in is
+            # therefore an explicit ``oauth_token_cache_enabled=True``.
+            "token_cache_enabled": opts.get("oauth_token_cache_enabled") is True,
         }
         if federation_client_id:
             kwargs["identity_federation_client_id"] = federation_client_id
@@ -523,28 +521,6 @@ def _coerce_redirect_port(redirect_port: Any) -> int:
         )
 
 
-def _coerce_bool(value: Any) -> bool:
-    """Coerce an opt-in boolean flag (e.g. ``oauth_token_cache_enabled``,
-    which may arrive as a string from a DSN/env) to a ``bool``.
-
-    A plain ``bool(value)`` is wrong for string inputs: ``bool("False")`` is
-    ``True``, which would silently enable on-disk token persistence whenever
-    the flag arrived as the string ``"False"``. Only genuinely truthy values
-    enable the flag: real booleans, and the usual textual/numeric truthy
-    spellings ("true"/"1"/"yes"/"on"). ``None`` (unset) and anything else
-    disable it (opt-in default)."""
-    if isinstance(value, bool):
-        return value
-    if value is None:
-        return False
-    if isinstance(value, str):
-        return value.strip().lower() in ("true", "1", "yes", "on")
-    if isinstance(value, (int, float)):
-        return value != 0
-    # Unknown types default to disabled rather than truthy-by-accident.
-    return False
-
-
 def _normalize_scopes(scopes: Any) -> Optional[list]:
     """Normalise an ``oauth_scopes`` value to a list of strings, or
     ``None`` to let the kernel apply its defaults.

src/databricks/sql/session.py

@@ -188,7 +188,7 @@ def _create_backend(
                 ),
                 # OAuth U2M token-cache enable/disable: controls whether the kernel
                 # persists U2M refresh tokens to disk (encrypted, at ~/.config/databricks-sql-kernel/oauth/).
-                # Coerced via _coerce_bool on the oauth-u2m branch, so omitted/None
+                # A typed Optional[bool]; on the oauth-u2m branch omitted/None
                 # ⇒ token_cache_enabled=False (disabled, in-memory only) — the
                 # opt-in default that preserves backward compat when token
                 # persistence moves to the kernel path; True ⇒ on-disk persistence.

tests/unit/test_kernel_auth_bridge.py

@@ -622,12 +622,13 @@ def test_u2m_token_cache_enabled_true_forwarded(self):
 
     @pytest.mark.parametrize(
         "raw_value",
-        ["False", "false", "0", "no", "off", "", "  ", "nope"],
+        ["True", "true", "1", "yes", "on", "False", "false", "0", "", 1, 0],
     )
-    def test_u2m_token_cache_enabled_falsey_string_stays_false(self, raw_value):
-        # A string DSN/env value that reads as falsey (e.g. "False") must NOT
-        # enable on-disk persistence: bool("False") is True, so the flag is
-        # coerced via _coerce_bool rather than bool().
+    def test_u2m_token_cache_enabled_non_bool_never_enables(self, raw_value):
+        # oauth_token_cache_enabled is a typed Optional[bool] (like the
+        # connector's other boolean options); only a real ``True`` enables
+        # on-disk persistence. Any non-bool value (e.g. a stray string from a
+        # DSN) fails safe to disabled rather than silently enabling.
         kwargs = kernel_auth_kwargs(
             _FakeOAuthProvider(),
             {
@@ -637,18 +638,6 @@ def test_u2m_token_cache_enabled_falsey_string_stays_false(self, raw_value):
         )
         assert kwargs["token_cache_enabled"] is False
 
-    @pytest.mark.parametrize("raw_value", ["True", "true", "1", "yes", "on"])
-    def test_u2m_token_cache_enabled_truthy_string_enables(self, raw_value):
-        # An explicit truthy string DSN/env value enables persistence.
-        kwargs = kernel_auth_kwargs(
-            _FakeOAuthProvider(),
-            {
-                "auth_type": "databricks-oauth",
-                "oauth_token_cache_enabled": raw_value,
-            },
-        )
-        assert kwargs["token_cache_enabled"] is True
-
     @pytest.mark.parametrize("u2m_auth_type", ["databricks-oauth", "azure-oauth"])
     def test_u2m_token_cache_enabled_both_auth_types(self, u2m_auth_type):
         # token_cache_enabled applies to both databricks-oauth and azure-oauth U2M types.