Keep main's path-node location lookups; build app permission paths from parts

Earlier rebases resolved conflicts with #6980 in favor of string paths,
reverting call sites that main already builds with structpath.NewPath.
Restore main's versions where this PR has no reason to change them, and make
the app permission checks take a path node instead of parsing a string.

Co-authored-by: Isaac <no-reply@databricks.com>

Author: denik

bundle/apps/validate.go

@@ -9,7 +9,6 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/structs/structpath"
-	"github.com/databricks/cli/libs/structs/structvar"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 )
 
@@ -28,7 +27,7 @@ func (v *validate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Missing app source code path or git source",
 				Detail:    fmt.Sprintf("app resource '%s' should have either source_code_path or git_source field", key),
-				Locations: b.Config.GetLocations("resources.apps." + key),
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "apps", key)),
 			})
 			continue
 		}
@@ -38,7 +37,7 @@ func (v *validate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Both source_code_path and git_source fields are set",
 				Detail:    fmt.Sprintf("app resource '%s' should have either source_code_path or git_source field, not both", key),
-				Locations: b.Config.GetLocations("resources.apps." + key),
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "apps", key)),
 			})
 			continue
 		}
@@ -48,7 +47,7 @@ func (v *validate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Duplicate app source code path",
 				Detail:    fmt.Sprintf("app resource '%s' has the same source code path as app resource '%s', this will lead to the app configuration being overridden by each other", key, usedSourceCodePaths[app.SourceCodePath]),
-				Locations: b.Config.GetLocations(fmt.Sprintf("resources.apps.%s.source_code_path", key)),
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "apps", key, "source_code_path")),
 			})
 		}
 		usedSourceCodePaths[app.SourceCodePath] = key
@@ -92,12 +91,9 @@ type appResourceReference struct {
 	permission   string
 }
 
-// hasPermissions checks if a bundle resource at the given dyn path has a non-empty permissions list.
-func hasPermissions(b *bundle.Bundle, resourcePath string) bool {
-	pv, err := valueAt(b, resourcePath+".permissions")
-	if err != nil {
-		return false
-	}
+// hasPermissions checks if a bundle resource at the given path has a non-empty permissions list.
+func hasPermissions(b *bundle.Bundle, resourcePath *structpath.PathNode) bool {
+	pv := b.Config.View().Lookup(structpath.NewPath(resourcePath, "permissions"))
 	for range pv.Sequence() {
 		return true
 	}
@@ -106,12 +102,9 @@ func hasPermissions(b *bundle.Bundle, resourcePath string) bool {
 
 // hasAppSPInPermissions checks if any permission entry for the given resource
 // references the app's service principal via variable interpolation.
-func hasAppSPInPermissions(b *bundle.Bundle, resourcePath, appKey string) bool {
+func hasAppSPInPermissions(b *bundle.Bundle, resourcePath *structpath.PathNode, appKey string) bool {
 	appSPRef := fmt.Sprintf("${resources.apps.%s.service_principal_client_id}", appKey)
-	pv, err := valueAt(b, resourcePath+".permissions")
-	if err != nil {
-		return false
-	}
+	pv := b.Config.View().Lookup(structpath.NewPath(resourcePath, "permissions"))
 	for _, entry := range pv.Sequence() {
 		if str, ok := entry.Get("service_principal_name").AsString(); ok && str == appSPRef {
 			return true
@@ -140,7 +133,7 @@ func warnForAppResourcePermissions(b *bundle.Bundle, appKey string, app *resourc
 		}
 		refType, resourceKey := matches[1], matches[2]
 
-		resourcePath := fmt.Sprintf("resources.%s.%s", refType, resourceKey)
+		resourcePath := structpath.NewPath(nil, "resources", refType, resourceKey)
 		if !hasPermissions(b, resourcePath) {
 			continue
 		}
@@ -149,7 +142,7 @@ func warnForAppResourcePermissions(b *bundle.Bundle, appKey string, app *resourc
 			continue
 		}
 
-		appPath := "resources.apps." + appKey
+		appPath := structpath.NewPath(nil, "resources", "apps", appKey)
 		diags = append(diags, diag.Diagnostic{
 			Severity: diag.Warning,
 			Summary:  fmt.Sprintf("app %q references %s %q which has permissions set. To prevent permission override after deploying the app, please add the app service principal to the %s permissions", appKey, refType, resourceKey, refType),
@@ -167,8 +160,8 @@ func warnForAppResourcePermissions(b *bundle.Bundle, appKey string, app *resourc
 				ref.permission,
 				appKey,
 			),
-			Paths:     structpath.NewPathSlice("resources", "apps", appKey),
-			Locations: b.Config.GetLocations(appPath),
+			Paths:     []*structpath.PathNode{appPath},
+			Locations: b.Config.GetLocationsOf(appPath),
 		})
 	}
 
@@ -182,12 +175,3 @@ func (v *validate) Name() string {
 func Validate() bundle.Mutator {
 	return &validate{}
 }
-
-// valueAt returns the view of the configuration value at path.
-func valueAt(b *bundle.Bundle, path string) (structvar.View, error) {
-	p, err := structpath.ParsePath(path)
-	if err != nil {
-		return structvar.View{}, err
-	}
-	return b.Config.View().Lookup(p), nil
-}

bundle/config/mutator/apply_source_linked_deployment_preset.go

@@ -13,10 +13,6 @@ import (
 
 type applySourceLinkedDeploymentPreset struct{}
 
-func targetPresetPath(target string) *structpath.PathNode {
-	return structpath.NewPath(nil, "targets", target, "presets", "source_linked_deployment")
-}
-
 // Apply source-linked deployment preset
 func ApplySourceLinkedDeploymentPreset() *applySourceLinkedDeploymentPreset {
 	return &applySourceLinkedDeploymentPreset{}
@@ -37,13 +33,13 @@ func (m *applySourceLinkedDeploymentPreset) Apply(ctx context.Context, b *bundle
 
 	if config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
 		if !isDatabricksWorkspace {
-			path := targetPresetPath(target)
+			path := structpath.NewPath(nil, "targets", target, "presets", "source_linked_deployment")
 			diags = diags.Append(
 				diag.Diagnostic{
 					Severity:  diag.Warning,
 					Summary:   "source-linked deployment is available only in the Databricks Workspace",
 					Paths:     []*structpath.PathNode{path},
-					Locations: b.Config.GetLocations("presets.source_linked_deployment"),
+					Locations: b.Config.GetLocationsOf(path.SkipPrefix(2)),
 				},
 			)
 
@@ -55,13 +51,13 @@ func (m *applySourceLinkedDeploymentPreset) Apply(ctx context.Context, b *bundle
 		b.Metrics.AddBoolValue("source_linked_set_for_non_development", b.Config.Bundle.Mode != config.Development)
 
 		if b.Config.Bundle.Mode != config.Development {
-			path := targetPresetPath(target)
+			path := structpath.NewPath(nil, "targets", target, "presets", "source_linked_deployment")
 			diags = diags.Append(
 				diag.Diagnostic{
 					Severity:  diag.Warning,
 					Summary:   "source-linked deployment in non-development mode is deprecated and will not be supported in a future release",
 					Paths:     []*structpath.PathNode{path},
-					Locations: b.Config.GetLocations("presets.source_linked_deployment"),
+					Locations: b.Config.GetLocationsOf(path.SkipPrefix(2)),
 				},
 			)
 		}
@@ -74,14 +70,14 @@ func (m *applySourceLinkedDeploymentPreset) Apply(ctx context.Context, b *bundle
 
 	// This mutator runs before workspace paths are defaulted so it's safe to check for the user-defined value
 	if b.Config.Workspace.FilePath != "" && config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
-		path := structpath.MustParsePath("workspace.file_path")
+		path := structpath.NewPath(nil, "workspace", "file_path")
 		diags = diags.Append(
 			diag.Diagnostic{
 				Severity:  diag.Warning,
 				Summary:   "workspace.file_path setting will be ignored in source-linked deployment mode",
 				Detail:    "In source-linked deployment files are not copied to the destination and resources use source files instead",
 				Paths:     []*structpath.PathNode{path},
-				Locations: b.Config.GetLocations(path.String()),
+				Locations: b.Config.GetLocationsOf(path),
 			},
 		)
 	}

bundle/config/mutator/resourcemutator/secret_scope_fixups.go

@@ -131,16 +131,15 @@ func (m *secretScopeFixups) Apply(ctx context.Context, b *bundle.Bundle) diag.Di
 		currentUser := b.Config.Workspace.CurrentUser.User
 
 		addManageForCurrentUser(scope, currentUser)
-		path := structpath.NewPath(nil, "resources", "secret_scopes", key)
 		err := collapsePermissions(scope)
 		if err != nil {
 			return diag.Diagnostics{
 				{
 					Severity:  diag.Error,
 					Summary:   "Failed to collapse permissions for secret scope",
 					Detail:    err.Error(),
-					Paths:     []*structpath.PathNode{path},
-					Locations: []diag.Location{b.Config.GetLocation(path.String())},
+					Paths:     structpath.NewPathSlice("resources", "secret_scopes", key),
+					Locations: []diag.Location{b.Config.GetLocationOf(structpath.NewPath(nil, "resources", "secret_scopes", key))},
 				},
 			}
 		}

bundle/config/mutator/sync_infer_root.go

@@ -90,11 +90,12 @@ func (m *syncInferRoot) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagno
 			continue
 		}
 
+		syncPath := structpath.NewPath(nil, "sync", "paths", i)
 		diags = append(diags, diag.Diagnostic{
 			Severity:  diag.Error,
 			Summary:   fmt.Sprintf("invalid sync path %q", path),
-			Locations: b.Config.GetLocations(fmt.Sprintf("sync.paths[%d]", i)),
-			Paths:     []*structpath.PathNode{structpath.NewIndex(structpath.MustParsePath("sync.paths"), i)},
+			Locations: b.Config.GetLocationsOf(syncPath),
+			Paths:     []*structpath.PathNode{syncPath},
 		})
 	}
 

bundle/config/validate/files_to_sync.go

@@ -56,14 +56,14 @@ func (v *filesToSync) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnost
 			Summary:  "There are no files to sync, please check your .gitignore",
 		})
 	} else {
-		path := "sync.exclude"
+		path := structpath.NewPath(nil, "sync", "exclude")
 		diags = diags.Append(diag.Diagnostic{
 			Severity: diag.Warning,
 			Summary:  "There are no files to sync, please check your .gitignore and sync.exclude configuration",
 			// Show all locations where sync.exclude is defined, since merging
 			// sync.exclude is additive.
-			Locations: b.Config.GetLocations(path),
-			Paths:     structpath.MustParsePaths(path),
+			Locations: b.Config.GetLocationsOf(path),
+			Paths:     []*structpath.PathNode{path},
 		})
 	}
 

bundle/config/validate/job_cluster_key_defined.go

@@ -31,14 +31,13 @@ func (v *jobClusterKeyDefined) Apply(ctx context.Context, b *bundle.Bundle) diag
 		}
 
 		for index, task := range job.Tasks {
-			taskPath := structpath.NewPath(nil, "resources", "jobs", k, "tasks", index)
 			diags = diags.Extend(checkJobClusterKey(b, jobClusterKeys, task.JobClusterKey,
-				structpath.NewPath(taskPath, "job_cluster_key")))
+				structpath.NewPath(nil, "resources", "jobs", k, "tasks", index, "job_cluster_key")))
 
 			// The Jobs API rejects nested for_each_task, so one level is sufficient.
 			if task.ForEachTask != nil {
 				diags = diags.Extend(checkJobClusterKey(b, jobClusterKeys, task.ForEachTask.Task.JobClusterKey,
-					structpath.NewPath(taskPath, "for_each_task", "task", "job_cluster_key")))
+					structpath.NewPath(nil, "resources", "jobs", k, "tasks", index, "for_each_task", "task", "job_cluster_key")))
 			}
 		}
 	}
@@ -61,7 +60,7 @@ func checkJobClusterKey(b *bundle.Bundle, jobClusterKeys map[string]bool, jobClu
 		// Show only the location where the job_cluster_key is defined.
 		// Other associated locations are not relevant since they are
 		// overridden during merging.
-		Locations: b.Config.GetLocations(path.String()),
+		Locations: b.Config.GetLocationsOf(path),
 		Paths:     []*structpath.PathNode{path},
 	}}
 }

bundle/config/validate/job_task_cluster_spec.go

@@ -92,7 +92,7 @@ func validateJobTask(b *bundle.Bundle, task jobs.Task, taskPath *structpath.Path
 				Severity:  diag.Error,
 				Summary:   "Missing required cluster or environment settings",
 				Detail:    detail,
-				Locations: b.Config.GetLocations(taskPath.String()),
+				Locations: b.Config.GetLocationsOf(taskPath),
 				Paths:     []*structpath.PathNode{taskPath},
 			})
 		}

bundle/config/validate/required.go

@@ -97,11 +97,11 @@ func errorForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnosti
 	for key, dashboard := range b.Config.Resources.Dashboards {
 		path := structpath.NewPath(nil, "resources", "dashboards", key)
 		if dashboard.DisplayName == "" {
-			nameLocations = append(nameLocations, b.Config.GetLocations(path.String())...)
+			nameLocations = append(nameLocations, b.Config.GetLocationsOf(path)...)
 			namePaths = append(namePaths, path)
 		}
 		if dashboard.WarehouseId == "" {
-			warehouseIdLocations = append(warehouseIdLocations, b.Config.GetLocations(path.String())...)
+			warehouseIdLocations = append(warehouseIdLocations, b.Config.GetLocationsOf(path)...)
 			warehouseIdPaths = append(warehouseIdPaths, path)
 		}
 	}
@@ -131,7 +131,7 @@ func errorForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnosti
 			diags = diags.Append(diag.Diagnostic{
 				Severity:  diag.Error,
 				Summary:   "sql_warehouse name is required",
-				Locations: b.Config.GetLocations(path.String()),
+				Locations: b.Config.GetLocationsOf(path),
 				Paths:     []*structpath.PathNode{path},
 			})
 		}
@@ -200,7 +200,7 @@ func errorForInvalidSecretScopePermissions(ctx context.Context, b *bundle.Bundle
 				Severity:  diag.Error,
 				Summary:   "secret scope permission principal is required",
 				Detail:    "Set one of user_name, group_name or service_principal_name",
-				Locations: b.Config.GetLocations(scopePath.String()),
+				Locations: b.Config.GetLocationsOf(scopePath),
 				Paths:     []*structpath.PathNode{path},
 			})
 		}

bundle/config/validate/validate_artifact_path.go

@@ -68,8 +68,8 @@ func findVolumeInBundle(r config.Root, catalogName, schemaName, volumeName strin
 		if v.SchemaName != schemaName && !isSchemaDefinedInBundle {
 			continue
 		}
-		pathString := "resources.volumes." + k
-		return structpath.MustParsePath(pathString), r.GetLocations(pathString), true
+		volumePath := structpath.NewPath(nil, "resources", "volumes", k)
+		return volumePath, r.GetLocationsOf(volumePath), true
 	}
 	return nil, nil, false
 }

bundle/config/validate/validate_deployment_fields.go

@@ -26,29 +26,29 @@ func (v *validateDeploymentFields) Apply(_ context.Context, b *bundle.Bundle) di
 	// deployment_id and version_id identify the bundle deployment and its version
 	// in the Deployment Metadata Service. The CLI sets them on every deploy, so a
 	// value provided by hand would be overwritten; reject it up front.
-	reject := func(resource *structpath.PathNode, field, value string) {
+	reject := func(resourceType, name, field, value string) {
 		if value == "" {
 			return
 		}
-		path := structpath.NewPath(resource, "deployment", field)
+		path := structpath.NewPath(nil, "resources", resourceType, name, "deployment", field)
 		diags = append(diags, diag.Diagnostic{
 			Severity:  diag.Error,
 			Summary:   field + " must not be set in bundle configuration; it is managed by Declarative Automation Bundles",
 			Paths:     []*structpath.PathNode{path},
-			Locations: b.Config.GetLocations(path.String()),
+			Locations: b.Config.GetLocationsOf(path),
 		})
 	}
 
 	for name, job := range b.Config.Resources.Jobs {
 		if d := job.Deployment; d != nil {
-			reject(structpath.NewPath(nil, "resources", "jobs", name), "deployment_id", d.DeploymentId)
-			reject(structpath.NewPath(nil, "resources", "jobs", name), "version_id", d.VersionId)
+			reject("jobs", name, "deployment_id", d.DeploymentId)
+			reject("jobs", name, "version_id", d.VersionId)
 		}
 	}
 	for name, pipeline := range b.Config.Resources.Pipelines {
 		if d := pipeline.Deployment; d != nil {
-			reject(structpath.NewPath(nil, "resources", "pipelines", name), "deployment_id", d.DeploymentId)
-			reject(structpath.NewPath(nil, "resources", "pipelines", name), "version_id", d.VersionId)
+			reject("pipelines", name, "deployment_id", d.DeploymentId)
+			reject("pipelines", name, "version_id", d.VersionId)
 		}
 	}