CXH-2380: reach the DB2 native DSN form through connector config

.github/workflows/ci.yaml

@@ -41,14 +41,14 @@ jobs:
       - name: Build baton-sql
         run: go build ./cmd/baton-sql
       - name: Run sync tests
-        uses: ConductorOne/github-workflows/actions/sync-test@v2
+        uses: ConductorOne/github-workflows/actions/sync-test@v4
         with:
           connector: ./baton-sql
           baton-entitlement: 'role:admin:member'
           baton-principal: john.smith
           baton-principal-type: user
       - name: Run account provisioning tests
-        uses: ConductorOne/github-workflows/actions/account-provisioning@v3
+        uses: ConductorOne/github-workflows/actions/account-provisioning@v4
         with:
           connector: ./baton-sql
           account-email: robert.tables2@example.com

cmd/baton-sql/main.go

@@ -2,11 +2,10 @@ package main
 
 import (
 	"context"
-	"fmt"
-	"os"
 
 	configSdk "github.com/conductorone/baton-sdk/pkg/config"
 	"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
+	"github.com/conductorone/baton-sdk/pkg/exit"
 	"github.com/conductorone/baton-sdk/pkg/field"
 	"github.com/conductorone/baton-sdk/pkg/types"
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
@@ -31,16 +30,14 @@ func main() {
 		},
 	)
 	if err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
-		os.Exit(1)
+		exit.LogExit(err)
 	}
 
 	cmd.Version = version
 
 	err = cmd.Execute()
 	if err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
-		os.Exit(1)
+		exit.LogExit(err)
 	}
 }
 

docs/db2.md

@@ -110,12 +110,20 @@ Query parameters are forwarded as additional DB2 connection keywords
 (`HOSTNAME`, `DATABASE`, `PORT`, `PROTOCOL`, `UID`, `PWD`) are rejected — use the native
 form below for full control.
 
-DB2's native form is also accepted as-is:
+DB2's native form is also accepted as-is (ODBC keywords are case-insensitive and may carry
+spaces after each `;`):
 
 ```
 HOSTNAME=localhost;PORT=50000;DATABASE=TESTDB;UID=db2inst1;PWD=pass123;PROTOCOL=TCPIP
 ```
 
+The native form is self-contained: it already carries the host, port, credentials, params and
+target database. It is therefore mutually exclusive with the structured `connect` fields
+(`host`, `port`, `user`, `password`, `params`) and with a per-database override (`connect.database`
+or the `databases` block for multi-database sync). Combining them is rejected with an explicit
+error rather than silently ignoring the extra settings, so use the `db2://` URL form when you
+need multi-database discovery or want to supply fields separately.
+
 ## Troubleshooting
 
 **`'sqlcli1.h' file not found`** — clidriver missing or `DB2HOME` wrong. Check that

pkg/bsql/offline_validate.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"net/url"
 	"strings"
+
+	"github.com/conductorone/baton-sql/pkg/database/db2"
 )
 
 // OfflineValidate performs YAML-level structural checks without opening a DB or
@@ -102,6 +104,12 @@ func resolveConnectScheme(c *DatabaseConfig) (string, error) {
 	if dsn == "" {
 		return "", errors.New("connect: scheme or dsn is required")
 	}
+	// A native DB2 DSN (HOSTNAME=...;DATABASE=...) carries no scheme prefix. Classify it
+	// via the shared detector so this check matches pkg/database's routing and does not
+	// misread a "://" inside a value as a scheme.
+	if db2.IsNativeDSN(dsn) {
+		return "db2", nil
+	}
 	// Placeholders like postgres://${HOST}/db — peel scheme before parse when possible.
 	if idx := strings.Index(dsn, "://"); idx > 0 {
 		return strings.ToLower(dsn[:idx]), nil

pkg/bsql/offline_validate_test.go

@@ -124,6 +124,27 @@ func TestRejectNonV1_NonPostgresScheme(t *testing.T) {
 	require.Contains(t, strings.ToLower(err.Error()), "postgres")
 }
 
+func TestRejectNonV1_NativeDB2DSNRejectedAsDB2(t *testing.T) {
+	// A native DB2 DSN carries no scheme prefix; it must be classified as "db2" (via the
+	// shared detector), so v1 rejects it with the scheme message rather than the confusing
+	// "scheme missing from dsn". Also guards against a "://" inside a value misclassifying it.
+	for _, dsn := range []string{
+		"HOSTNAME=localhost;PORT=50000;DATABASE=TESTDB;UID=u;PWD=p;PROTOCOL=TCPIP",
+		"HOSTNAME=localhost;DATABASE=TESTDB;PWD=my://secret",
+	} {
+		cfg, err := Parse([]byte(minimalPostgresYAML()))
+		require.NoError(t, err)
+		cfg.Connect.Scheme = ""
+		cfg.Connect.DSN = dsn
+		s, err := resolveConnectScheme(&cfg.Connect)
+		require.NoError(t, err)
+		require.Equal(t, "db2", s)
+		err = RejectNonV1ProductFeatures(cfg)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "db2")
+	}
+}
+
 func TestRejectNonV1_PostgresqlAliasRejected(t *testing.T) {
 	cfg, err := Parse([]byte(minimalPostgresYAML()))
 	require.NoError(t, err)

pkg/connector/connector.go

@@ -97,6 +97,9 @@ func (c *Connector) Validate(ctx context.Context) (annotations.Annotations, erro
 
 	for name, db := range c.dbs {
 		if err := db.PingContext(ctx); err != nil {
+			if authErr := database.AuthError(err); authErr != nil {
+				return nil, authErr
+			}
 			return nil, fmt.Errorf("database %q ping failed: %w", name, err)
 		}
 	}

pkg/database/autherror.go

@@ -0,0 +1,35 @@
+package database
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/go-sql-driver/mysql"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const mysqlAccessDenied = 1045
+
+// AuthError returns an Unauthenticated gRPC status when err is a database
+// authentication/authorization failure, or nil otherwise. SQLSTATE class 28
+// ("invalid authorization") is the ANSI code drivers report on bad credentials
+// (Postgres/Redshift/Vertica/etc. surface it via SQLState()); MySQL is the
+// exception, reporting error 1045 with no SQLSTATE.
+func AuthError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var sqlState interface{ SQLState() string }
+	if errors.As(err, &sqlState) && strings.HasPrefix(sqlState.SQLState(), "28") {
+		return status.Error(codes.Unauthenticated, "database authentication failed")
+	}
+
+	var myErr *mysql.MySQLError
+	if errors.As(err, &myErr) && myErr.Number == mysqlAccessDenied {
+		return status.Error(codes.Unauthenticated, "database authentication failed")
+	}
+
+	return nil
+}

pkg/database/autherror_test.go

@@ -0,0 +1,44 @@
+package database
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/go-sql-driver/mysql"
+	"github.com/jackc/pgx/v5/pgconn"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestAuthError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want codes.Code // codes.OK means expect nil
+	}{
+		{"nil", nil, codes.OK},
+		{"postgres invalid_password 28P01", &pgconn.PgError{Code: "28P01"}, codes.Unauthenticated},
+		{"postgres invalid_authorization 28000", &pgconn.PgError{Code: "28000"}, codes.Unauthenticated},
+		{"postgres non-auth relation missing 42P01", &pgconn.PgError{Code: "42P01"}, codes.OK},
+		{"postgres auth error wrapped", fmt.Errorf("ping: %w", &pgconn.PgError{Code: "28P01"}), codes.Unauthenticated},
+		{"mysql access denied 1045", &mysql.MySQLError{Number: 1045}, codes.Unauthenticated},
+		{"mysql other 1146", &mysql.MySQLError{Number: 1146}, codes.OK},
+		{"plain error", errors.New("boom"), codes.OK},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := AuthError(tt.err)
+			if tt.want == codes.OK {
+				if got != nil {
+					t.Fatalf("want nil, got %v", got)
+				}
+				return
+			}
+			if status.Code(got) != tt.want {
+				t.Fatalf("want %v, got %v", tt.want, status.Code(got))
+			}
+		})
+	}
+}

pkg/database/database.go

@@ -361,13 +361,26 @@ func ResolveDatabaseName(opts ConnectOptions) string {
 			return expanded
 		}
 	}
+	if _, database, isNativeDB2, err := nativeDB2DSN(opts); err == nil && isNativeDB2 {
+		return database
+	}
 	parsedUrl, err := buildConnectionURL(opts)
 	if err != nil || parsedUrl == nil {
 		return ""
 	}
 	return strings.TrimPrefix(parsedUrl.Path, "/")
 }
 
+// hasStructuredConnectFields reports whether opts carries any structured connect
+// field that a native DB2 DSN would make redundant. A native DSN is self-contained;
+// combining it with these (or a per-database override) silently drops them, so the
+// caller rejects the combination. Scheme is excluded: "db2" alongside a native DSN
+// is a supported, explicit hint.
+func hasStructuredConnectFields(opts ConnectOptions) bool {
+	return opts.Host != "" || opts.Port != "" || opts.User != "" ||
+		opts.Password != "" || opts.Database != "" || len(opts.Params) > 0
+}
+
 // ConnectMany opens one *sql.DB per name in dbNames. On any per-database failure,
 // every handle opened so far is closed before returning the error.
 func ConnectMany(ctx context.Context, opts ConnectOptions, dbNames []string) (map[string]*sql.DB, DbEngine, error) {
@@ -404,6 +417,34 @@ func ConnectMany(ctx context.Context, opts ConnectOptions, dbNames []string) (ma
 }
 
 func Connect(ctx context.Context, opts ConnectOptions) (*sql.DB, DbEngine, error) {
+	// A native DB2 DSN is an opaque ODBC keyword=value string, not a URL. Routing it
+	// through buildConnectionURL corrupts it (url.Parse/.String mangles the opaque form),
+	// so hand it to the driver verbatim. See docs/db2.md.
+	nativeDSN, _, isNativeDB2, err := nativeDB2DSN(opts)
+	if err != nil {
+		return nil, Unknown, err
+	}
+	if isNativeDB2 {
+		// A native DSN already carries host, port, credentials, params and the target
+		// database. Structured fields or a per-database override (set directly, or by
+		// ConnectMany for databases.static / discovery_query) would be silently dropped
+		// on the verbatim path, so reject the combination instead of connecting to the
+		// wrong database. See docs/db2.md.
+		if hasStructuredConnectFields(opts) {
+			return nil, Unknown, errors.New(
+				"native DB2 DSN is self-contained and cannot be combined with structured " +
+					"connect fields (host, port, user, password, params) or a per-database " +
+					"override (connect.database, databases); put every setting in the DSN or " +
+					"use the db2:// URL form",
+			)
+		}
+		db, err := db2.Connect(ctx, nativeDSN)
+		if err != nil {
+			return nil, Unknown, err
+		}
+		return db, DB2, nil
+	}
+
 	parsedDsn, err := buildConnectionURL(opts)
 	if err != nil {
 		return nil, Unknown, err
@@ -468,6 +509,37 @@ func Connect(ctx context.Context, opts ConnectOptions) (*sql.DB, DbEngine, error
 	}
 }
 
+// nativeDB2DSN reports whether opts carries a native DB2 DSN: an opaque ODBC
+// keyword=value string (e.g. "HOSTNAME=...;DATABASE=...") rather than a db2:// URL.
+// When it does, the env-expanded string (for verbatim handoff to the driver) and its
+// DATABASE value are returned. The scheme, when set, must be db2; a URL-shaped DSN or
+// foreign scheme is left to the normal URL path. Detection is db2.ParseNativeDSN, shared
+// with convertToDB2DSN's passthrough, so one pass yields both facts without re-splitting.
+func nativeDB2DSN(opts ConnectOptions) (string, string, bool, error) {
+	if opts.DSN == "" {
+		return "", "", false, nil
+	}
+	lookup := opts.resolveLookup()
+
+	scheme, err := expandValue(opts.Scheme, lookup)
+	if err != nil {
+		return "", "", false, err
+	}
+	if scheme != "" && scheme != "db2" {
+		return "", "", false, nil
+	}
+
+	dsn, err := expandValue(opts.DSN, lookup)
+	if err != nil {
+		return "", "", false, err
+	}
+	database, native := db2.ParseNativeDSN(dsn)
+	if !native {
+		return "", "", false, nil
+	}
+	return dsn, database, true, nil
+}
+
 func buildConnectionURL(opts ConnectOptions) (*url.URL, error) {
 	var (
 		parsedUrl *url.URL