fix(kernel): guard JWT M2M + databricks-oauth auth_type; renumber comments

Address peco-review-bot review on #921:
- Medium: add the missing ambiguity guard for oauth_jwt_key_file +
  auth_type="databricks-oauth" (U2M intent), mirroring the existing
  shared-secret M2M + U2M guard. Fails loudly rather than silently
  resolving to one flow. Covered by a new unit test.
- Low: renumber the inline resolution-order comments (PAT→3, U2M→4,
  creds→5, else→6) to match the docstring after the JWT branch insert.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

Author: rahuls-db

src/databricks/sql/backend/kernel/auth_bridge.py

@@ -248,6 +248,13 @@ def kernel_auth_kwargs(
             "kernel-managed JWT private-key M2M, or use the Thrift backend "
             "(default) for credentials_provider."
         )
+    if has_jwt_m2m and auth_type == "databricks-oauth":
+        raise NotSupportedError(
+            f"Ambiguous auth on use_kernel=True: auth_type={auth_type!r} selects "
+            "the U2M browser flow, but oauth_jwt_key_file was also provided "
+            "(JWT private-key M2M). Drop oauth_jwt_key_file for U2M, or drop "
+            "auth_type for JWT M2M."
+        )
 
     # 1. OAuth M2M (JWT private-key client assertion) — the kernel signs a
     #    short-lived assertion with the private key and runs the
@@ -309,7 +316,7 @@ def kernel_auth_kwargs(
             kwargs["identity_federation_client_id"] = federation_client_id
         return kwargs
 
-    # 2. PAT (including TokenFederationProvider-wrapped PAT).
+    # 3. PAT (including TokenFederationProvider-wrapped PAT).
     if _is_pat(auth_provider):
         token = _extract_bearer_token(auth_provider)
         if not token:
@@ -322,7 +329,7 @@ def kernel_auth_kwargs(
             kwargs["identity_federation_client_id"] = federation_client_id
         return kwargs
 
-    # 3. OAuth U2M — browser authorization-code flow; the kernel runs it.
+    # 4. OAuth U2M — browser authorization-code flow; the kernel runs it.
     #    Only databricks-oauth reaches here (azure-oauth rejected up front).
     #    Forward the connector's own databricks-sql-python bundle instead of
     #    the kernel's databricks-sql-connector default, for parity with the
@@ -354,7 +361,7 @@ def kernel_auth_kwargs(
             kwargs["identity_federation_client_id"] = federation_client_id
         return kwargs
 
-    # 4. Custom credentials_provider — the connector's primary M2M path
+    # 5. Custom credentials_provider — the connector's primary M2M path
     #    on Thrift/SEA, but unusable on the kernel: it's an opaque token
     #    source with no extractable client_id/secret, so the kernel
     #    can't own the token lifecycle. Point the caller at the raw
@@ -368,7 +375,7 @@ def kernel_auth_kwargs(
             "credentials_provider."
         )
 
-    # 5. Everything else (including no usable credentials at all —
+    # 6. Everything else (including no usable credentials at all —
     #    ``auth_provider`` is None on the kernel path when no access
     #    token was supplied and no OAuth kwargs resolved above).
     provider_desc = (

tests/unit/test_kernel_auth_bridge.py

@@ -355,6 +355,20 @@ def test_jwt_plus_credentials_provider_is_rejected(self):
                 },
             )
 
+    def test_jwt_plus_databricks_oauth_auth_type_is_rejected(self):
+        # auth_type="databricks-oauth" signals U2M intent; a private key
+        # alongside it is ambiguous (mirrors the shared-secret M2M + U2M guard).
+        with pytest.raises(NotSupportedError, match="oauth_jwt_key_file"):
+            kernel_auth_kwargs(
+                None,
+                {
+                    "oauth_client_id": "sp",
+                    "oauth_jwt_key_file": "/k.pem",
+                    "oauth_jwt_kid": "k",
+                    "auth_type": "databricks-oauth",
+                },
+            )
+
     def test_federation_client_id_forwarded(self):
         kwargs = kernel_auth_kwargs(
             _FakeOAuthProvider(),