fix(kernel): forward token_url on shared-secret M2M too (JDBC parity)

Address peco-review-bot: the CONNECTION_PARAMETERS.md row said token_url
"applies to shared-secret M2M too", but the bridge only forwarded it on
the JWT branch — so an oauth_client_id + oauth_client_secret + token_url
connection silently dropped token_url.

token_url is an auth-method-agnostic token-endpoint override: JDBC's
OAuth2ConnAuthTokenEndpoint is consumed by the client-secret M2M provider,
the JWT provider, and the refresh provider alike; the Node driver also
forwards it on both branches; and the kernel's oauth-m2m auth_type accepts
it (pyo3). Forward it on the shared-secret M2M branch so code matches the
doc and the other drivers. Adds a unit test.

Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>

Author: rahuls-db

src/databricks/sql/backend/kernel/auth_bridge.py

@@ -312,6 +312,12 @@ def kernel_auth_kwargs(
         scopes = _normalize_scopes(opts.get("oauth_scopes"))
         if scopes is not None:
             kwargs["oauth_scopes"] = scopes
+        # token_url is an auth-method-agnostic token-endpoint override (JDBC's
+        # OAuth2ConnAuthTokenEndpoint applies it to client-secret M2M too), so
+        # forward it here as well as on the JWT path.
+        token_url = opts.get("token_url")
+        if token_url:
+            kwargs["token_url"] = token_url
         if federation_client_id:
             kwargs["identity_federation_client_id"] = federation_client_id
         return kwargs

tests/unit/test_kernel_auth_bridge.py

@@ -213,6 +213,19 @@ def test_m2m_includes_scopes_when_provided(self):
         )
         assert kwargs["oauth_scopes"] == ["all-apis", "sql"]
 
+    def test_m2m_forwards_token_url(self):
+        # token_url is an auth-agnostic token-endpoint override (JDBC parity),
+        # so the shared-secret M2M path forwards it too — not just JWT.
+        kwargs = kernel_auth_kwargs(
+            _FakeOAuthProvider(),
+            {
+                "oauth_client_id": "sp-uuid",
+                "oauth_client_secret": "shh",
+                "token_url": "https://login.microsoftonline.com/t/oauth2/v2.0/token",
+            },
+        )
+        assert kwargs["token_url"] == "https://login.microsoftonline.com/t/oauth2/v2.0/token"
+
     def test_m2m_normalizes_space_delimited_scopes(self):
         # DatabricksOAuthProvider stores scopes as a single
         # space-delimited string; the bridge splits it to a list.