fix(jobs): remove non-functional OBO support

docs/docs/plugins/jobs.md

@@ -12,7 +12,6 @@ Trigger and monitor [Databricks Lakeflow Jobs](https://docs.databricks.com/en/jo
 - Run-and-wait with SSE streaming status updates
 - Parameter validation with Zod schemas
 - Task-type-aware parameter mapping (notebook, python_wheel, sql, etc.)
-- Optional on-behalf-of (OBO) user execution via `.asUser(req)`
 
 ## Basic usage
 
@@ -123,18 +122,7 @@ When `taskType` is omitted, parameters are passed through to the SDK as-is.
 
 ## Execution context
 
-HTTP routes run as the **app's service principal** by default. Jobs are typically shared infrastructure, and the app's resource binding (`databricks.yml`) grants `CAN_MANAGE_RUN` to the SP — so users trigger runs without needing individual grants.
-
-Per-run attribution in the Jobs UI will show the app's SP, not the human user. If you need user-level attribution (or want the Databricks permission check to use the user's grants), opt in to OBO explicitly in a custom handler via `.asUser(req)`:
-
-```ts
-// Default: runs as the app's service principal
-const result = await AppKit.jobs("etl").runNow({ startDate: "2025-01-01" });
-
-// Opt-in: runs as the logged-in user (requires `jobs.jobs` in
-// `databricks.yml` user_api_scopes AND the user's own CAN_MANAGE_RUN grant)
-const result = await AppKit.jobs("etl").asUser(req).runNow({ startDate: "2025-01-01" });
-```
+Jobs always run as the **app's service principal**. The app's resource binding (`databricks.yml`) grants `CAN_MANAGE_RUN` to the SP, so users trigger runs without needing individual grants. Per-run attribution in the Jobs UI shows the app's SP, not the human user.
 
 ## HTTP endpoints
 

packages/appkit/src/index.ts

@@ -74,7 +74,6 @@ export type {
   IJobsConfig,
   JobAPI,
   JobConfig,
-  JobHandle,
   JobsExport,
 } from "./plugins/jobs";
 export type {

packages/appkit/src/plugins/jobs/index.ts

@@ -1,8 +1,2 @@
 export { jobs } from "./plugin";
-export type {
-  IJobsConfig,
-  JobAPI,
-  JobConfig,
-  JobHandle,
-  JobsExport,
-} from "./types";
+export type { IJobsConfig, JobAPI, JobConfig, JobsExport } from "./types";

packages/appkit/src/plugins/jobs/plugin.ts

@@ -1,7 +1,6 @@
 import { STATUS_CODES } from "node:http";
 import type express from "express";
 import type {
-  IAppRequest,
   IAppRouter,
   PluginExecutionSettings,
   StreamExecutionSettings,
@@ -27,7 +26,6 @@ import type {
   IJobsConfig,
   JobAPI,
   JobConfig,
-  JobHandle,
   JobRunStatus,
   JobsExport,
 } from "./types";
@@ -256,10 +254,7 @@ class JobsPlugin extends Plugin {
     const jobConfig = this.jobConfigs[jobKey];
     // Capture `this` for use in the async generator
     const self = this;
-    // Eagerly capture the client and userId so that when createJobAPI is
-    // called inside an asUser() proxy (which runs in user context), the
-    // closures below use the user-scoped client instead of falling back
-    // to the service principal when the ALS context has already exited.
+    // Capture client and userId eagerly: the closures below run later, after the ALS context may have exited.
     const client = this.client;
     const userKey = getCurrentUserId();
 
@@ -728,22 +723,14 @@ class JobsPlugin extends Plugin {
   }
 
   exports(): JobsExport {
-    const resolveJob = (jobKey: string): JobHandle => {
+    const resolveJob = (jobKey: string): JobAPI => {
       if (!this.jobKeys.includes(jobKey)) {
         throw new Error(
           `Unknown job "${jobKey}". Available jobs: ${this.jobKeys.join(", ")}`,
         );
       }
 
-      const spApi = this.createJobAPI(jobKey);
-
-      return {
-        ...spApi,
-        asUser: (req: IAppRequest) => {
-          const userPlugin = this.asUser(req) as JobsPlugin;
-          return userPlugin.createJobAPI(jobKey);
-        },
-      };
+      return this.createJobAPI(jobKey);
     };
 
     return resolveJob as JobsExport;

packages/appkit/src/plugins/jobs/tests/plugin.test.ts

@@ -2,7 +2,6 @@ import { mockServiceContext, setupDatabricksEnv } from "@tools/test-helpers";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { z } from "zod";
 import { ServiceContext } from "../../../context/service-context";
-import { AuthenticationError } from "../../../errors";
 import { ResourceType } from "../../../registry";
 import {
   JOBS_READ_DEFAULTS,
@@ -248,14 +247,13 @@ describe("JobsPlugin", () => {
       expect(typeof exported).toBe("function");
     });
 
-    test("returns job handle with asUser and direct JobAPI methods", () => {
+    test("returns job handle with direct JobAPI methods", () => {
       process.env.DATABRICKS_JOB_ETL = "123";
 
       const plugin = new JobsPlugin({});
       const exported = plugin.exports();
 
       const handle = exported("etl");
-      expect(typeof handle.asUser).toBe("function");
       expect(typeof handle.runNow).toBe("function");
       expect(typeof handle.runAndWait).toBe("function");
       expect(typeof handle.lastRun).toBe("function");
@@ -741,76 +739,6 @@ describe("JobsPlugin", () => {
     });
   });
 
-  describe("OBO and service principal access", () => {
-    test("job handle exposes asUser and all JobAPI methods", () => {
-      process.env.DATABRICKS_JOB_ETL = "123";
-
-      const plugin = new JobsPlugin({});
-      const handle = plugin.exports()("etl");
-
-      expect(typeof handle.asUser).toBe("function");
-
-      const jobMethods = [
-        "runNow",
-        "runAndWait",
-        "lastRun",
-        "listRuns",
-        "getRun",
-        "getRunOutput",
-        "cancelRun",
-        "getJob",
-      ];
-      for (const method of jobMethods) {
-        expect(typeof (handle as any)[method]).toBe("function");
-      }
-    });
-
-    test("asUser throws AuthenticationError without token in production", () => {
-      const originalEnv = process.env.NODE_ENV;
-      process.env.NODE_ENV = "production";
-      process.env.DATABRICKS_JOB_ETL = "123";
-
-      try {
-        const plugin = new JobsPlugin({});
-        const handle = plugin.exports()("etl");
-        const mockReq = { header: () => undefined } as any;
-
-        expect(() => handle.asUser(mockReq)).toThrow(AuthenticationError);
-      } finally {
-        process.env.NODE_ENV = originalEnv;
-      }
-    });
-
-    test("asUser in dev mode returns JobAPI with all methods", () => {
-      const originalEnv = process.env.NODE_ENV;
-      process.env.NODE_ENV = "development";
-      process.env.DATABRICKS_JOB_ETL = "123";
-
-      try {
-        const plugin = new JobsPlugin({});
-        const handle = plugin.exports()("etl");
-        const mockReq = { header: () => undefined } as any;
-        const api = handle.asUser(mockReq);
-
-        const jobMethods = [
-          "runNow",
-          "runAndWait",
-          "lastRun",
-          "listRuns",
-          "getRun",
-          "getRunOutput",
-          "cancelRun",
-          "getJob",
-        ];
-        for (const method of jobMethods) {
-          expect(typeof (api as any)[method]).toBe("function");
-        }
-      } finally {
-        process.env.NODE_ENV = originalEnv;
-      }
-    });
-  });
-
   describe("clientConfig", () => {
     test("returns configured job keys with params schema", () => {
       process.env.DATABRICKS_JOB_ETL = "123";
@@ -1990,57 +1918,4 @@ describe("injectRoutes", () => {
       expect(mockRes.end).not.toHaveBeenCalled();
     });
   });
-
-  describe("execution context", () => {
-    test("HTTP routes run as service principal by default (no asUser)", async () => {
-      process.env.DATABRICKS_JOB_ETL = "123";
-
-      mockClient.jobs.listRuns.mockReturnValue((async function* () {})());
-
-      const plugin = new JobsPlugin({});
-      const asUserSpy = vi.spyOn(plugin, "asUser");
-      const routeSpy = vi.spyOn(plugin as any, "route");
-
-      const mockRouter = { get: vi.fn(), post: vi.fn(), delete: vi.fn() };
-      plugin.injectRoutes(mockRouter as any);
-
-      const runsRoute = routeSpy.mock.calls.find(
-        (call) => (call[1] as any).name === "runs",
-      );
-      const handler = (runsRoute?.[1] as any).handler;
-
-      const mockReq = {
-        params: { jobKey: "etl" },
-        query: {},
-        header: vi.fn().mockReturnValue("test-token"),
-      } as any;
-
-      const mockRes = {
-        status: vi.fn().mockReturnThis(),
-        json: vi.fn(),
-      } as any;
-
-      await handler(mockReq, mockRes);
-
-      // Route handlers should not implicitly call asUser — callers opt into
-      // OBO via the programmatic `exports().asUser(req)` surface.
-      expect(asUserSpy).not.toHaveBeenCalled();
-    });
-
-    test("programmatic exports().asUser(req) still delegates through asUser", () => {
-      process.env.DATABRICKS_JOB_ETL = "123";
-
-      const plugin = new JobsPlugin({});
-      const asUserSpy = vi.spyOn(plugin, "asUser");
-      const handle = plugin.exports()("etl");
-
-      const mockReq = {
-        header: vi.fn().mockReturnValue("test-token"),
-      } as any;
-
-      handle.asUser(mockReq);
-
-      expect(asUserSpy).toHaveBeenCalledWith(mockReq);
-    });
-  });
 });

packages/appkit/src/plugins/jobs/types.ts

@@ -1,4 +1,4 @@
-import type { BasePluginConfig, IAppRequest } from "shared";
+import type { BasePluginConfig } from "shared";
 import type { z } from "zod";
 import type { ExecutionResult } from "../../plugin";
 import type { jobs } from "../../workspace-client";
@@ -66,14 +66,6 @@ export interface IJobsConfig extends BasePluginConfig {
   jobs?: Record<string, JobConfig>;
 }
 
-/**
- * Job handle returned by `appkit.jobs("etl")`.
- * Supports OBO access via `.asUser(req)`.
- */
-export type JobHandle = JobAPI & {
-  asUser: (req: IAppRequest) => JobAPI;
-};
-
 /**
  * Public API shape of the jobs plugin.
  * Callable to select a job by key.
@@ -87,9 +79,6 @@ export type JobHandle = JobAPI & {
  * for await (const status of appkit.jobs("etl").runAndWait()) {
  *   console.log(status.status, status.run);
  * }
- *
- * // OBO access
- * await appkit.jobs("etl").asUser(req).runNow();
  * ```
  */
-export type JobsExport = (jobKey: string) => JobHandle;
+export type JobsExport = (jobKey: string) => JobAPI;