Trim PAT token and reject internal whitespace with a coded error

[parthban-db]

🥞 Stacked PR

Use this link to review incremental changes.

• stack/bugbash-bug12-pat-error [Files changed] [MERGED]
  • stack/bugbash-bug7-pat-trim [Files changed]

---

Summary

newPatCredentials now trims surrounding whitespace from the token and rejects tokens containing internal whitespace. A token read with a trailing newline (e.g. $(cat token)) now produces a clean Bearer <token> header instead of a malformed one.

Why

Previously newPatCredentials only checked token === '' and interpolated the raw value straight into the header, so a token with a trailing newline silently produced Bearer dapiABC\n and the server rejected the request with an opaque auth failure. Trimming fixes the common newline case, and an explicit check turns the genuinely broken case (whitespace inside the token) into a fast, actionable error instead of a confusing server-side rejection.

What changed

• Trim leading/trailing whitespace from the token before building the Bearer header.
• Reject a token that is empty after trimming with PatCredentialsError('TOKEN_REQUIRED').
• Reject a token with internal whitespace with PatCredentialsError('TOKEN_MALFORMED').
• Builds on the exported PatCredentialsError introduced in [auth] Throw exported, coded PatCredentialsError from PAT credentials #186 (this branch adds the TOKEN_MALFORMED path and the trim logic).
• Adds table-driven test coverage for trailing-newline, surrounding-whitespace, whitespace-only, and internal-whitespace tokens in packages/auth/tests/credentials/pat.test.ts.
• Deliberately diverges from the Go SDK (config/auth_pat.go), which neither trims nor validates whitespace; the JS SDK surfaces the malformed-header failure to callers, so trimming plus a coded error is more useful here.

Validated: npm run build, npm test, npm run test:browser, npm run typecheck, and npm run lint for @databricks/sdk-auth all pass.

[github-actions]

Please ensure that the NEXT_CHANGELOG.md file is updated with any relevant changes.
If this is not necessary for your PR, please include the following in your PR description:
NO_CHANGELOG=true
and rerun the job.

[github-actions]

Please ensure that the NEXT_CHANGELOG.md file is updated with any relevant changes.
If this is not necessary for your PR, please include the following in your PR description:
NO_CHANGELOG=true
and rerun the job.