feat: what to check when access is refused, as a list, for Databricks too

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/databricks/databricks.go

@@ -317,15 +317,47 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return v, nil
 }
 
+// deniedChecks are what to check when Databricks refuses: the network,
+// when the workspace's IP access list refused, else access.
+func deniedChecks(msg string) []string {
+	if strings.Contains(msg, "IP ACL") || strings.Contains(msg, "IP access list") {
+		return []string{
+			"you're on a network the workspace lets in (VPN, office)",
+			"the workspace's admin has let your network in",
+		}
+	}
+	return []string{
+		"you have access to the workspace",
+		"the scope's manager has given you READ on it, or a group you're in",
+	}
+}
+
 var errNoFallback = errors.New("no Key Vault fallback")
 
-// combine reports both the Databricks and the Key Vault failure. An auth
-// error from either stays reachable with errors.As.
+// combine reports both the Databricks and the Key Vault failure, with
+// both their checks after. An auth error from either stays reachable
+// with errors.As.
 func combine(dbxErr, kvErr error) error {
 	if errors.Is(kvErr, errNoFallback) {
 		return dbxErr
 	}
-	return fmt.Errorf("%w; Key Vault fallback: %w", dbxErr, kvErr)
+	var checks []string
+	strip := func(err error) error {
+		if d, ok := err.(*provider.Denied); ok {
+			for _, c := range d.Checks {
+				if !slices.Contains(checks, c) {
+					checks = append(checks, c)
+				}
+			}
+			return d.Err
+		}
+		return err
+	}
+	err := fmt.Errorf("%w; Key Vault fallback: %w", strip(dbxErr), strip(kvErr))
+	if len(checks) > 0 {
+		return &provider.Denied{Err: err, Checks: checks}
+	}
+	return err
 }
 
 // classify turns authentication failures into *provider.AuthError: a 401
@@ -336,6 +368,9 @@ func classify(pr profile, err error) error {
 	}
 	var api *apierr.APIError
 	if errors.As(err, &api) {
+		if api.StatusCode == 403 {
+			return &provider.Denied{Err: err, Checks: deniedChecks(api.Message)}
+		}
 		if api.StatusCode != 401 {
 			return err
 		}