feat(dbt_project): support DBT PROJECT grants#25
Open
usbrandon wants to merge 1 commit into
Open
Conversation
Adds DBT PROJECT (dbt Projects on Snowflake) as a schema-scoped grantable
resource type so users can write:
grants:
- priv: USAGE
on: dbt project <db>.<schema>.<proj>
to: <runner_role>
- priv: MONITOR
on: dbt project <db>.<schema>.<proj>
to: <observer_role>
USAGE is required to EXECUTE DBT PROJECT and list/retrieve project files;
MONITOR exposes project details + run history in Snowsight. The schema-scope
priv CREATE DBT PROJECT is added to SchemaPriv for deploy-from-Workspace flows.
Changes (mirrors the CORTEX SEARCH SERVICE grant PR):
- ResourceType.DBT_PROJECT added to the enum (alphabetical).
- DbtProjectPriv(Priv) with ALL/MONITOR/OWNERSHIP/USAGE.
- PRIVS_FOR_RESOURCE_TYPE entry mapping the type to the priv class.
- SchemaPriv.CREATE_DBT_PROJECT added.
- RESOURCE_SCOPES entry registering SchemaScope() (INTEGRATION/Cortex
precedent: no concrete resource class yet, just enough to let
`priv: ... on: dbt project ...` parse and render).
- Unit tests: DbtProjectPriv enum values + end-to-end Grant SQL for USAGE
and MONITOR.
- Docs: docs/resources/dbt_project.md (new), grant.md example, mkdocs nav.
Full dbt project resource modeling (CREATE DBT PROJECT ... FROM <workspace>
with profiles/target config) is left for a future PR — this covers grants.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016L3b4GTh5nyFy5vxQ6e9TY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds DBT PROJECT (dbt Projects on Snowflake) as a schema-scoped grantable resource type:
USAGEexecutes the project (EXECUTE DBT PROJECT) and lists/retrieves its files;MONITORexposes project details + run history in Snowsight. Schema-scopeCREATE DBT PROJECTsupports deploy-from-Workspace.Change (mirrors the CORTEX SEARCH SERVICE grant support)
enums.py:ResourceType.DBT_PROJECT.privs.py:DbtProjectPriv(ALL/MONITOR/OWNERSHIP/USAGE),PRIVS_FOR_RESOURCE_TYPEentry,SchemaPriv.CREATE_DBT_PROJECT.resources/resource.py:RESOURCE_SCOPESSchemaScope()(grants only; no concrete resource class yet).data_provider.py:fetch_dbt_project()— needed to resolveon: dbt projectgrant references at plan time (SHOW DBT PROJECTS).TestDbtProjectPriv+test_grant_on_dbt_project.docs/resources/dbt_project.md,grant.mdexample,mkdocs.ymlnav.Validation
Verified end-to-end against a live account: created a dbt project object, and
GRANT USAGE/MONITOR ON DBT PROJECT ... TO ROLEplans + applies cleanly. Full dbt project resource modeling (CREATE DBT PROJECT ... FROM) is left for a future PR — this covers grants.🤖 Generated with Claude Code