feat(database): support shared databases (FROM SHARE) and IMPORTED PRIVILEGES grants#39
Open
GClunies wants to merge 1 commit into
Open
feat(database): support shared databases (FROM SHARE) and IMPORTED PRIVILEGES grants#39GClunies wants to merge 1 commit into
GClunies wants to merge 1 commit into
Conversation
…IVILEGES grants Databases created from inbound shares (direct shares and Marketplace listings) previously had to be managed with manual SQL. Activate the dormant SharedDatabase resource as a polymorphic sibling of Database under ResourceType.DATABASE, resolved by the presence of from_share, and enable IMPORTED PRIVILEGES so the RBAC around shared databases can live in YAML. - SharedDatabase: CREATE DATABASE <name> FROM SHARE <provider>.<share>, declared under the existing databases: key via from_share. Read-only by design: no schemas, tags, or params; not a ResourceContainer. Creation runs as ACCOUNTADMIN since FROM SHARE requires IMPORT SHARE. - IMPORTED PRIVILEGES: enabled in DatabasePriv, excluded from ALL expansion (only valid on shared databases). fetch_grant handles Snowflake reporting the grant as USAGE in SHOW GRANTS, gated on the database actually being imported so a mistaken declaration on a regular database still surfaces as drift. - Fetch round-trip: fetch_database delegates to fetch_shared_database for kind IMPORTED DATABASE. A declared class that disagrees with the fetched kind raises a clear error instead of a TypeError that aborts the whole plan. - Blueprint guards: container-only attach/merge paths raise OrphanResourceException with guidance when the target is a shared database; the PUBLIC-schema ownership transfer is skipped for shared databases. Changing from_share errors at plan time (replacement is not implemented) - documented in the resource docs. - Docs: new resources/shared_database.md page, SUMMARY.md entry, and an IMPORTED PRIVILEGES example in grant.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Shared databases (direct shares and Marketplace listings) and the
IMPORTED PRIVILEGESgrant can now be managed in snowcap instead of manual SQL. Activates the dormantSharedDatabaseresource as a polymorphic sibling ofDatabase(samedatabases:YAML key, discriminated byfrom_share) and wires the full fetch/plan round-trip.Closes #28.
Changes
SharedDatabaseresource:CREATE DATABASE <name> FROM SHARE <provider_account>.<share_name>; read-only by design (no schemas/tags/params), default ownerACCOUNTADMIN, created asACCOUNTADMINsinceFROM SHARErequiresIMPORT SHARE.IMPORTED PRIVILEGESenabled inDatabasePriv, excluded fromALLexpansion;fetch_granthandles Snowflake reporting the grant asUSAGEinSHOW GRANTS, gated on the database actually being imported so a mistaken declaration on a regular database still surfaces as drift.fetch_databasedelegates tofetch_shared_databaseforkind = IMPORTED DATABASE; a declared class that disagrees with the fetched kind raises a clear, actionable error instead of aborting the whole plan with aTypeError.OrphanResourceExceptionwith guidance when the target is a shared database; PUBLIC-schema ownership transfer skipped for shared databases; changingfrom_shareerrors at plan time (replacement not implemented — documented).docs/resources/shared_database.md,SUMMARY.mdnav entry,IMPORTED PRIVILEGESexample ingrant.md.ResourceName).Notes for reviewers
SYSTEM()output fields are undocumented; whetherowneris present in all editions needs a live-account check (fetch relies on it via_get_owner_identifier).