Add Grants to BigQuery Materializations

dbt/adapters/bigquery/impl.py

@@ -261,6 +261,29 @@ def list_relations_without_caching(
             logger.debug("list_relations_without_caching error: {}".format(str(exc)))
             return []
 
+    @available
+    def standardize_grants_dict(self, grants_table: agate.Table) -> dict:
+        """Translate the result of `show grants` (or equivalent) to match the
+        grants which a user would configure in their project.
+
+        If relevant -- filter down to grants made BY the current user role,
+        and filter OUT any grants TO the current user/role (e.g. OWNERSHIP).
+
+        :param grants_table: An agate table containing the query result of
+            the SQL returned by get_show_grant_sql
+        :return: A standardized dictionary matching the `grants` config
+        :rtype: dict
+        """
+        grants_dict: Dict[str, List] = {}
+        for row in grants_table:
+            grantee = row["grantee"]
+            privilege = row["privilege_type"]
+            if privilege in grants_dict.keys():
+                grants_dict[privilege].append(grantee)
+            else:
+                grants_dict.update({privilege: [grantee]})
+        return grants_dict
+
     def get_relation(self, database: str, schema: str, identifier: str) -> BigQueryRelation:
         if self._schema_is_cached(database, schema):
             # if it's in the cache, use the parent's model of going through

dbt/include/bigquery/macros/adapters/apply_grants.sql

@@ -0,0 +1,28 @@
+{% macro  bigquery__get_show_grant_sql(relation) %}
+    {% if not target.location %}
+        {{ exceptions.raise_compiler_error("In order to use the grants feature, you must specify a location ") }}
+    {% endif %}
+
+    select privilege_type, grantee from {{ relation.project }}.`region-{{ target.location }}`.INFORMATION_SCHEMA.OBJECT_PRIVILEGES
+    where object_schema = "{{ relation.dataset }}" and object_name = "{{ relation.identifier }}" and split(grantee, ':')[offset(1)] != session_user()
+{% endmacro %}
+
+
+{%- macro bigquery__get_grant_sql(relation, grant_config) -%}
+    {%- for privilege in grant_config.keys() -%}
+        {%- set grantees = grant_config[privilege] -%}
+        {%- if grantees -%}
+            grant `{{ privilege }}` on {{ relation.type }} {{ relation }} to {{ '\"' + grantees|join('\", \"') + '\"' }};
+        {% endif -%}
+    {%- endfor -%}
+{%- endmacro %}
+
+
+{% macro bigquery__get_revoke_sql(relation, grant_config) %}
+    {%- for privilege in grant_config.keys() -%}
+        {%- set grantees = grant_config[privilege] -%}
+        {%- if grantees -%}
+            revoke `{{ privilege }}` on {{ relation.type }} {{ relation }} from {{ '\"' + grantees|join('\", \"') + '\"' }};
+        {% endif -%}
+    {%- endfor -%}
+{%- endmacro -%}

dbt/include/bigquery/macros/materializations/copy.sql

@@ -16,7 +16,7 @@
     {{ source_array.append(source(*src_table)) }}
   {% endfor %}
 
-  {# Call adapter's copy_table function #}
+  {# Call adapter copy_table function #}
   {%- set result_str = adapter.copy_table(
       source_array,
       destination,
@@ -26,6 +26,7 @@
 
   {# Clean up #}
   {{ run_hooks(post_hooks) }}
+  {%- do apply_grants(target_relation, grant_config) -%}
   {{ adapter.commit() }}
 
   {{ return({'relations': [destination]}) }}

dbt/include/bigquery/macros/materializations/incremental.sql

@@ -143,7 +143,7 @@
   {%- set tmp_relation = make_temp_relation(this) %}
 
   {#-- Validate early so we don't run SQL if the strategy is invalid --#}
-  {% set strategy = dbt_bigquery_validate_get_incremental_strategy(config) -%}
+  {%- set strategy = dbt_bigquery_validate_get_incremental_strategy(config) -%}
 
   {%- set raw_partition_by = config.get('partition_by', none) -%}
   {%- set partition_by = adapter.parse_partition_by(raw_partition_by) -%}
@@ -152,6 +152,9 @@
 
   {% set on_schema_change = incremental_validate_on_schema_change(config.get('on_schema_change'), default='ignore') %}
 
+   -- grab current tables grants config for comparision later on
+  {% set grant_config = config.get('grants') %}
+
   {{ run_hooks(pre_hooks) }}
 
   {% if existing_relation is none %}
@@ -197,6 +200,8 @@
 
   {% set target_relation = this.incorporate(type='table') %}
 
+  {% do apply_grants(target_relation, grant_config) %}
+
   {% do persist_docs(target_relation, model) %}
 
   {{ return({'relations': [target_relation]}) }}

dbt/include/bigquery/macros/materializations/table.sql

@@ -5,6 +5,9 @@
   {%- set exists_not_as_table = (old_relation is not none and not old_relation.is_table) -%}
   {%- set target_relation = api.Relation.create(database=database, schema=schema, identifier=identifier, type='table') -%}
 
+  -- grab current tables grants config for comparision later on
+  {%- set grant_config = config.get('grants') -%}
+
   {{ run_hooks(pre_hooks) }}
 
   {#
@@ -30,6 +33,8 @@
 
   {{ run_hooks(post_hooks) }}
 
+  {%- do apply_grants(target_relation, grant_config) -%}
+
   {% do persist_docs(target_relation, model) %}
 
   {{ return({'relations': [target_relation]}) }}

dbt/include/bigquery/macros/materializations/view.sql

@@ -9,9 +9,13 @@
 
 
 {% materialization view, adapter='bigquery' -%}
+    -- grab current tables grants config for comparision later on
+    {% set grant_config = config.get('grants') %}
+
     {% set to_return = create_or_replace_view() %}
 
     {% set target_relation = this.incorporate(type='view') %}
+    {% do apply_grants(target_relation, grant_config) %}
     {% do persist_docs(target_relation, model) %}
 
     {% if config.get('grant_access_to') %}

dev-requirements.txt

@@ -1,7 +1,12 @@
 # install latest changes in dbt-core
 # TODO: how to automate switching from develop to version branches?
-git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-core&subdirectory=core
-git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-tests-adapter&subdirectory=tests/adapter
+
+git+https://github.com/dbt-labs/dbt-core.git@ct-660-grant-sql#egg=dbt-core&subdirectory=core
+git+https://github.com/dbt-labs/dbt-core.git@ct-660-grant-sql#egg=dbt-tests-adapter&subdirectory=tests/adapter
+
+# TODO: replace above with this after dbt-core/#5263  gets merged to main
+# git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-core&subdirectory=core
+# git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-tests-adapter&subdirectory=tests/adapter
 
 black==22.6.0
 bumpversion