Add Grant SQL Macros

core/dbt/include/global_project/macros/adapters/apply_grants.sql

@@ -0,0 +1,50 @@
+{% macro get_show_grant_sql(relation) %}
+{{ return(adapter.dispatch("get_show_grant_sql", "dbt")(relation)) }}
+{% endmacro %}
+
+{% macro default__get_show_grant_sql(relation) %}
+show grants on {{ relation.type }} {{ relation }}
+{% endmacro %}
+
+{% macro get_grant_sql(relation, grant_config) %}
+{{ return(adapter.dispatch('get_grant_sql', 'dbt')(relation, grant_config)) }}
+{% endmacro %}
+
+{% macro default__get_grant_sql(relation, grant_config) %}
+ {% for privilege in grant_config.keys() %}
+ {% set grantee = grant_config[privilege] %}
+ grant {{ privilege }} on {{ relation.type }} {{ relation }} to {{ grantee | join(', ') }}
+ {% endfor %}
+{% endmacro %}
+
+{% macro get_revoke_sql(relation, grant_config) %}
+{{ return(adapter.dispatch("get_revoke_sql", "dbt")(relation, grant_config)) }}
+{% endmacro %}
+
+{% macro default__get_revoke_sql(relation, grant_config) %}
+ {% for privilege in grant_config.keys() %}
+ {% set grantee = grant_config[privilege] %}
+ revoke {{ privilege }} on {{ relation.type }} {{ relation }} from {{ grantee | join(', ') }}
+ where {{ grantee }} != {{ target.user }}
+ {% endfor %}
+{% endmacro %}
+
+{% macro apply_grants(relation, grant_config, should_revoke) %}
+{{ return(adapter.dispatch("apply_grants", "dbt")(relation, grant_config, should_revoke)) }}
+{% endmacro %}
+
+{% macro default__apply_grants(relation, grant_config, should_revoke=True) %}
+{% if grant_config %}
+ {% call statement('grants') %}
+ {% if should_revoke %}
+ {% set current_grants = run_query(get_show_grant_sql(relation)) %}
+ {{ log(current_grants, info = true) }}
+ {% set diff_grants = { k: current_grants[k] for k in set(current_grants) - set(grant_config) } %}
+
+ {{ log(diff_grants, info = true) }}
+ {{ get_revoke_sql(relation, diff_grants) }}
+ {% endif %}
+ {{ get_grant_sql(relation, grant_config) }}
+ {% endcall %}
+{% endif %}
+{% endmacro %}

core/dbt/include/global_project/macros/materializations/models/incremental/incremental.sql

@@ -20,6 +20,8 @@
  -- BEGIN, in a separate transaction
  {%- set preexisting_intermediate_relation = load_cached_relation(intermediate_relation)-%}
  {%- set preexisting_backup_relation = load_cached_relation(backup_relation) -%}
+ -- grab current tables grants config for comparision later on
+ {% set grant_config = config.get('grants') %}
  {{ drop_relation_if_exists(preexisting_intermediate_relation) }}
  {{ drop_relation_if_exists(preexisting_backup_relation) }}
 
@@ -59,6 +61,9 @@
  {% do to_drop.append(backup_relation) %}
  {% endif %}
 
+ {{ log(grant_config, "what grants are we passing") }}
+ {% do apply_grants(target_relation, grant_config) %}
+
  {% do persist_docs(target_relation, model) %}
 
  {% if existing_relation is none or existing_relation.is_view or should_full_refresh() %}

core/dbt/include/global_project/macros/materializations/models/table/table.sql

@@ -14,6 +14,8 @@
  {%- set backup_relation = make_backup_relation(target_relation, backup_relation_type) -%}
  -- as above, the backup_relation should not already exist
  {%- set preexisting_backup_relation = load_cached_relation(backup_relation) -%}
+ -- grab current tables grants config for comparision later on
+ {% set grant_config = config.get('grants') %}
 
  -- drop the temp relations if they exist already in the database
  {{ drop_relation_if_exists(preexisting_intermediate_relation) }}
@@ -39,7 +41,8 @@
  {% do create_indexes(target_relation) %}
 
  {{ run_hooks(post_hooks, inside_transaction=True) }}
-
+ {{ log(grant_config, "what grants are we passing") }}
+ {% do apply_grants(target_relation, grant_config) %}
  {% do persist_docs(target_relation, model) %}
 
  -- `COMMIT` happens here

core/dbt/include/global_project/macros/materializations/models/view/view.sql

@@ -25,6 +25,8 @@
  {%- set backup_relation = make_backup_relation(target_relation, backup_relation_type) -%}
  -- as above, the backup_relation should not already exist
  {%- set preexisting_backup_relation = load_cached_relation(backup_relation) -%}
+ -- grab current tables grants config for comparision later on
+ {% set grant_config = config.get('grants') %}
 
  {{ run_hooks(pre_hooks, inside_transaction=False) }}
 
@@ -47,6 +49,9 @@
  {% endif %}
  {{ adapter.rename_relation(intermediate_relation, target_relation) }}
 
+ {{ log(grant_config, "what grants are we passing") }}
+ {% do apply_grants(target_relation, grant_config) %}
+
  {% do persist_docs(target_relation, model) %}
 
  {{ run_hooks(post_hooks, inside_transaction=True) }}

core/dbt/include/global_project/macros/materializations/seeds/seed.sql

@@ -9,6 +9,9 @@
  {%- set exists_as_view = (old_relation is not none and old_relation.is_view) -%}
 
  {%- set agate_table = load_agate_table() -%}
+ -- grab current tables grants config for comparision later on
+ {% set grant_config = config.get('grants') %}
+
  {%- do store_result('agate_table', response='OK', agate_table=agate_table) -%}
 
  {{ run_hooks(pre_hooks, inside_transaction=False) }}
@@ -35,6 +38,8 @@
  {% endcall %}
 
  {% set target_relation = this.incorporate(type='table') %}
+ {{ log(grant_config, "what grants are we passing") }}
+ {% do apply_grants(target_relation, grant_config) %}
  {% do persist_docs(target_relation, model) %}
 
  {% if full_refresh_mode or not exists_as_table %}

core/dbt/include/global_project/macros/materializations/snapshots/snapshot.sql

@@ -5,6 +5,8 @@
 
  {%- set strategy_name = config.get('strategy') -%}
  {%- set unique_key = config.get('unique_key') %}
+ -- grab current tables grants config for comparision later on
+ {% set grant_config = config.get('grants') %}
 
  {% set target_relation_exists, target_relation = get_or_create_relation(
  database=model.database,
@@ -72,7 +74,8 @@
  {% call statement('main') %}
  {{ final_sql }}
  {% endcall %}
-
+ {{ log(grant_config, "what grants are we passing") }}
+ {% do apply_grants(target_relation, grant_config) %}
  {% do persist_docs(target_relation, model) %}
 
  {% if not target_relation_exists %}