Ct 716 add grants to materializations

.github/workflows/integration.yml

@@ -173,6 +173,9 @@ jobs:
  SNOWFLAKE_TEST_DATABASE: ${{ secrets.SNOWFLAKE_TEST_DATABASE }}
  SNOWFLAKE_TEST_QUOTED_DATABASE: ${{ secrets.SNOWFLAKE_TEST_QUOTED_DATABASE }}
  SNOWFLAKE_TEST_ROLE: ${{ secrets.SNOWFLAKE_TEST_ROLE }}
+ DBT_TEST_USER_1: ${{ secrets.DBT_TEST_USER_1 }}
+ DBT_TEST_USER_2: ${{ secrets.DBT_TEST_USER_2 }}
+ DBT_TEST_USER_3: ${{ secrets.DBT_TEST_USER_3 }}
  run: tox
 
  - uses: actions/upload-artifact@v2

dbt/adapters/snowflake/impl.py

@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import Mapping, Any, Optional, List, Union
+from typing import Mapping, Any, Optional, List, Union, Dict
 
 import agate
 
@@ -9,6 +9,7 @@
  LIST_SCHEMAS_MACRO_NAME,
  LIST_RELATIONS_MACRO_NAME,
 )
+from dbt.adapters.base.meta import available
 from dbt.adapters.snowflake import SnowflakeConnectionManager
 from dbt.adapters.snowflake import SnowflakeRelation
 from dbt.adapters.snowflake import SnowflakeColumn
@@ -158,5 +159,19 @@ def quote_seed_column(self, column: str, quote_config: Optional[bool]) -> str:
  else:
  return column
 
+ @available
+ def standardize_grants_dict(self, grants_table: agate.Table) -> dict:
+ grants_dict: Dict[str, Any] = {}
+
+ for row in grants_table:
+ grantee = row["grantee_name"]
+ privilege = row["privilege"]
+ if privilege != "OWNERSHIP":
+ if privilege in grants_dict.keys():
+ grants_dict[privilege].append(grantee)
+ else:
+ grants_dict.update({privilege: [grantee]})
+ return grants_dict
+
  def timestamp_add_sql(self, add_to: str, number: int = 1, interval: str = "hour") -> str:
  return f"DATEADD({interval}, {number}, {add_to})"

dbt/include/snowflake/macros/adapters.sql

@@ -293,3 +293,8 @@
  {{ snowflake_dml_explicit_transaction(truncate_dml) }}
  {%- endcall %}
 {% endmacro %}
+
+{% macro snowflake__copy_grants() %}
+ {% set copy_grants = config.get('copy_grants', False) %}
+ {{ return(copy_grants) }}
+{% endmacro %}

dbt/include/snowflake/macros/materializations/incremental.sql

@@ -35,6 +35,8 @@
  {% set existing_relation = load_relation(this) %}
  {% set tmp_relation = make_temp_relation(this) %}
 
+ {% set grant_config = config.get('grants') %}
+
  {#-- Validate early so we don't run SQL if the strategy is invalid --#}
  {% set strategy = dbt_snowflake_validate_get_incremental_strategy(config) -%}
  {% set on_schema_change = incremental_validate_on_schema_change(config.get('on_schema_change'), default='ignore') %}
@@ -74,6 +76,11 @@
  {{ run_hooks(post_hooks) }}
 
  {% set target_relation = target_relation.incorporate(type='table') %}
+
+ {% set should_revoke =
+ should_revoke(existing_relation.is_table, full_refresh_mode) %}
+ {% do apply_grants(target_relation, grant_config, should_revoke=should_revoke) %}
+
  {% do persist_docs(target_relation, model) %}
 
  {% do unset_query_tag(original_query_tag) %}

dbt/include/snowflake/macros/materializations/snapshot.sql

@@ -1,6 +1,5 @@
 {% materialization snapshot, adapter='snowflake' %}
  {% set original_query_tag = set_query_tag() %}
-
  {% set relations = materialization_snapshot_default() %}
 
  {% do unset_query_tag(original_query_tag) %}

dbt/include/snowflake/macros/materializations/table.sql

@@ -4,6 +4,8 @@
 
  {%- set identifier = model['alias'] -%}
 
+ {% set grant_config = config.get('grants') %}
+
  {%- set old_relation = adapter.get_relation(database=database, schema=schema, identifier=identifier) -%}
  {%- set target_relation = api.Relation.create(identifier=identifier,
  schema=schema,
@@ -25,6 +27,9 @@
 
  {{ run_hooks(post_hooks) }}
 
+ {% set should_revoke = should_revoke(old_relation, full_refresh_mode=True) %}
+ {% do apply_grants(target_relation, grant_config, should_revoke=should_revoke) %}
+
  {% do persist_docs(target_relation, model) %}
 
  {% do unset_query_tag(original_query_tag) %}

dbt/include/snowflake/macros/materializations/view.sql

@@ -4,6 +4,7 @@
  {% set to_return = create_or_replace_view() %}
 
  {% set target_relation = this.incorporate(type='view') %}
+
  {% do persist_docs(target_relation, model, for_columns=false) %}
 
  {% do return(to_return) %}

dev-requirements.txt

@@ -1,7 +1,11 @@
 # install latest changes in dbt-core
 # TODO: how to automate switching from develop to version branches?
-git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-core&subdirectory=core
-git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-tests-adapter&subdirectory=tests/adapter
+git+https://github.com/dbt-labs/dbt-core.git@ct-660-grant-sql#egg=dbt-core&subdirectory=core
+git+https://github.com/dbt-labs/dbt-core.git@ct-660-grant-sql#egg=dbt-tests-adapter&subdirectory=tests/adapter
+
+# TODO: revert back to main pointer after PR's 5447, and 5369 are merged into core.
+# git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-core&subdirectory=core
+# git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-tests-adapter&subdirectory=tests/adapter
 
 black==22.3.0
 click~=8.0.4

test.env.example

@@ -29,3 +29,7 @@ SNOWFLAKE_TEST_PASSWORD=my_password
 SNOWFLAKE_TEST_QUOTED_DATABASE=my_quoted_database_name
 SNOWFLAKE_TEST_USER=my_username
 SNOWFLAKE_TEST_WAREHOUSE=my_warehouse_name
+
+DBT_TEST_USER_1=dbt_test_role_1
+DBT_TEST_USER_2=dbt_test_role_2
+DBT_TEST_USER_3=dbt_test_role_3

tests/functional/adapter/test_grants.py

@@ -0,0 +1,6 @@
+import pytest
+
+from dbt.tests.adapter.grants.test_models import TestModelGrants
+
+class TestModelGrantsSnowflake(TestModelGrants):
+ pass