Ct 716 add grants to materializations

.github/workflows/integration.yml

@@ -173,6 +173,9 @@ jobs:
           SNOWFLAKE_TEST_DATABASE: ${{ secrets.SNOWFLAKE_TEST_DATABASE }}
           SNOWFLAKE_TEST_QUOTED_DATABASE: ${{ secrets.SNOWFLAKE_TEST_QUOTED_DATABASE }}
           SNOWFLAKE_TEST_ROLE: ${{ secrets.SNOWFLAKE_TEST_ROLE }}
+          DBT_TEST_USER_1: ${{ secrets.DBT_TEST_USER_1 }}
+          DBT_TEST_USER_2: ${{ secrets.DBT_TEST_USER_2 }}
+          DBT_TEST_USER_3: ${{ secrets.DBT_TEST_USER_3 }}
         run: tox
 
       - uses: actions/upload-artifact@v2

dbt/adapters/snowflake/impl.py

@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import Mapping, Any, Optional, List, Union
+from typing import Mapping, Any, Optional, List, Union, Dict
 
 import agate
 
@@ -9,6 +9,7 @@
     LIST_SCHEMAS_MACRO_NAME,
     LIST_RELATIONS_MACRO_NAME,
 )
+from dbt.adapters.base.meta import available
 from dbt.adapters.snowflake import SnowflakeConnectionManager
 from dbt.adapters.snowflake import SnowflakeRelation
 from dbt.adapters.snowflake import SnowflakeColumn
@@ -158,5 +159,19 @@ def quote_seed_column(self, column: str, quote_config: Optional[bool]) -> str:
         else:
             return column
 
+    @available
+    def standardize_grants_dict(self, grants_table: agate.Table) -> dict:
+        grants_dict: Dict[str, Any] = {}
+
+        for row in grants_table:
+            grantee = row["grantee_name"]
+            privilege = row["privilege"]
+            if privilege != "OWNERSHIP":
+                if privilege in grants_dict.keys():
+                    grants_dict[privilege].append(grantee)
+                else:
+                    grants_dict.update({privilege: [grantee]})
+        return grants_dict
+
     def timestamp_add_sql(self, add_to: str, number: int = 1, interval: str = "hour") -> str:
         return f"DATEADD({interval}, {number}, {add_to})"

dbt/include/snowflake/macros/adapters.sql

@@ -293,3 +293,8 @@
     {{ snowflake_dml_explicit_transaction(truncate_dml) }}
   {%- endcall %}
 {% endmacro %}
+
+{% macro snowflake__copy_grants() %}
+    {% set copy_grants = config.get('copy_grants', False) %}
+    {{ return(copy_grants) }}
+{% endmacro %}

dbt/include/snowflake/macros/materializations/incremental.sql

@@ -35,6 +35,8 @@
   {% set existing_relation = load_relation(this) %}
   {% set tmp_relation = make_temp_relation(this) %}
 
+  {% set  grant_config = config.get('grants') %}
+
   {#-- Validate early so we don't run SQL if the strategy is invalid --#}
   {% set strategy = dbt_snowflake_validate_get_incremental_strategy(config) -%}
   {% set on_schema_change = incremental_validate_on_schema_change(config.get('on_schema_change'), default='ignore') %}
@@ -74,6 +76,11 @@
   {{ run_hooks(post_hooks) }}
 
   {% set target_relation = target_relation.incorporate(type='table') %}
+
+  {% set should_revoke =
+   should_revoke(existing_relation.is_table, full_refresh_mode) %}
+  {% do apply_grants(target_relation, grant_config, should_revoke=should_revoke) %}
+
   {% do persist_docs(target_relation, model) %}
 
   {% do unset_query_tag(original_query_tag) %}

dbt/include/snowflake/macros/materializations/snapshot.sql

@@ -1,6 +1,5 @@
 {% materialization snapshot, adapter='snowflake' %}
     {% set original_query_tag = set_query_tag() %}
-
     {% set relations = materialization_snapshot_default() %}
 
     {% do unset_query_tag(original_query_tag) %}

dbt/include/snowflake/macros/materializations/table.sql

@@ -4,6 +4,8 @@
 
   {%- set identifier = model['alias'] -%}
 
+  {% set grant_config = config.get('grants') %}
+
   {%- set old_relation = adapter.get_relation(database=database, schema=schema, identifier=identifier) -%}
   {%- set target_relation = api.Relation.create(identifier=identifier,
                                                 schema=schema,
@@ -25,6 +27,9 @@
 
   {{ run_hooks(post_hooks) }}
 
+  {% set should_revoke = should_revoke(old_relation, full_refresh_mode=True) %}
+  {% do apply_grants(target_relation, grant_config, should_revoke=should_revoke) %}
+
   {% do persist_docs(target_relation, model) %}
 
   {% do unset_query_tag(original_query_tag) %}

dbt/include/snowflake/macros/materializations/view.sql

@@ -4,6 +4,7 @@
     {% set to_return = create_or_replace_view() %}
 
     {% set target_relation = this.incorporate(type='view') %}
+
     {% do persist_docs(target_relation, model, for_columns=false) %}
 
     {% do return(to_return) %}

dev-requirements.txt

@@ -1,7 +1,11 @@
 # install latest changes in dbt-core
 # TODO: how to automate switching from develop to version branches?
-git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-core&subdirectory=core
-git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-tests-adapter&subdirectory=tests/adapter
+git+https://github.com/dbt-labs/dbt-core.git@ct-660-grant-sql#egg=dbt-core&subdirectory=core
+git+https://github.com/dbt-labs/dbt-core.git@ct-660-grant-sql#egg=dbt-tests-adapter&subdirectory=tests/adapter
+
+# TODO: revert back to main pointer after PR's 5447, and 5369 are merged into core.
+# git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-core&subdirectory=core
+# git+https://github.com/dbt-labs/dbt-core.git#egg=dbt-tests-adapter&subdirectory=tests/adapter
 
 black==22.3.0
 click~=8.0.4

test.env.example

@@ -29,3 +29,7 @@ SNOWFLAKE_TEST_PASSWORD=my_password
 SNOWFLAKE_TEST_QUOTED_DATABASE=my_quoted_database_name
 SNOWFLAKE_TEST_USER=my_username
 SNOWFLAKE_TEST_WAREHOUSE=my_warehouse_name
+
+DBT_TEST_USER_1=dbt_test_role_1
+DBT_TEST_USER_2=dbt_test_role_2
+DBT_TEST_USER_3=dbt_test_role_3

tests/functional/adapter/test_grants.py

@@ -0,0 +1,6 @@
+import pytest
+
+from dbt.tests.adapter.grants.test_models import TestModelGrants
+
+class TestModelGrantsSnowflake(TestModelGrants):
+    pass