dbt-labs / dbt-snowflake

dbt-snowflake contains all of the code enabling dbt to work with Snowflake
https://getdbt.com
Apache License 2.0
296 stars 176 forks source link

Add database role support #1207

Open seediang opened 1 month ago

seediang commented 1 month ago

resolves #1206 docs dbt-labs/docs.getdbt.com/#

Problem

dbt-snowflake only supports granting to Account-level database roles. Snowflake supports granting to other objects including Database Roles and Shares. However, dbt-snowflake does not.

Solution

The solution allow dbt-snowflake to manage database roles as well as existing account level roles. The configuration is extended to include a nested object_type level but also supports the original style. The original style is mapped into the new style under a "role" key.

models:
    - name: MODEL_NAME_1
      config:
        grants:
            # New syntax option
            select:
                role: [ROLE_NAME_1, ROLE_NAME_2, ...]
                database_role: [DATABASE_ROLE_NAME_1, DATABASE_ROLE_NAME_2, ...]
            insert:
                role: [ROLE_NAME_1, ROLE_NAME_2, ...]
                database_role: [DATABASE_ROLE_NAME_1, DATABASE_ROLE_NAME_2, ...]
    - name: MODEL_NAME_2
      config:
        grants:
            # Also preserve existing syntax for full backwards compatibility
            select: [ROLE_NAME_1, ROLE_NAME_2, ...]

The solution has added a number of python functions to the adapter. Originally these were implemented as macros but the logic was also required in python for the automated tests. Rather than duplicate the logic it was moved into python and made available in the jinja context.

The new functions are below. I believe in the long term these would make sense migrating into the dbt-adapter project.

The solution also introduces three new macros, which are similar to existing ones but take an additional object_type parameter ie role or database_role:

Areas that need advice

  1. The existing test_grants.py has been patched to make use of the new functions and the tests are passing. This is not the cleanest and any suggestion for improvement would be appreciated.
  2. The best way to extended the current tests to support roles in the new style.
  3. The best way to include database roles in the functional tests.

Checklist