@malloy-publisher/server 0.0.241 → 0.0.243

package/dist/app/api-doc.yaml

@@ -4141,25 +4141,31 @@ components:
           type: string
           description: Snowflake username for authentication
         password:
-          type: string
+          type: ["string", "null"]
           description: Snowflake password for authentication
         privateKey:
           type: string
           description: Snowflake private key for authentication
         privateKeyPass:
-          type: string
+          type: ["string", "null"]
           description: Passphrase for the Snowflake private key
         warehouse:
           type: string
           description: Snowflake warehouse name
         database:
-          type: string
-          description: Snowflake database name
+          type: ["string", "null"]
+          description:
+            Snowflake database name. Omitted or null connects with no current
+            database, so names must be fully qualified as
+            DATABASE.SCHEMA.TABLE and schema discovery spans the account.
         schema:
-          type: string
-          description: Snowflake schema name
+          type: ["string", "null"]
+          description:
+            Snowflake schema name. Sets the session default schema and forms part
+            of the connection's identity, so it determines what a materialization
+            build runs as. It does not restrict which schemas are discoverable.
         role:
-          type: string
+          type: ["string", "null"]
           description: Snowflake role name
         responseTimeoutMilliseconds:
           type: integer

package/dist/server.mjs

@@ -265609,6 +265609,9 @@ var PROXIED_SSLMODES = [
   "verify-full"
 ];
 var PUBLISHER_DUCKDB_API_FIELDS = new Set(["attachedDatabases"]);
+function nullToUndefined(value) {
+  return value ?? undefined;
+}
 function normalizeSnowflakePrivateKey(privateKey) {
   let privateKeyContent = privateKey.trim();
   if (!privateKeyContent.includes(`
@@ -266129,13 +266132,13 @@ function assembleEnvironmentConnections(connections = [], environmentPath = "")
           is: "snowflake",
           account: connection.snowflakeConnection?.account,
           username: connection.snowflakeConnection?.username,
-          password: connection.snowflakeConnection?.password,
+          password: nullToUndefined(connection.snowflakeConnection?.password),
           privateKey: connection.snowflakeConnection?.privateKey ? normalizeSnowflakePrivateKey(connection.snowflakeConnection.privateKey) : undefined,
-          privateKeyPass: connection.snowflakeConnection?.privateKeyPass,
+          privateKeyPass: nullToUndefined(connection.snowflakeConnection?.privateKeyPass),
           warehouse: connection.snowflakeConnection?.warehouse,
-          database: connection.snowflakeConnection?.database,
-          schema: connection.snowflakeConnection?.schema,
-          role: connection.snowflakeConnection?.role,
+          database: nullToUndefined(connection.snowflakeConnection?.database),
+          schema: nullToUndefined(connection.snowflakeConnection?.schema),
+          role: nullToUndefined(connection.snowflakeConnection?.role),
           timeoutMs: connection.snowflakeConnection?.responseTimeoutMilliseconds,
           poolMin: 1,
           poolMax: 20
@@ -266657,32 +266660,44 @@ async function federateSnowflake(connection, config) {
   if (!sf) {
     throw new Error(`Snowflake connection configuration missing for: ${config.name}`);
   }
-  const required = {
+  for (const [field, value] of Object.entries({
     account: sf.account,
-    username: sf.username,
-    password: sf.password
-  };
-  for (const [field, value] of Object.entries(required)) {
+    username: sf.username
+  })) {
     if (!value) {
       throw new Error(`Snowflake ${field} is required for: ${config.name}`);
     }
   }
+  const usesKeyPair = !!sf.privateKey;
+  if (!usesKeyPair && !sf.password) {
+    throw new Error(`Snowflake privateKey or password is required for: ${config.name}`);
+  }
   await installAndLoadExtension(connection, "snowflake", true);
   const params = {
     account: escapeSQL(sf.account || ""),
     user: escapeSQL(sf.username || ""),
-    password: escapeSQL(sf.password || ""),
+    password: sf.password ? escapeSQL(sf.password) : undefined,
+    privateKey: sf.privateKey ? escapeSQL(normalizeSnowflakePrivateKey(sf.privateKey)) : undefined,
+    privateKeyPass: sf.privateKeyPass ? escapeSQL(sf.privateKeyPass) : undefined,
     database: sf.database ? escapeSQL(sf.database) : undefined,
-    warehouse: sf.warehouse ? escapeSQL(sf.warehouse) : undefined
+    warehouse: sf.warehouse ? escapeSQL(sf.warehouse) : undefined,
+    schema: sf.schema ? escapeSQL(sf.schema) : undefined,
+    role: sf.role ? escapeSQL(sf.role) : undefined
   };
   const secretName = sanitizeSecretName(`snowflake_${config.name}`);
   const secretLines = [
     `   TYPE snowflake`,
     `   ACCOUNT '${params.account}'`,
     `   USER '${params.user}'`,
-    `   PASSWORD '${params.password}'`,
+    ...usesKeyPair ? [
+      `   AUTH_TYPE 'key_pair'`,
+      `   PRIVATE_KEY '${params.privateKey}'`,
+      ...params.privateKeyPass ? [`   PRIVATE_KEY_PASSWORD '${params.privateKeyPass}'`] : []
+    ] : [`   PASSWORD '${params.password}'`],
     ...params.database ? [`   DATABASE '${params.database}'`] : [],
-    ...params.warehouse ? [`   WAREHOUSE '${params.warehouse}'`] : []
+    ...params.warehouse ? [`   WAREHOUSE '${params.warehouse}'`] : [],
+    ...params.schema ? [`   SCHEMA '${params.schema}'`] : [],
+    ...params.role ? [`   ROLE '${params.role}'`] : []
   ];
   await connection.runSQL(`CREATE OR REPLACE SECRET ${secretName} (
 ${secretLines.join(`,
@@ -267004,7 +267019,7 @@ function entryToDuckDBOptions(name, entry, workingDirectory) {
   return { ...removeUndefined(rest), name };
 }
 function removeUndefined(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, fieldValue]) => fieldValue !== undefined));
+  return Object.fromEntries(Object.entries(value).filter(([, fieldValue]) => fieldValue !== undefined && fieldValue !== null));
 }
 function buildSnowflakePrivateKeyConnection(metadata) {
   const name = metadata.apiConnection.name;
@@ -267905,6 +267920,52 @@ async function getSchemasForMySQL(connection) {
     }
   ];
 }
+var SNOWFLAKE_SYSTEM_DATABASES = new Set([
+  "SNOWFLAKE",
+  "SNOWFLAKE_SAMPLE_DATA"
+]);
+async function listSnowflakeSchemasInDatabase(connection, malloyConnection, database, schema) {
+  const filters = [
+    `CATALOG_NAME = '${sqlLiteral(database, connection.type)}'`
+  ];
+  if (schema) {
+    filters.push(`SCHEMA_NAME = '${sqlLiteral(schema, connection.type)}'`);
+  }
+  assertSafeSqlIdentifier(database, "database name");
+  const result = await runIntrospectionSQL(malloyConnection, `SELECT CATALOG_NAME, SCHEMA_NAME, SCHEMA_OWNER FROM ${database}.INFORMATION_SCHEMA.SCHEMATA WHERE ${filters.join(" AND ")} ORDER BY SCHEMA_NAME`);
+  return standardizeRunSQLResult2(result).map((row) => {
+    const r = row;
+    return {
+      catalogName: String(r.CATALOG_NAME ?? r.catalog_name ?? ""),
+      schemaName: String(r.SCHEMA_NAME ?? r.schema_name ?? ""),
+      owner: String(r.SCHEMA_OWNER ?? r.schema_owner ?? "")
+    };
+  });
+}
+var SNOWFLAKE_SHOW_ROW_LIMIT = 1e4;
+async function listSnowflakeSchemasInAccount(malloyConnection) {
+  const result = await runIntrospectionSQL(malloyConnection, `SHOW SCHEMAS IN ACCOUNT LIMIT ${SNOWFLAKE_SHOW_ROW_LIMIT}`);
+  const returnedRows = standardizeRunSQLResult2(result);
+  if (returnedRows.length >= SNOWFLAKE_SHOW_ROW_LIMIT) {
+    logger.warn("Snowflake account-wide schema listing hit the SHOW row limit; the schema list is incomplete and some tables will not be discoverable", {
+      rowLimit: SNOWFLAKE_SHOW_ROW_LIMIT,
+      returnedRows: returnedRows.length
+    });
+  }
+  const parsed = returnedRows.map((row) => {
+    const r = row;
+    return {
+      catalogName: String(r.database_name ?? r.DATABASE_NAME ?? ""),
+      schemaName: String(r.name ?? r.NAME ?? ""),
+      owner: String(r.owner ?? r.OWNER ?? "")
+    };
+  });
+  const usable = parsed.filter((r) => r.catalogName && r.schemaName);
+  if (usable.length < parsed.length) {
+    logger.warn("Dropped Snowflake schema rows missing a database or schema name; the schema list is incomplete", { dropped: parsed.length - usable.length, returned: parsed.length });
+  }
+  return usable.sort((a, b) => a.catalogName.localeCompare(b.catalogName) || a.schemaName.localeCompare(b.schemaName));
+}
 async function getSchemasForSnowflake(connection, malloyConnection) {
   if (!connection.snowflakeConnection) {
     throw new Error("Snowflake connection is required");
@@ -267912,28 +267973,15 @@ async function getSchemasForSnowflake(connection, malloyConnection) {
   try {
     const database = connection.snowflakeConnection.database;
     const schema = connection.snowflakeConnection.schema;
-    const filters = [];
-    if (database) {
-      filters.push(`CATALOG_NAME = '${sqlLiteral(database, connection.type)}'`);
-    }
-    if (schema) {
-      filters.push(`SCHEMA_NAME = '${sqlLiteral(schema, connection.type)}'`);
-    }
-    const whereClause = filters.length > 0 ? `WHERE ${filters.join(" AND ")}` : "";
-    const result = await runIntrospectionSQL(malloyConnection, `SELECT CATALOG_NAME, SCHEMA_NAME, SCHEMA_OWNER FROM ${database ? `${database}.` : ""}INFORMATION_SCHEMA.SCHEMATA ${whereClause} ORDER BY SCHEMA_NAME`);
-    const rows = standardizeRunSQLResult2(result);
-    return rows.map((row) => {
-      const typedRow = row;
-      const catalogName = String(typedRow.CATALOG_NAME ?? typedRow.catalog_name ?? "");
-      const schemaName = String(typedRow.SCHEMA_NAME ?? typedRow.schema_name ?? "");
-      const owner = String(typedRow.SCHEMA_OWNER ?? typedRow.schema_owner ?? "");
-      return {
-        name: `${catalogName}.${schemaName}`,
-        isHidden: ["SNOWFLAKE", ""].includes(owner) || schemaName === "INFORMATION_SCHEMA",
-        isDefault: schema ? schemaName === schema : false
-      };
-    });
+    const rows = database ? await listSnowflakeSchemasInDatabase(connection, malloyConnection, database, schema) : await listSnowflakeSchemasInAccount(malloyConnection);
+    return rows.map(({ catalogName, schemaName, owner }) => ({
+      name: `${catalogName}.${schemaName}`,
+      isHidden: owner === "SNOWFLAKE" || Boolean(database) && owner === "" || schemaName === "INFORMATION_SCHEMA" || !database && SNOWFLAKE_SYSTEM_DATABASES.has(catalogName),
+      isDefault: Boolean(database) && Boolean(schema) && schemaName === schema
+    }));
   } catch (error) {
+    if (error instanceof BadRequestError)
+      throw error;
     logger.error(`Error getting schemas for Snowflake connection ${connection.name}`, { error });
     throw new Error(`Failed to get schemas for Snowflake connection ${connection.name}: ${error.message}`);
   }
@@ -269317,7 +269365,7 @@ class QueryController {
   constructor(environmentStore) {
     this.environmentStore = environmentStore;
   }
-  async getQuery(environmentName, packageName, modelPath, sourceName, queryName, query, compactJson = false, filterParams, bypassFilters, givens, metadata) {
+  async getQuery(environmentName, packageName, modelPath, sourceName, queryName, query, compactJson = false, filterParams, bypassFilters, givens, metadata, bypassAuthorize) {
     let requestMetadata;
     let queryClass;
     try {
@@ -269357,7 +269405,7 @@ class QueryController {
             return null;
           }
         }
-      }, compactJson ? "compact" : "full"), getQueryTimeoutMs());
+      }, compactJson ? "compact" : "full", bypassAuthorize), getQueryTimeoutMs());
       const renderLogs = import_render_validator.validateRenderTags(result);
       return {
         result: serializedResult,
@@ -277169,12 +277217,19 @@ function unwrapQuotedExpression(body) {
 
 // src/authorize_metrics.ts
 var guardRejectionCounter = null;
+var bypassCounter = null;
 function recordAuthorizeGuardRejection(field) {
   guardRejectionCounter ??= publisherMeter().createCounter("publisher_authorize_guard_rejected_total", {
     description: "Requests rejected with 400 for declaring an `#(authorize)` annotation in caller-submitted Malloy text. Label: field ('query'|'source_name'|'query_name'|'compile_source')."
   });
   guardRejectionCounter.add(1, { field });
 }
+function recordAuthorizeBypass(entryPoint) {
+  bypassCounter ??= publisherMeter().createCounter("publisher_authorize_bypass_total", {
+    description: "Gate evaluations skipped because the request carried an authorize bypass (private data-management path). Label: entry_point ('source'|'runnable'). Any nonzero value on a path that should not use the bypass is a finding — see the paired `authorize bypass` audit log line for org/package/model/source."
+  });
+  bypassCounter.add(1, { entry_point: entryPoint });
+}
 
 // src/service/environment.ts
 init_logger();
@@ -278733,7 +278788,11 @@ class Model {
     }
     return this.fileLevelAuthorize;
   }
-  async assertAuthorized(sourceName, givens) {
+  async assertAuthorized(sourceName, givens, bypassAuthorize = false) {
+    if (bypassAuthorize) {
+      this.noteAuthorizeBypass("source", sourceName);
+      return;
+    }
     const gates = sourceName ? this.entryPointGatesBySource.get(sourceName) : undefined;
     if (gates) {
       for (const { label, exprs, selfContained, ambientPrefix } of gates) {
@@ -278743,6 +278802,15 @@ class Model {
     }
     await this.assertAuthorizedExprs(sourceName ?? "(query)", this.effectiveAuthorizeFor(sourceName), givens);
   }
+  noteAuthorizeBypass(entryPoint, sourceName) {
+    recordAuthorizeBypass(entryPoint);
+    logger.info("authorize bypass", {
+      entryPoint,
+      sourceName: sourceName ?? "(query)",
+      modelPath: this.modelPath,
+      packageName: this.packageName
+    });
+  }
   async assertAuthorizedExprs(label, exprs, givens, selfContainedFirst = false, ambientPrefix = 0) {
     if (exprs.length === 0)
       return;
@@ -278765,7 +278833,11 @@ class Model {
     if (!passed)
       deny();
   }
-  async assertAuthorizedForAllSources(runnable, givens) {
+  async assertAuthorizedForAllSources(runnable, givens, bypassAuthorize = false) {
+    if (bypassAuthorize) {
+      this.noteAuthorizeBypass("runnable", await this.resolveAuthorizeSourceFromRunnable(runnable));
+      return;
+    }
     const ownSourceName = await this.resolveAuthorizeSourceFromRunnable(runnable);
     await this.assertAuthorized(ownSourceName, givens);
     const { struct, modelDef, compositeResolvedSourceDef } = await this.resolveRunTargetStruct(runnable);
@@ -279342,7 +279414,7 @@ class Model {
       return { ...b, schema, refinements };
     }).filter((b) => b.schema.length > 0);
   }
-  async getQueryResults(sourceName, queryName, query, filterParams, bypassFilters, givens, abortSignal, queryMetadataInput, responseShape = "full") {
+  async getQueryResults(sourceName, queryName, query, filterParams, bypassFilters, givens, abortSignal, queryMetadataInput, responseShape = "full", bypassAuthorize = false) {
     const startTime = performance.now();
     if (this.compilationError) {
       if (this.compilationError instanceof MalloyError2 || this.compilationError instanceof ModelCompilationError) {
@@ -279361,7 +279433,7 @@ class Model {
     const surfaceName = extractRunTargetSourceName(query);
     const earlySource = sourceName || (queryName ? this.queries?.find((q) => q.name === queryName)?.sourceName : undefined) || (surfaceName && !this.sources?.some((s) => s.name === surfaceName) ? this.queries?.find((q) => q.name === surfaceName)?.sourceName : undefined) || surfaceName;
     if (earlySource) {
-      await this.assertAuthorized(earlySource, givens ?? {});
+      await this.assertAuthorized(earlySource, givens ?? {}, bypassAuthorize);
     }
     try {
       for (const [field, callerText] of [
@@ -279456,7 +279528,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
     if (boundary === "deferred") {
       this.assertQueryBoundaryCompiled(compiledSource, query);
     }
-    await this.assertAuthorizedForAllSources(runnable, givens ?? {});
+    await this.assertAuthorizedForAllSources(runnable, givens ?? {}, bypassAuthorize);
     const maxRows = getMaxQueryRows();
     const maxBytes = getMaxResponseBytes();
     const buildManifest = this.resolveFreshBuildManifest();
@@ -284408,6 +284480,13 @@ class WatchModeController {
 init_errors();
 init_logger();
 
+// src/authorize_bypass_header.ts
+var BYPASS_AUTHORIZE_HEADER = "x-publisher-bypass-authorize";
+var readBypassAuthorize = (req) => {
+  const raw = req.headers[BYPASS_AUTHORIZE_HEADER];
+  return typeof raw === "string" && raw.trim().toLowerCase() === "true" ? true : undefined;
+};
+
 // src/filter_deprecation.ts
 var setFilterDeprecationHeaders = (res, options) => {
   const hasFilterParams = options.filterParams !== undefined && options.filterParams !== null && !(typeof options.filterParams === "object" && !Array.isArray(options.filterParams) && Object.keys(options.filterParams).length === 0);
@@ -295580,7 +295659,7 @@ app.post(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/mod
       queryMetadata: req.body?.queryMetadata,
       queryClass: req.body?.queryClass,
       versionId: req.body?.versionId
-    });
+    }, readBypassAuthorize(req));
     setFilterDeprecationHeaders(res, {
       filterParams: req.body.filterParams ?? req.body.sourceFilters,
       bypassFilters: req.body.bypassFilters === true ? true : undefined

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.0.241",
+   "version": "0.0.243",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"