@runnerty/executor-snowflake 1.0.1 → 1.1.0

package/.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm whoami *)",
+      "Bash(npm config *)"
+    ]
+  }
+}

package/README.md

@@ -76,18 +76,43 @@ export SNOWFLAKE_PASSWORD="mypassword"
 }
 ```
 
+#### External Browser (SSO) Authentication:
+
+Set `authenticator` to `externalbrowser` to authenticate through your identity provider (Okta, Azure AD, etc.) using the default browser, the same way tools like DataGrip do. This is useful for local development against accounts that are only reachable through federated SSO. The browser is opened once and, when `clientStoreTemporaryCredential` is enabled (default), the token is cached so subsequent connections reuse it without prompting again.
+
+> Note: external browser authentication is interactive and therefore intended for local/interactive usage, not for headless/scheduled execution.
+
+```json
+{
+  "id": "snowflake_default",
+  "type": "@runnerty-executor-snowflake",
+  "account": "@ENV(SNOWFLAKE_ACCOUNT)",
+  "user": "@ENV(SNOWFLAKE_USERNAME)",
+  "host": "@ENV(SNOWFLAKE_HOST)",
+  "database": "@ENV(SNOWFLAKE_DATABASE)",
+  "schema": "@ENV(SNOWFLAKE_SCHEMA)",
+  "warehouse": "@ENV(SNOWFLAKE_WAREHOUSE)",
+  "role": "@ENV(SNOWFLAKE_ROLE)",
+  "authenticator": "externalbrowser"
+}
+```
+
 #### Configuration params:
 
-| Parameter   | Description                                                     |
-| :---------- | :-------------------------------------------------------------- |
-| account     | Snowflake account identifier (e.g., "myaccount.us-east-1")      |
-| username    | The Snowflake user to authenticate as.                          |
-| database    | Name of the database to use for this connection. (Optional)     |
-| schema      | Name of the schema to use for this connection. (Optional)       |
-| warehouse   | Name of the warehouse to use for this connection. (Optional)    |
-| role        | Name of the role to use for this connection. (Optional)         |
-| timeout     | Connection timeout in milliseconds. (Default: 60000)            |
-| application | Application name for connection tracking. (Default: "runnerty") |
+| Parameter                      | Description                                                                                                   |
+| :----------------------------- | :----------------------------------------------------------------------------------------------------------- |
+| account                        | Snowflake account identifier (e.g., "myaccount.us-east-1")                                                    |
+| user                           | The Snowflake user to authenticate as.                                                                        |
+| host                           | Snowflake host name. (Optional)                                                                               |
+| database                       | Name of the database to use for this connection. (Optional)                                                  |
+| schema                         | Name of the schema to use for this connection. (Optional)                                                    |
+| warehouse                      | Name of the warehouse to use for this connection. (Optional)                                                 |
+| role                           | Name of the role to use for this connection. (Optional)                                                      |
+| authenticator                  | Authentication method. Set to `externalbrowser` for browser-based SSO. (Default: OAuth token authentication) |
+| clientStoreTemporaryCredential | Cache the SSO token so the browser opens only once. Only applies to `externalbrowser`. (Default: true)       |
+| browserActionTimeout           | Time in milliseconds to wait for the browser SSO action. Only applies to `externalbrowser`. (Optional)       |
+| timeout                        | Connection timeout in milliseconds. (Default: 60000)                                                         |
+| application                    | Application name for connection tracking. (Default: "runnerty")                                              |
 
 ### Plan samples:
 
@@ -259,6 +284,7 @@ This executor requires OAuth authentication setup. Make sure you have:
 ### Features:
 
 - ✅ **OAuth Authentication** - Secure token-based authentication
+- ✅ **External Browser (SSO)** - Browser-based federated authentication (Okta, Azure AD, ...)
 - ✅ **Streaming Support** - Efficient processing of large datasets
 - ✅ **Multiple Export Formats** - XLSX, CSV, JSON
 - ✅ **Parameterized Queries** - Support for `:parameter` placeholders

package/index.js

@@ -59,21 +59,30 @@ class snowflakeExecutor extends Executor {
 
   async createConnection(params) {
     try {
-      const token = await getToken(params);
+      const useExternalBrowser = (params.authenticator || '').toLowerCase() === 'externalbrowser';
+
+      // The external browser (SSO) flow does not use the OAuth token endpoint
+      const token = useExternalBrowser ? null : await getToken(params);
 
       const connectionOptions = this.getConnectionOptions(params, token);
 
       return new Promise((resolve, reject) => {
         const connection = snowflake.createConnection(connectionOptions);
 
-        // Usar connect normal con token OAuth
-        connection.connect((err, conn) => {
+        const connectCallback = (err, conn) => {
           if (err) {
             reject(new Error(`Snowflake connection error: ${err.message}`));
           } else {
             resolve(conn);
           }
-        });
+        };
+
+        // External browser (SSO) authentication is asynchronous: it must use connectAsync
+        if (useExternalBrowser) {
+          connection.connectAsync(connectCallback);
+        } else {
+          connection.connect(connectCallback);
+        }
       });
     } catch (error) {
       throw new Error(`Failed to get token or connect: ${error.message}`);
@@ -81,11 +90,9 @@ class snowflakeExecutor extends Executor {
   }
 
   getConnectionOptions(params, token) {
-    return {
+    const options = {
       account: params.account,
       username: params.user,
-      authenticator: 'oauth', // Especificar que usamos OAuth
-      token: token, // Token OAuth obtenido de la API
       database: params.database,
       schema: params.schema,
       warehouse: params.warehouse,
@@ -93,6 +100,21 @@ class snowflakeExecutor extends Executor {
       timeout: params.timeout || 60000,
       application: params.application || 'runnerty'
     };
+
+    if ((params.authenticator || '').toLowerCase() === 'externalbrowser') {
+      // Browser-based SSO (opens the default browser to authenticate against the IdP).
+      // clientStoreTemporaryCredential caches the token so the browser is opened only
+      // once and reused across processes.
+      options.authenticator = 'EXTERNALBROWSER';
+      if (params.host) options.host = params.host;
+      options.clientStoreTemporaryCredential = params.clientStoreTemporaryCredential !== false;
+      if (params.browserActionTimeout) options.browserActionTimeout = params.browserActionTimeout;
+    } else {
+      options.authenticator = 'oauth'; // OAuth token obtained from the token endpoint
+      options.token = token;
+    }
+
+    return options;
   }
 
   async executeQuery(connection, query) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runnerty/executor-snowflake",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Runnerty module: Snowflake executor",
   "author": "Coderty",
   "license": "MIT",

package/schema.json

@@ -59,6 +59,36 @@
         },
         "encoding": {
           "type": "string"
+        },
+        "account": {
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        },
+        "schema": {
+          "type": "string"
+        },
+        "warehouse": {
+          "type": "string"
+        },
+        "role": {
+          "type": "string"
+        },
+        "application": {
+          "type": "string"
+        },
+        "timeout": {
+          "type": "number"
+        },
+        "authenticator": {
+          "type": "string"
+        },
+        "browserActionTimeout": {
+          "type": "number"
+        },
+        "clientStoreTemporaryCredential": {
+          "type": "boolean"
         }
       }
     },