omnata-plugin-devkit 0.13.1a179__tar.gz → 0.13.2__tar.gz

{omnata_plugin_devkit-0.13.1a179 → omnata_plugin_devkit-0.13.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: omnata-plugin-devkit
-Version: 0.13.1a179
+Version: 0.13.2
 Summary: 
 License-File: LICENSE
 Author: James Weakley

{omnata_plugin_devkit-0.13.1a179 → omnata_plugin_devkit-0.13.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "omnata-plugin-devkit"
-version = "0.13.1a179"
+version = "0.13.2"
 description = ""
 authors = ["James Weakley <james.weakley@omnata.com>"]
 readme = "README.md"

{omnata_plugin_devkit-0.13.1a179 → omnata_plugin_devkit-0.13.2}/src/omnata_plugin_devkit/jinja_templates/CONFIGURE_APIS.sql.jinja

@@ -323,7 +323,8 @@ try{
                                 OBJECT,
                                 VARCHAR,
                                 VARCHAR,
-                                VARCHAR)`
+                                VARCHAR)`,
+        `SET_CONNECTION_OBJECTS(OBJECT)`
             ];
     procsToAlter.forEach(function(procToAlter) {
         var sqlText = `alter procedure ${procToAlter}

omnata_plugin_devkit-0.13.2/src/omnata_plugin_devkit/jinja_templates/CREATE_GENERIC_SECRET_OBJECT.sql.jinja

@@ -0,0 +1,50 @@
+create or replace procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT(SECRET_NAME VARCHAR, SECRET_CONTENTS VARCHAR)
+returns object
+language python
+RUNTIME_VERSION = '3.10'
+PACKAGES = ({{packages}})
+HANDLER = 'run'
+COMMENT = $$
+Creates a generic secret object. SECRET_STRING is written via a dollar-quoted
+literal rather than a bind parameter: bind binding for SECRET_STRING = ? was
+observed to interpret backslash escapes inside the value, turning a JSON `\n`
+two-byte escape into a raw LF byte and corrupting the stored JSON. Dollar
+quoting is byte-faithful.
+$$
+execute as owner
+as
+$$
+from logging import getLogger
+logger = getLogger(__name__)
+
+# Avoid putting two literal dollar signs in this proc body (the body itself
+# is dollar-quoted, so a stray pair of dollar signs would close it early).
+_TWO_DOLLARS = "$" + "$"
+
+
+def run(session, secret_name, secret_contents):
+   try:
+      if secret_contents is None:
+         secret_contents = ""
+      if _TWO_DOLLARS in secret_contents:
+         raise ValueError(
+            "secret_contents contains '" + _TWO_DOLLARS + "', which is "
+            "currently not supported due to Snowflake delimiter requirements."
+         )
+      sql = (
+         "CREATE OR REPLACE SECRET IDENTIFIER(?) TYPE = GENERIC_STRING "
+         "SECRET_STRING = " + _TWO_DOLLARS + secret_contents + _TWO_DOLLARS
+      )
+      session.sql(sql, params=[secret_name]).collect()
+      session.sql(
+         "grant usage on secret IDENTIFIER(?) to application role OMNATA_MANAGEMENT",
+         params=[secret_name],
+      ).collect()
+      return {"success": True, "data": None}
+   except Exception as e:
+      return {"success": False, "error": f"CREATE_GENERIC_SECRET_OBJECT: {str(e)}"}
+$$
+;
+
+grant usage on procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT(VARCHAR, VARCHAR)
+to application role OMNATA_MANAGEMENT;

omnata_plugin_devkit-0.13.2/src/omnata_plugin_devkit/jinja_templates/CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING.sql.jinja

@@ -0,0 +1,82 @@
+create or replace procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING(
+   SECRET_NAME VARCHAR,
+   SECRET_TO_CLONE VARCHAR,
+   KEYS_TO_INCLUDE ARRAY,
+   NEW_CONTENTS_TO_MERGE VARCHAR DEFAULT NULL
+)
+returns object
+language python
+RUNTIME_VERSION = '3.10'
+PACKAGES = ({{packages}})
+HANDLER = 'run'
+COMMENT = $$
+Creates a generic secret object using an existing secret as the seed.
+  - KEYS_TO_INCLUDE (optional): if provided, restrict the cloned content to
+    these keys before any merging.
+  - NEW_CONTENTS_TO_MERGE (optional): JSON object string whose entries are
+    merged on top of the cloned content (overwriting matching keys). Use
+    this to add or update fields in one shot without a second proc call.
+The write itself is delegated to CREATE_GENERIC_SECRET_OBJECT, which uses a
+dollar-quoted SECRET_STRING literal to avoid bind-parameter escape
+interpretation that corrupts newlines in PEM values.
+$$
+execute as owner
+as
+$$
+import json
+from logging import getLogger
+logger = getLogger(__name__)
+
+
+def _call_proc(session, sql, params):
+   rows = session.sql(sql, params=params).collect()
+   if not rows:
+      raise RuntimeError(f"delegate proc returned no rows: {sql}")
+   val = rows[0][0]
+   if isinstance(val, str):
+      try:
+         val = json.loads(val)
+      except json.JSONDecodeError:
+         pass
+   if isinstance(val, dict) and val.get('success') is False:
+      raise RuntimeError(val.get('error') or f"delegate proc failed: {sql}")
+   return val.get('data') if isinstance(val, dict) else val
+
+
+def run(session, secret_name, secret_to_clone, keys_to_include, new_contents_to_merge):
+   try:
+      existing = _call_proc(
+         session,
+         "call PLUGIN.RETRIEVE_SECRETS(NULL, ?)",
+         [secret_to_clone],
+      ) or {}
+      if not isinstance(existing, dict):
+         existing = {}
+      if keys_to_include is not None:
+         existing = {k: existing[k] for k in keys_to_include if k in existing}
+      if new_contents_to_merge is not None:
+         try:
+            new_dict = json.loads(new_contents_to_merge)
+         except (TypeError, json.JSONDecodeError) as parse_err:
+            raise ValueError(
+               f"NEW_CONTENTS_TO_MERGE must be a JSON object string: {parse_err}"
+            ) from parse_err
+         if not isinstance(new_dict, dict):
+            raise ValueError("NEW_CONTENTS_TO_MERGE must decode to a JSON object")
+         existing = {**existing, **new_dict}
+      _call_proc(
+         session,
+         "call PLUGIN.CREATE_GENERIC_SECRET_OBJECT(?, ?)",
+         [secret_name, json.dumps(existing)],
+      )
+      return {"success": True, "data": None}
+   except Exception as e:
+      return {
+         "success": False,
+         "error": f"CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING: {str(e)}",
+      }
+$$
+;
+
+grant usage on procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING(VARCHAR, VARCHAR, ARRAY, VARCHAR)
+to application role OMNATA_MANAGEMENT;

{omnata_plugin_devkit-0.13.1a179 → omnata_plugin_devkit-0.13.2}/src/omnata_plugin_devkit/jinja_templates/RETRIEVE_SECRETS_UDF.sql.jinja

@@ -35,7 +35,4 @@ def run(oauth_secret_name,other_secrets_name):
             raise ValueError(f"Error parsing secrets content: {str(exception)}") from exception
    return connection_secrets
 $$
-;
-
-grant usage on function PLUGIN.RETRIEVE_SECRETS_UDF(VARCHAR,VARCHAR)
-to application role OMNATA_MANAGEMENT;
+;

omnata_plugin_devkit-0.13.2/src/omnata_plugin_devkit/jinja_templates/SET_CONNECTION_OBJECTS.sql.jinja

@@ -0,0 +1,357 @@
+create or replace procedure PLUGIN.SET_CONNECTION_OBJECTS(PARAMETERS OBJECT)
+returns object
+language python
+RUNTIME_VERSION = '3.10'
+PACKAGES = ({{packages}})
+IMPORTS = ('/app.zip')
+HANDLER = 'run'
+COMMENT = $$
+Creates or replaces every Snowflake object required to provision a connection: network
+rules, OAuth security integration, OAuth secret, secret authorization configuration,
+other_secrets generic secret, External Access Integration, EAI application specification,
+and Security Integration application specification. OAuth-related objects are only created
+when oauth_security_integration_name is provided.
+
+Expected keys on PARAMETERS:
+  external_access_integration_name             (required; account-level, no schema)
+  network_rule_name                            (required; unqualified — DATA schema is prepended)
+  network_addresses                            (required, array of strings)
+  network_rule_name_privatelink                (optional; unqualified — DATA schema is prepended)
+  network_rule_addresses_privatelink           (required if privatelink rule set)
+  oauth_security_integration_name              (optional; account-level, no schema — enables the oauth branch)
+  oauth_parameters                             (required if oauth SI set; object with
+                                                oauth_grant, oauth_token_endpoint,
+                                                oauth_authorization_endpoint,
+                                                oauth_allowed_scopes, oauth_client_id,
+                                                oauth_client_secret)
+  oauth_secret_name                            (optional; unqualified — DATA schema is prepended; requires oauth SI)
+  oauth_secret_configuration_name              (optional; application-scope, no schema; requires oauth_secret_name)
+  other_secrets_name                           (required; unqualified — DATA schema is prepended)
+  connection_secrets                           (optional object; merged into the generic secret
+                                                contents, overwriting any matching keys from
+                                                merge_with_secret_name)
+  merge_with_secret_name                       (optional; unqualified name of an existing generic
+                                                secret in DATA whose contents are read via
+                                                RETRIEVE_SECRETS_UDF and used as the baseline for
+                                                the new other_secrets generic secret.)
+  external_access_integration_spec_name        (required; application-scope, no schema)
+  security_integration_spec_name               (optional; application-scope, no schema; requires oauth SI)
+  connection_slug                              (required; human-readable connection identifier
+                                                included in spec labels/descriptions so the
+                                                consumer knows which connection they are
+                                                approving)
+$$
+execute as owner
+as
+$$
+import json
+import _snowflake
+from logging import getLogger
+from typing import Any, Dict, List, Literal, Optional
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+from omnata_plugin_runtime.logging import log_exception
+logger = getLogger(__name__)
+
+_IDENT_PATTERN = r'^[A-Za-z_][A-Za-z0-9_$.]*$'
+_BARE_IDENT_PATTERN = r'^[A-Za-z_][A-Za-z0-9_$]*$'
+_BARE_IDENT_HINT = "must be an unqualified identifier (no schema prefix; DATA. is prepended automatically)"
+
+
+class OAuthParameters(BaseModel):
+   model_config = ConfigDict(extra='allow')
+   oauth_grant: Literal['authorization_code', 'client_credentials'] = 'authorization_code'
+   oauth_token_endpoint: Optional[str] = None
+   oauth_authorization_endpoint: Optional[str] = None
+   oauth_allowed_scopes: Optional[List[str]] = None
+   oauth_client_id: Optional[str] = None
+   oauth_client_secret: Optional[str] = None
+
+
+class SetConnectionParameters(BaseModel):
+   model_config = ConfigDict(extra='ignore')
+
+   external_access_integration_name: str = Field(pattern=_IDENT_PATTERN, max_length=255)
+   network_rule_name: str = Field(pattern=_BARE_IDENT_PATTERN, max_length=255, description=_BARE_IDENT_HINT)
+   network_addresses: List[str]
+   network_rule_name_privatelink: Optional[str] = Field(default=None, pattern=_BARE_IDENT_PATTERN, max_length=255, description=_BARE_IDENT_HINT)
+   network_rule_addresses_privatelink: Optional[List[str]] = None
+   oauth_security_integration_name: Optional[str] = Field(default=None, pattern=_IDENT_PATTERN, max_length=255)
+   oauth_parameters: Optional[OAuthParameters] = None
+   oauth_secret_name: Optional[str] = Field(default=None, pattern=_BARE_IDENT_PATTERN, max_length=255, description=_BARE_IDENT_HINT)
+   oauth_secret_configuration_name: Optional[str] = Field(default=None, pattern=_IDENT_PATTERN, max_length=255)
+   other_secrets_name: str = Field(pattern=_BARE_IDENT_PATTERN, max_length=255, description=_BARE_IDENT_HINT)
+   connection_secrets: Optional[Dict[str, Any]] = None
+   merge_with_secret_name: Optional[str] = Field(default=None, pattern=_BARE_IDENT_PATTERN, max_length=255, description=_BARE_IDENT_HINT)
+   external_access_integration_spec_name: str = Field(pattern=_IDENT_PATTERN, max_length=255)
+   security_integration_spec_name: Optional[str] = Field(default=None, pattern=_IDENT_PATTERN, max_length=255)
+   connection_slug: str = Field(min_length=1, max_length=255)
+
+   @model_validator(mode='after')
+   def _check_combinations(self):
+      if self.network_rule_name_privatelink and self.network_rule_addresses_privatelink is None:
+         raise ValueError("network_rule_addresses_privatelink is required when network_rule_name_privatelink is provided")
+      if self.oauth_security_integration_name and self.oauth_parameters is None:
+         raise ValueError("oauth_parameters (object) is required when oauth_security_integration_name is provided")
+      if self.oauth_secret_name and not self.oauth_security_integration_name:
+         raise ValueError("oauth_security_integration_name is required when oauth_secret_name is provided")
+      if self.oauth_secret_configuration_name and not self.oauth_secret_name:
+         raise ValueError("oauth_secret_name is required when oauth_secret_configuration_name is provided")
+      if self.security_integration_spec_name and not self.oauth_security_integration_name:
+         raise ValueError("oauth_security_integration_name is required when security_integration_spec_name is provided")
+      return self
+
+
+def _esc_sql(s):
+   return str(s).replace("'", "''")
+
+
+def _call_proc(session, sql, params):
+   """Run `CALL PLUGIN.X(...)` and unwrap the {success, data|error} envelope.
+   Raises RuntimeError when success is false; returns `data` on success."""
+   rows = session.sql(sql, params=params).collect()
+   if not rows:
+      raise RuntimeError(f"delegate proc returned no rows: {sql}")
+   val = rows[0][0]
+   if isinstance(val, str):
+      try:
+         val = json.loads(val)
+      except json.JSONDecodeError:
+         pass
+   if isinstance(val, dict) and val.get('success') is False:
+      raise RuntimeError(val.get('error') or f"delegate proc failed: {sql}")
+   return val.get('data') if isinstance(val, dict) else val
+
+
+def run(session, parameters):
+   try:
+      params = SetConnectionParameters.model_validate(parameters or {})
+
+      eai_name                  = params.external_access_integration_name
+      network_rule_name         = params.network_rule_name
+      network_rule_fqn          = f"DATA.{network_rule_name}"
+      network_addresses         = params.network_addresses
+      eai_spec_name             = params.external_access_integration_spec_name
+      connection_slug           = params.connection_slug
+
+      privatelink_rule_name     = params.network_rule_name_privatelink
+      privatelink_rule_fqn      = f"DATA.{privatelink_rule_name}" if privatelink_rule_name else None
+      privatelink_addresses     = params.network_rule_addresses_privatelink
+
+      oauth_si_name             = params.oauth_security_integration_name
+      oauth_parameters          = params.oauth_parameters
+      oauth_secret_name         = params.oauth_secret_name
+      oauth_secret_fqn          = f"DATA.{oauth_secret_name}" if oauth_secret_name else None
+      oauth_secret_config_name  = params.oauth_secret_configuration_name
+      si_spec_name              = params.security_integration_spec_name
+
+      other_secrets_name        = params.other_secrets_name
+      other_secrets_fqn         = f"DATA.{other_secrets_name}"
+      merge_with_secret_name    = params.merge_with_secret_name
+      connection_secrets        = params.connection_secrets
+
+      logger.info(f"SET_CONNECTION_OBJECTS: provisioning connection '{connection_slug}' (EAI {eai_name})")
+
+      # (1) Direct network rule — delegate to CREATE_NETWORK_RULE_OBJECT.
+      _call_proc(
+         session,
+         "call PLUGIN.CREATE_NETWORK_RULE_OBJECT(?, PARSE_JSON(?), ?)",
+         [network_rule_fqn, json.dumps(network_addresses), 'HOST_PORT'],
+      )
+
+      # (2) Privatelink network rule — optional.
+      if privatelink_rule_fqn:
+         _call_proc(
+            session,
+            "call PLUGIN.CREATE_NETWORK_RULE_OBJECT(?, PARSE_JSON(?), ?)",
+            [privatelink_rule_fqn, json.dumps(privatelink_addresses), 'PRIVATE_HOST_PORT'],
+         )
+
+      # (3) OAuth security integration — inline DDL (no existing proc).
+      if oauth_si_name:
+         op = oauth_parameters
+         oauth_grant = op.oauth_grant
+         oauth_token_ep = op.oauth_token_endpoint or ''
+         oauth_auth_ep = op.oauth_authorization_endpoint or ''
+         oauth_scopes = op.oauth_allowed_scopes or []
+         oauth_client_id = op.oauth_client_id
+         oauth_client_secret = op.oauth_client_secret
+
+         clauses = [
+            "TYPE = API_AUTHENTICATION",
+            "AUTH_TYPE = OAUTH2",
+            "OAUTH_CLIENT_AUTH_METHOD = CLIENT_SECRET_POST",
+            f"OAUTH_GRANT = {oauth_grant.upper()}",
+         ]
+         if oauth_grant == 'authorization_code' and oauth_auth_ep:
+            clauses.append(f"OAUTH_AUTHORIZATION_ENDPOINT = '{_esc_sql(oauth_auth_ep)}'")
+         if oauth_token_ep:
+            clauses.append(f"OAUTH_TOKEN_ENDPOINT = '{_esc_sql(oauth_token_ep)}'")
+         if oauth_scopes:
+            scope_parts = [f"'{_esc_sql(s)}'" for s in oauth_scopes]
+            clauses.append(f"OAUTH_ALLOWED_SCOPES = ({', '.join(scope_parts)})")
+         if oauth_client_id is not None:
+            clauses.append(f"OAUTH_CLIENT_ID = '{_esc_sql(oauth_client_id)}'")
+         if oauth_client_secret is not None:
+            clauses.append(f"OAUTH_CLIENT_SECRET = '{_esc_sql(oauth_client_secret)}'")
+         clauses.append("ENABLED = TRUE")
+
+         si_sql = "CREATE OR REPLACE SECURITY INTEGRATION IDENTIFIER(?)\n  " + "\n  ".join(clauses)
+         logger.info(f"Executing SQL: {si_sql}")
+         session.sql(si_sql, params=[oauth_si_name]).collect()
+         # USAGE on the security integration is required for any APPLICATION_ROLES listed in an
+         # ALTER APPLICATION SET CONFIGURATION DEFINITION SECRET_AUTHORIZATION (the referenced
+         # OAuth secret's API_AUTHENTICATION points to this integration).
+         session.sql(
+            "grant usage on integration IDENTIFIER(?) to application role OMNATA_MANAGEMENT",
+            params=[oauth_si_name],
+         ).collect()
+
+      # (4) OAuth secret — delegate to CREATE_OAUTH_SECRET_OBJECT.
+      if oauth_secret_fqn:
+         _call_proc(
+            session,
+            "call PLUGIN.CREATE_OAUTH_SECRET_OBJECT(?, ?)",
+            [oauth_secret_fqn, oauth_si_name],
+         )
+         # CREATE_OAUTH_SECRET_OBJECT grants USAGE only. MODIFY is required on the secret for
+         # any APPLICATION_ROLES listed in an ALTER APPLICATION SET CONFIGURATION DEFINITION
+         # SECRET_AUTHORIZATION, otherwise the configuration fails with
+         # "role ... is missing 'MODIFY' privilege on Secret".
+         session.sql(
+            "grant modify, usage on secret IDENTIFIER(?) to application role OMNATA_MANAGEMENT",
+            params=[oauth_secret_fqn],
+         ).collect()
+
+      # (5) Secret authorization configuration.
+      # https://docs.snowflake.com/en/developer-guide/native-apps/app-configuration-secret-authorization#step-5-create-the-secret-authorization-configuration
+      if oauth_secret_config_name:
+         # The secret name alternates its trailing __A / __B suffix on each edit; include that
+         # letter in the label so the edit-flow configuration is distinct from the prior one
+         # (configuration definition labels must be unique).
+         secret_alt = oauth_secret_name[-1]
+         cfg_label = f"Authorize OAuth connection: {connection_slug} ({secret_alt})"
+         cfg_description = (
+            f"Complete the OAuth flow so this application can access the external service "
+            f"for connection '{connection_slug}'"
+         )
+         cfg_sql = (
+            f"ALTER APPLICATION SET CONFIGURATION DEFINITION {oauth_secret_config_name}\n"
+            f"  TYPE = SECRET_AUTHORIZATION\n"
+            f"  SECRET = {oauth_secret_fqn}\n"
+            f"  LABEL = '{_esc_sql(cfg_label)}'\n"
+            f"  DESCRIPTION = '{_esc_sql(cfg_description)}'\n"
+            f"  APPLICATION_ROLES = (OMNATA_MANAGEMENT)"
+         )
+         logger.info(f"Executing SQL: {cfg_sql}")
+         session.sql(cfg_sql).collect()
+
+      # (6) Other secrets — read the seed directly via _snowflake.get_generic_secret_string
+      # rather than going through RETRIEVE_SECRETS / CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING.
+      # The cross-proc VARCHAR bind path was observed to mangle backslash escapes in JSON
+      # payloads; reading the secret in-process avoids any extra hop. The secret must be
+      # bound to this proc by CONFIGURE_APIS — the alias is the unqualified name.
+      seed_secrets = {}
+      if merge_with_secret_name:
+         raw = _snowflake.get_generic_secret_string(merge_with_secret_name)
+         if raw and len(raw) > 2:
+            decoded = json.loads(raw)
+            if isinstance(decoded, dict):
+               seed_secrets = decoded
+      if connection_secrets:
+         seed_secrets.update(connection_secrets)
+      _call_proc(
+         session,
+         "call PLUGIN.CREATE_GENERIC_SECRET_OBJECT(?, ?)",
+         [other_secrets_fqn, json.dumps(seed_secrets)],
+      )
+
+      # (7) External Access Integration.
+      eai_rules = [network_rule_fqn]
+      if privatelink_rule_fqn:
+         eai_rules.append(privatelink_rule_fqn)
+      eai_secrets = [other_secrets_fqn]
+      if oauth_secret_fqn:
+         eai_secrets.append(oauth_secret_fqn)
+
+      eai_rules_sql = ', '.join(eai_rules)
+      eai_secrets_clause = ''
+      if eai_secrets:
+         eai_secrets_clause = f"\n  ALLOWED_AUTHENTICATION_SECRETS = ({', '.join(eai_secrets)})"
+      eai_sql = (
+         f"CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION IDENTIFIER(?)\n"
+         f"  ALLOWED_NETWORK_RULES = ({eai_rules_sql})"
+         f"{eai_secrets_clause}\n"
+         f"  ENABLED = FALSE"
+      )
+      logger.info(f"Executing SQL: {eai_sql}")
+      session.sql(eai_sql, params=[eai_name]).collect()
+      # Grant USAGE so the sync engine (via OMNATA_MANAGEMENT) can see/use the EAI.
+      session.sql(
+         "grant usage on integration IDENTIFIER(?) to application role OMNATA_MANAGEMENT",
+         params=[eai_name],
+      ).collect()
+
+      # (8) EAI application specification — delegate to SET_EAI_SPECIFICATION.
+      # Unlike for security integrations/configurations, this specification does not need to alternate when editing as it's not bound to any objects
+      eai_spec_props = {
+         "LABEL": f"External access for connection: {connection_slug}",
+         "DESCRIPTION": f"Allows this app to communicate with external services for connection '{connection_slug}'",
+         "HOST_PORTS": network_addresses,
+      }
+      if privatelink_addresses:
+         eai_spec_props["PRIVATE_HOST_PORTS"] = privatelink_addresses
+      _call_proc(
+         session,
+         "call PLUGIN.SET_EAI_SPECIFICATION(?, PARSE_JSON(?))",
+         [eai_spec_name, json.dumps(eai_spec_props)],
+      )
+
+      # (9) SI application specification — delegate to SET_SI_SPECIFICATION (OAuth only).
+      if si_spec_name:
+         op2 = oauth_parameters
+         grant_uc = op2.oauth_grant.upper()
+         # Include the alternating suffix letter so the edit-flow spec gets a distinct label.
+         si_spec_alt = si_spec_name[-1]
+         si_spec_props = {
+            "LABEL": f"OAuth integration for connection: {connection_slug} ({si_spec_alt})",
+            "DESCRIPTION": f"Allows this app to use an OAuth security integration for connection '{connection_slug}'",
+            "OAUTH_TYPE": grant_uc,
+         }
+         if op2.oauth_token_endpoint:
+            si_spec_props["OAUTH_TOKEN_ENDPOINT"] = op2.oauth_token_endpoint
+         if grant_uc == 'AUTHORIZATION_CODE' and op2.oauth_authorization_endpoint:
+            si_spec_props["OAUTH_AUTHORIZATION_ENDPOINT"] = op2.oauth_authorization_endpoint
+         if op2.oauth_allowed_scopes:
+            si_spec_props["OAUTH_ALLOWED_SCOPES"] = op2.oauth_allowed_scopes
+         _call_proc(
+            session,
+            "call PLUGIN.SET_SI_SPECIFICATION(?, PARSE_JSON(?))",
+            [si_spec_name, json.dumps(si_spec_props)],
+         )
+
+      return {
+         "success": True,
+         "data": {
+            "connection_slug": connection_slug,
+            "external_access_integration_name": eai_name,
+            "network_rule_name": network_rule_fqn,
+            "network_rule_name_privatelink": privatelink_rule_fqn,
+            "oauth_security_integration_name": oauth_si_name,
+            "oauth_secret_name": oauth_secret_fqn,
+            "oauth_secret_configuration_name": oauth_secret_config_name,
+            "other_secrets_name": other_secrets_fqn,
+            "external_access_integration_spec_name": eai_spec_name,
+            "security_integration_spec_name": si_spec_name,
+         },
+      }
+   except Exception as exception:
+      log_exception(exception, logger)
+      return {
+         "success": False,
+         "error": f"SET_CONNECTION_OBJECTS: {str(exception)}",
+      }
+$$
+;
+
+grant usage on procedure PLUGIN.SET_CONNECTION_OBJECTS(OBJECT)
+to application role OMNATA_MANAGEMENT;

omnata_plugin_devkit-0.13.1a179/src/omnata_plugin_devkit/jinja_templates/CREATE_GENERIC_SECRET_OBJECT.sql.jinja

@@ -1,35 +0,0 @@
-create or replace procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT(SECRET_NAME VARCHAR,SECRET_CONTENTS VARCHAR)
-   returns object
-   language javascript
-   COMMENT = $$
-   Creates a generic secret object.
-   $$
-   execute as owner
-as
-$$
-try{
-   snowflake.createStatement( {
-      sqlText: `CREATE OR REPLACE SECRET IDENTIFIER(?) TYPE = GENERIC_STRING SECRET_STRING = ?`,
-      binds:[SECRET_NAME,SECRET_CONTENTS]
-   } ).execute();
-   snowflake.createStatement( {
-      sqlText: `grant usage on secret IDENTIFIER(?) to application role OMNATA_MANAGEMENT`,
-      binds:[SECRET_NAME]
-   } ).execute();
-    return {
-        "success": true,
-        "data": null
-    }
-}
-catch(e){
-   return {
-      "success": false,
-      "error": `CREATE_GENERIC_SECRET_OBJECT: ${String(e)}`
-   }
-}
-$$
-;
-
-grant usage on procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT(VARCHAR,VARCHAR)
-to application role OMNATA_MANAGEMENT;
-

omnata_plugin_devkit-0.13.1a179/src/omnata_plugin_devkit/jinja_templates/CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING.sql.jinja

@@ -1,55 +0,0 @@
-create or replace procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING(SECRET_NAME VARCHAR,SECRET_TO_CLONE VARCHAR,KEYS_TO_INCLUDE ARRAY)
-   returns object
-   language javascript
-   COMMENT = $$
-   Creates a generic secret object, using an existing object as a starting point.
-   $$
-   execute as owner
-as
-$$
-try{
-   // retrieve the existing secrets
-   var results = snowflake.createStatement( {
-         sqlText: `call RETRIEVE_SECRETS(null,?)`,
-         binds:[SECRET_TO_CLONE]
-      } ).execute();
-   results.next();
-   var procResult = results.getColumnValue(1);
-   if (procResult.success===false){
-      throw procResult.error;
-   }
-   var existingSecrets = procResult.data;
-   if (KEYS_TO_INCLUDE != null){
-      // pick out the specific keys from the KEYS_TO_INCLUDE array
-      existingSecrets = KEYS_TO_INCLUDE.reduce((acc,key) => {
-         acc[key] = existingSecrets[key];
-         return acc;
-      }, {})
-   }
-   // create the secret object by calling the regular proc
-   var results = snowflake.createStatement( {
-         sqlText: `call CREATE_GENERIC_SECRET_OBJECT(?,?)`,
-         binds:[SECRET_NAME,JSON.stringify(existingSecrets)]
-      } ).execute();
-   results.next();
-   var procResult = results.getColumnValue(1);
-   if (procResult.success===false){
-      throw procResult.error;
-   }
-   return {
-      "success": true,
-      "data": null
-   }
-}
-catch(e){
-   return {
-      "success": false,
-      "error": `CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING: ${String(e)}`
-   }
-}
-$$
-;
-
-grant usage on procedure PLUGIN.CREATE_GENERIC_SECRET_OBJECT_FROM_EXISTING(VARCHAR,VARCHAR,ARRAY)
-to application role OMNATA_MANAGEMENT;
-