snowflake-cli-labs 2.8.0rc1__py3-none-any.whl → 3.0.0__py3-none-any.whl

snowflake/cli/api/project/util.py

@@ -34,6 +34,9 @@ UNQUOTED_IDENTIFIER_REGEX = r"([a-zA-Z_])([a-zA-Z0-9_$]{0,254})"
 QUOTED_IDENTIFIER_REGEX = r'"((""|[^"]){0,255})"'
 VALID_IDENTIFIER_REGEX = f"(?:{UNQUOTED_IDENTIFIER_REGEX}|{QUOTED_IDENTIFIER_REGEX})"
 
+# An env var that is used to suffix the names of some account-level resources
+TEST_RESOURCE_SUFFIX_VAR = "SNOWFLAKE_CLI_TEST_RESOURCE_SUFFIX"
+
 
 def encode_uri_component(s: str) -> str:
     """
@@ -191,12 +194,6 @@ def extract_schema(qualified_name: str):
     return None
 
 
-def generate_user_env(username: str) -> dict:
-    return {
-        "USER": username,
-    }
-
-
 def first_set_env(*keys: str):
     for k in keys:
         v = os.getenv(k)
@@ -259,3 +256,23 @@ def identifier_to_show_like_pattern(identifier: str) -> str:
     matching this identifier
     """
     return f"'{escape_like_pattern(unquote_identifier(identifier))}'"
+
+
+def append_test_resource_suffix(identifier: str) -> str:
+    """
+    Append a suffix that should be added to specified account-level resources.
+
+    This is an internal concern that is currently only used in tests
+    to isolate concurrent runs and to add the test name to resources.
+    """
+    suffix = os.environ.get(TEST_RESOURCE_SUFFIX_VAR, "")
+    if identifier_to_str(identifier).endswith(identifier_to_str(suffix)):
+        # If the suffix has already been added, don't add it again
+        return identifier
+    if is_valid_quoted_identifier(identifier) or is_valid_quoted_identifier(suffix):
+        # If either identifier is already quoted, use concat_identifier
+        # to add the suffix inside the quotes
+        return concat_identifiers([identifier, suffix])
+    # Otherwise just append the string, don't add quotes
+    # in case the user doesn't want them
+    return f"{identifier}{suffix}"

snowflake/cli/api/rendering/jinja.py

@@ -17,7 +17,7 @@ from __future__ import annotations
 
 from pathlib import Path
 from textwrap import dedent
-from typing import Dict, Optional
+from typing import Any, Dict, Optional
 
 import jinja2
 from jinja2 import Environment, StrictUndefined, loaders
@@ -82,8 +82,18 @@ class IgnoreAttrEnvironment(Environment):
             return self.undefined(obj=obj, name=argument)
 
 
+def get_basic_jinja_env(loader: Optional[loaders.BaseLoader] = None) -> Environment:
+    return env_bootstrap(
+        IgnoreAttrEnvironment(
+            loader=loader or loaders.BaseLoader(),
+            keep_trailing_newline=True,
+            undefined=StrictUndefined,
+        )
+    )
+
+
 def jinja_render_from_file(
-    template_path: Path, data: Dict, output_file_path: Optional[Path] = None
+    template_path: Path, data: Dict[str, Any], output_file_path: Optional[Path] = None
 ) -> Optional[str]:
     """
     Renders a jinja template and outputs either the rendered contents as string or writes to a file.
@@ -96,12 +106,8 @@ def jinja_render_from_file(
     Returns:
         None if file path is provided, else returns the rendered string.
     """
-    env = env_bootstrap(
-        IgnoreAttrEnvironment(
-            loader=loaders.FileSystemLoader(template_path.parent),
-            keep_trailing_newline=True,
-            undefined=StrictUndefined,
-        )
+    env = get_basic_jinja_env(
+        loader=loaders.FileSystemLoader(template_path.parent.as_posix())
     )
     loaded_template = env.get_template(template_path.name)
     rendered_result = loaded_template.render(**data)

snowflake/cli/api/rendering/project_definition_templates.py

@@ -24,7 +24,11 @@ _YML_TEMPLATE_START = "<%"
 _YML_TEMPLATE_END = "%>"
 
 
-def get_project_definition_cli_jinja_env() -> Environment:
+def has_client_side_templates(template_content: str) -> bool:
+    return _YML_TEMPLATE_START in template_content
+
+
+def get_client_side_jinja_env() -> Environment:
     _random_block = "___very___unique___block___to___disable___logic___blocks___"
     return env_bootstrap(
         IgnoreAttrEnvironment(

snowflake/cli/api/rendering/sql_templates.py

@@ -17,8 +17,11 @@ from __future__ import annotations
 from typing import Dict, Optional
 
 from click import ClickException
-from jinja2 import StrictUndefined, loaders
-from snowflake.cli.api.cli_global_context import cli_context
+from jinja2 import Environment, StrictUndefined, loaders, meta
+from snowflake.cli.api.cli_global_context import get_cli_context
+from snowflake.cli.api.console.console import cli_console
+from snowflake.cli.api.exceptions import InvalidTemplate
+from snowflake.cli.api.metrics import CLICounterField
 from snowflake.cli.api.rendering.jinja import (
     CONTEXT_KEY,
     FUNCTION_KEY,
@@ -26,26 +29,62 @@ from snowflake.cli.api.rendering.jinja import (
     env_bootstrap,
 )
 
-_SQL_TEMPLATE_START = "&{"
-_SQL_TEMPLATE_END = "}"
+_SQL_TEMPLATE_START = "<%"
+_SQL_TEMPLATE_END = "%>"
+_OLD_SQL_TEMPLATE_START = "&{"
+_OLD_SQL_TEMPLATE_END = "}"
 RESERVED_KEYS = [CONTEXT_KEY, FUNCTION_KEY]
 
 
-def get_sql_cli_jinja_env(*, loader: Optional[loaders.BaseLoader] = None):
+def _get_sql_jinja_env(template_start: str, template_end: str) -> Environment:
     _random_block = "___very___unique___block___to___disable___logic___blocks___"
     return env_bootstrap(
         IgnoreAttrEnvironment(
-            loader=loader or loaders.BaseLoader(),
-            keep_trailing_newline=True,
-            variable_start_string=_SQL_TEMPLATE_START,
-            variable_end_string=_SQL_TEMPLATE_END,
+            variable_start_string=template_start,
+            variable_end_string=template_end,
+            loader=loaders.BaseLoader(),
             block_start_string=_random_block,
             block_end_string=_random_block,
+            keep_trailing_newline=True,
             undefined=StrictUndefined,
         )
     )
 
 
+def _does_template_have_env_syntax(env: Environment, template_content: str) -> bool:
+    template = env.parse(template_content)
+    return bool(meta.find_undeclared_variables(template))
+
+
+def has_sql_templates(template_content: str) -> bool:
+    return (
+        _OLD_SQL_TEMPLATE_START in template_content
+        or _SQL_TEMPLATE_START in template_content
+    )
+
+
+def choose_sql_jinja_env_based_on_template_syntax(
+    template_content: str, reference_name: Optional[str] = None
+) -> Environment:
+    old_syntax_env = _get_sql_jinja_env(_OLD_SQL_TEMPLATE_START, _OLD_SQL_TEMPLATE_END)
+    new_syntax_env = _get_sql_jinja_env(_SQL_TEMPLATE_START, _SQL_TEMPLATE_END)
+    has_old_syntax = _does_template_have_env_syntax(old_syntax_env, template_content)
+    has_new_syntax = _does_template_have_env_syntax(new_syntax_env, template_content)
+    reference_name_str = f" in {reference_name}" if reference_name else ""
+    if has_old_syntax and has_new_syntax:
+        raise InvalidTemplate(
+            f"The SQL query{reference_name_str} mixes {_OLD_SQL_TEMPLATE_START} ... {_OLD_SQL_TEMPLATE_END} syntax"
+            f" and {_SQL_TEMPLATE_START} ... {_SQL_TEMPLATE_END} syntax."
+        )
+    if has_old_syntax:
+        cli_console.warning(
+            f"Warning: {_OLD_SQL_TEMPLATE_START} ... {_OLD_SQL_TEMPLATE_END} syntax{reference_name_str} is deprecated."
+            f" Use {_SQL_TEMPLATE_START} ... {_SQL_TEMPLATE_END} syntax instead."
+        )
+        return old_syntax_env
+    return new_syntax_env
+
+
 def snowflake_sql_jinja_render(content: str, data: Dict | None = None) -> str:
     data = data or {}
 
@@ -55,6 +94,12 @@ def snowflake_sql_jinja_render(content: str, data: Dict | None = None) -> str:
                 f"{reserved_key} in user defined data. The `{reserved_key}` variable is reserved for CLI usage."
             )
 
-    context_data = cli_context.template_context
+    context_data = get_cli_context().template_context
     context_data.update(data)
-    return get_sql_cli_jinja_env().from_string(content).render(**context_data)
+    env = choose_sql_jinja_env_based_on_template_syntax(content)
+
+    get_cli_context().metrics.set_counter(
+        CLICounterField.SQL_TEMPLATES, int(has_sql_templates(content))
+    )
+
+    return env.from_string(content).render(context_data)

snowflake/cli/api/rest_api.py

@@ -21,8 +21,9 @@ from typing import Any, Dict, Optional
 from click import ClickException
 from snowflake.cli.api.constants import SF_REST_API_URL_PREFIX
 from snowflake.connector.connection import SnowflakeConnection
-from snowflake.connector.errors import BadRequest, InterfaceError
+from snowflake.connector.errors import BadRequest
 from snowflake.connector.network import SnowflakeRestful
+from snowflake.connector.vendored.requests.exceptions import HTTPError
 
 log = logging.getLogger(__name__)
 
@@ -47,10 +48,10 @@ class RestApi:
         Check whether [get] endpoint exists under given URL.
         """
         try:
-            result = self.send_rest_request(url, method="get")
-            return bool(result) or result == []
-        except InterfaceError as err:
-            if "404 Not Found" in str(err):
+            self.send_rest_request(url, method="get")
+            return True
+        except HTTPError as err:
+            if err.response.status_code == 404:
                 return False
             raise err
 
@@ -60,6 +61,10 @@ class RestApi:
             return bool(result)
         except BadRequest:
             return False
+        except HTTPError as err:
+            if err.response.status_code == 404:
+                return False
+            raise err
 
     def send_rest_request(
         self, url: str, method: str, data: Optional[Dict[str, Any]] = None
@@ -91,6 +96,7 @@ class RestApi:
             token=self.rest.token,
             data=json.dumps(data if data else {}),
             no_retry=True,
+            raise_raw_http_failure=True,
         )
 
     def _database_exists(self, db_name: str) -> bool:

snowflake/cli/api/secure_path.py

@@ -24,6 +24,12 @@ from pathlib import Path
 from typing import Optional, Union
 
 from snowflake.cli.api.exceptions import DirectoryIsNotEmptyError, FileTooLargeError
+from snowflake.cli.api.secure_utils import (
+    chmod as secure_chmod,
+)
+from snowflake.cli.api.secure_utils import (
+    restrict_file_permissions,
+)
 
 log = logging.getLogger(__name__)
 
@@ -47,6 +53,12 @@ class SecurePath:
         """
         return self._path
 
+    def chmod(self, permissions_mask: int) -> None:
+        """
+        Change the file mode and permissions, like os.chmod().
+        """
+        secure_chmod(self._path, permissions_mask)
+
     @property
     def parent(self):
         """
@@ -97,28 +109,11 @@ class SecurePath:
         """A string representing the final path component."""
         return self._path.name
 
-    def chmod(self, permissions_mask: int) -> None:
-        """
-        Change the file mode and permissions, like os.chmod().
-        """
-        log.info(
-            "Update permissions of file %s to %s", self._path, oct(permissions_mask)
-        )
-        self._path.chmod(permissions_mask)
-
     def restrict_permissions(self) -> None:
         """
         Restrict file/directory permissions to owner-only.
         """
-        import stat
-
-        owner_permissions = (
-            # https://docs.python.org/3/library/stat.html
-            stat.S_IRUSR  # readable by owner
-            | stat.S_IWUSR  # writeable by owner
-            | stat.S_IXUSR  # executable by owner
-        )
-        self.chmod(self._path.stat().st_mode & owner_permissions)
+        restrict_file_permissions(self._path)
 
     def touch(self, permissions_mask: int = 0o600, exist_ok: bool = True) -> None:
         """
@@ -349,6 +344,9 @@ class SecurePath:
         ):
             raise FileTooLargeError(self._path.resolve(), size_limit_in_mb)
 
+    def rename(self, new_name: Union[str | Path]):
+        self._path.rename(new_name)
+
 
 def _raise_file_exists_error(path: Path):
     raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), path)

snowflake/cli/api/secure_utils.py

@@ -12,11 +12,64 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import logging
 import stat
 from pathlib import Path
+from typing import List
 
+from snowflake.connector.compat import IS_WINDOWS
 
-def file_permissions_are_strict(file_path: Path) -> bool:
+log = logging.getLogger(__name__)
+
+
+def _get_windows_whitelisted_users():
+    # whitelisted users list obtained in consultation with prodsec: CASEC-9627
+    import os
+
+    return [
+        "SYSTEM",
+        "Administrators",
+        "Network",
+        "Domain Admins",
+        "Domain Users",
+        os.getlogin(),
+    ]
+
+
+def _run_icacls(file_path: Path) -> str:
+    import subprocess
+
+    return subprocess.check_output(["icacls", str(file_path)], text=True)
+
+
+def _windows_permissions_are_denied(permission_codes: str) -> bool:
+    # according to https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
+    return "(DENY)" in permission_codes or "(N)" in permission_codes
+
+
+def windows_get_not_whitelisted_users_with_access(file_path: Path) -> List[str]:
+    import re
+
+    # according to https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
+    icacls_output_regex = (
+        rf"({re.escape(str(file_path))})?.*\\(?P<user>.*):(?P<permissions>[(A-Z),]+)"
+    )
+    whitelisted_users = _get_windows_whitelisted_users()
+
+    users_with_access = []
+    for permission in re.finditer(icacls_output_regex, _run_icacls(file_path)):
+        if (permission.group("user") not in whitelisted_users) and (
+            not _windows_permissions_are_denied(permission.group("permissions"))
+        ):
+            users_with_access.append(permission.group("user"))
+    return list(set(users_with_access))
+
+
+def _windows_file_permissions_are_strict(file_path: Path) -> bool:
+    return windows_get_not_whitelisted_users_with_access(file_path) == []
+
+
+def _unix_file_permissions_are_strict(file_path: Path) -> bool:
     accessible_by_others = (
         # https://docs.python.org/3/library/stat.html
         stat.S_IRGRP  # readable by group
@@ -27,3 +80,39 @@ def file_permissions_are_strict(file_path: Path) -> bool:
         | stat.S_IXOTH  # executable by others
     )
     return (file_path.stat().st_mode & accessible_by_others) == 0
+
+
+def file_permissions_are_strict(file_path: Path) -> bool:
+    if IS_WINDOWS:
+        return _windows_file_permissions_are_strict(file_path)
+    return _unix_file_permissions_are_strict(file_path)
+
+
+def chmod(path: Path, permissions_mask: int) -> None:
+    log.info("Update permissions of file %s to %s", path, oct(permissions_mask))
+    path.chmod(permissions_mask)
+
+
+def _unix_restrict_file_permissions(path: Path) -> None:
+    owner_permissions = (
+        # https://docs.python.org/3/library/stat.html
+        stat.S_IRUSR  # readable by owner
+        | stat.S_IWUSR  # writeable by owner
+        | stat.S_IXUSR  # executable by owner
+    )
+    chmod(path, path.stat().st_mode & owner_permissions)
+
+
+def _windows_restrict_file_permissions(path: Path) -> None:
+    import subprocess
+
+    for user in windows_get_not_whitelisted_users_with_access(path):
+        log.info("Removing permissions of user %s from file %s", user, path)
+        subprocess.run(["icacls", str(path), "/DENY", f"{user}:F"])
+
+
+def restrict_file_permissions(file_path: Path) -> None:
+    if IS_WINDOWS:
+        _windows_restrict_file_permissions(file_path)
+    else:
+        _unix_restrict_file_permissions(file_path)

snowflake/cli/api/sql_execution.py

@@ -21,7 +21,7 @@ from io import StringIO
 from textwrap import dedent
 from typing import Iterable, Optional, Tuple
 
-from snowflake.cli.api.cli_global_context import cli_context
+from snowflake.cli.api.cli_global_context import get_cli_context
 from snowflake.cli.api.console import cli_console
 from snowflake.cli.api.constants import ObjectType
 from snowflake.cli.api.exceptions import (
@@ -35,27 +35,21 @@ from snowflake.cli.api.project.util import (
     unquote_identifier,
 )
 from snowflake.cli.api.utils.cursor import find_first_row
+from snowflake.connector import SnowflakeConnection
 from snowflake.connector.cursor import DictCursor, SnowflakeCursor
 from snowflake.connector.errors import ProgrammingError
 
 
-class SqlExecutionMixin:
-    def __init__(self):
+class SqlExecutor:
+    def __init__(self, connection: SnowflakeConnection | None = None):
         self._snowpark_session = None
+        self._connection = connection
 
     @property
-    def _conn(self):
-        return cli_context.connection
-
-    @property
-    def snowpark_session(self):
-        if not self._snowpark_session:
-            from snowflake.snowpark.session import Session
-
-            self._snowpark_session = Session.builder.configs(
-                {"connection": self._conn}
-            ).create()
-        return self._snowpark_session
+    def _conn(self) -> SnowflakeConnection:
+        if self._connection:
+            return self._connection
+        return get_cli_context().connection
 
     @cached_property
     def _log(self):
@@ -88,6 +82,12 @@ class SqlExecutionMixin:
     def _execute_queries(self, queries: str, **kwargs):
         return list(self._execute_string(dedent(queries), **kwargs))
 
+    def execute_query(self, query: str, **kwargs):
+        return self._execute_query(query, **kwargs)
+
+    def execute_queries(self, queries: str, **kwargs):
+        return self._execute_queries(queries, **kwargs)
+
     def use(self, object_type: ObjectType, name: str):
         try:
             self._execute_query(f"use {object_type.value.sf_name} {name}")
@@ -97,16 +97,16 @@ class SqlExecutionMixin:
                 f"Could not use {object_type} {name}. Object does not exist, or operation cannot be performed."
             )
 
+    def current_role(self) -> str:
+        return self._execute_query(f"select current_role()").fetchone()[0]
+
     @contextmanager
     def use_role(self, new_role: str):
         """
         Switches to a different role for a while, then switches back.
         This is a no-op if the requested role is already active.
         """
-        role_result = self._execute_query(
-            f"select current_role()", cursor_class=DictCursor
-        ).fetchone()
-        prev_role = role_result["CURRENT_ROLE()"]
+        prev_role = self.current_role()
         is_different_role = new_role.lower() != prev_role.lower()
         if is_different_role:
             self._log.debug("Assuming different role: %s", new_role)
@@ -117,6 +117,12 @@ class SqlExecutionMixin:
             if is_different_role:
                 self._execute_query(f"use role {prev_role}")
 
+    def session_has_warehouse(self) -> bool:
+        result = self._execute_query(
+            "select current_warehouse() is not null"
+        ).fetchone()
+        return bool(result[0])
+
     @contextmanager
     def use_warehouse(self, new_wh: str):
         """
@@ -125,12 +131,10 @@ class SqlExecutionMixin:
         If there is no default warehouse in the account, it will throw an error.
         """
 
-        wh_result = self._execute_query(
-            f"select current_warehouse()", cursor_class=DictCursor
-        ).fetchone()
+        wh_result = self._execute_query(f"select current_warehouse()").fetchone()
         # If user has an assigned default warehouse, prev_wh will contain a value even if the warehouse is suspended.
         try:
-            prev_wh = wh_result["CURRENT_WAREHOUSE()"]
+            prev_wh = wh_result[0]
         except:
             prev_wh = None
 
@@ -147,11 +151,11 @@ class SqlExecutionMixin:
                 self.use(object_type=ObjectType.WAREHOUSE, name=prev_wh)
 
     def create_password_secret(
-        self, name: str, username: str, password: str
+        self, name: FQN, username: str, password: str
     ) -> SnowflakeCursor:
         return self._execute_query(
             f"""
-            create secret {name}
+            create secret {name.sql_identifier}
             type = password
             username = '{username}'
             password = '{password}'
@@ -159,11 +163,11 @@ class SqlExecutionMixin:
         )
 
     def create_api_integration(
-        self, name: str, api_provider: str, allowed_prefix: str, secret: Optional[str]
+        self, name: FQN, api_provider: str, allowed_prefix: str, secret: Optional[str]
     ) -> SnowflakeCursor:
         return self._execute_query(
             f"""
-            create api integration {name}
+            create api integration {name.sql_identifier}
             api_provider = {api_provider}
             api_allowed_prefixes = ('{allowed_prefix}')
             allowed_authentication_secrets = ({secret if secret else ''})
@@ -254,6 +258,22 @@ class SqlExecutionMixin:
         return show_obj_row
 
 
+class SqlExecutionMixin(SqlExecutor):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self._snowpark_session = None
+
+    @property
+    def snowpark_session(self):
+        if not self._snowpark_session:
+            from snowflake.snowpark.session import Session
+
+            self._snowpark_session = Session.builder.configs(
+                {"connection": self._conn}
+            ).create()
+        return self._snowpark_session
+
+
 class VerboseCursor(SnowflakeCursor):
     def execute(self, command: str, *args, **kwargs):
         cli_console.message(command)