snowflake-cli-labs 2.8.0rc1__py3-none-any.whl → 3.0.0rc1__py3-none-any.whl

snowflake/cli/api/rendering/sql_templates.py

@@ -17,8 +17,10 @@ from __future__ import annotations
 from typing import Dict, Optional
 
 from click import ClickException
-from jinja2 import StrictUndefined, loaders
-from snowflake.cli.api.cli_global_context import cli_context
+from jinja2 import Environment, StrictUndefined, loaders, meta
+from snowflake.cli.api.cli_global_context import get_cli_context
+from snowflake.cli.api.console.console import cli_console
+from snowflake.cli.api.exceptions import InvalidTemplate
 from snowflake.cli.api.rendering.jinja import (
     CONTEXT_KEY,
     FUNCTION_KEY,
@@ -26,26 +28,55 @@ from snowflake.cli.api.rendering.jinja import (
     env_bootstrap,
 )
 
-_SQL_TEMPLATE_START = "&{"
-_SQL_TEMPLATE_END = "}"
+_SQL_TEMPLATE_START = "<%"
+_SQL_TEMPLATE_END = "%>"
+_OLD_SQL_TEMPLATE_START = "&{"
+_OLD_SQL_TEMPLATE_END = "}"
 RESERVED_KEYS = [CONTEXT_KEY, FUNCTION_KEY]
 
 
-def get_sql_cli_jinja_env(*, loader: Optional[loaders.BaseLoader] = None):
+def _get_sql_jinja_env(template_start: str, template_end: str) -> Environment:
     _random_block = "___very___unique___block___to___disable___logic___blocks___"
     return env_bootstrap(
         IgnoreAttrEnvironment(
-            loader=loader or loaders.BaseLoader(),
-            keep_trailing_newline=True,
-            variable_start_string=_SQL_TEMPLATE_START,
-            variable_end_string=_SQL_TEMPLATE_END,
+            variable_start_string=template_start,
+            variable_end_string=template_end,
+            loader=loaders.BaseLoader(),
             block_start_string=_random_block,
             block_end_string=_random_block,
+            keep_trailing_newline=True,
             undefined=StrictUndefined,
         )
     )
 
 
+def _does_template_have_env_syntax(env: Environment, template_content: str) -> bool:
+    template = env.parse(template_content)
+    return bool(meta.find_undeclared_variables(template))
+
+
+def choose_sql_jinja_env_based_on_template_syntax(
+    template_content: str, reference_name: Optional[str] = None
+) -> Environment:
+    old_syntax_env = _get_sql_jinja_env(_OLD_SQL_TEMPLATE_START, _OLD_SQL_TEMPLATE_END)
+    new_syntax_env = _get_sql_jinja_env(_SQL_TEMPLATE_START, _SQL_TEMPLATE_END)
+    has_old_syntax = _does_template_have_env_syntax(old_syntax_env, template_content)
+    has_new_syntax = _does_template_have_env_syntax(new_syntax_env, template_content)
+    reference_name_str = f" in {reference_name}" if reference_name else ""
+    if has_old_syntax and has_new_syntax:
+        raise InvalidTemplate(
+            f"The SQL query{reference_name_str} mixes {_OLD_SQL_TEMPLATE_START} ... {_OLD_SQL_TEMPLATE_END} syntax"
+            f" and {_SQL_TEMPLATE_START} ... {_SQL_TEMPLATE_END} syntax."
+        )
+    if has_old_syntax:
+        cli_console.warning(
+            f"Warning: {_OLD_SQL_TEMPLATE_START} ... {_OLD_SQL_TEMPLATE_END} syntax{reference_name_str} is deprecated."
+            f" Use {_SQL_TEMPLATE_START} ... {_SQL_TEMPLATE_END} syntax instead."
+        )
+        return old_syntax_env
+    return new_syntax_env
+
+
 def snowflake_sql_jinja_render(content: str, data: Dict | None = None) -> str:
     data = data or {}
 
@@ -55,6 +86,7 @@ def snowflake_sql_jinja_render(content: str, data: Dict | None = None) -> str:
                 f"{reserved_key} in user defined data. The `{reserved_key}` variable is reserved for CLI usage."
             )
 
-    context_data = cli_context.template_context
+    context_data = get_cli_context().template_context
     context_data.update(data)
-    return get_sql_cli_jinja_env().from_string(content).render(**context_data)
+    env = choose_sql_jinja_env_based_on_template_syntax(content)
+    return env.from_string(content).render(context_data)

snowflake/cli/api/secure_path.py

@@ -24,6 +24,12 @@ from pathlib import Path
 from typing import Optional, Union
 
 from snowflake.cli.api.exceptions import DirectoryIsNotEmptyError, FileTooLargeError
+from snowflake.cli.api.secure_utils import (
+    chmod as secure_chmod,
+)
+from snowflake.cli.api.secure_utils import (
+    restrict_file_permissions,
+)
 
 log = logging.getLogger(__name__)
 
@@ -47,6 +53,12 @@ class SecurePath:
         """
         return self._path
 
+    def chmod(self, permissions_mask: int) -> None:
+        """
+        Change the file mode and permissions, like os.chmod().
+        """
+        secure_chmod(self._path, permissions_mask)
+
     @property
     def parent(self):
         """
@@ -97,28 +109,11 @@ class SecurePath:
         """A string representing the final path component."""
         return self._path.name
 
-    def chmod(self, permissions_mask: int) -> None:
-        """
-        Change the file mode and permissions, like os.chmod().
-        """
-        log.info(
-            "Update permissions of file %s to %s", self._path, oct(permissions_mask)
-        )
-        self._path.chmod(permissions_mask)
-
     def restrict_permissions(self) -> None:
         """
         Restrict file/directory permissions to owner-only.
         """
-        import stat
-
-        owner_permissions = (
-            # https://docs.python.org/3/library/stat.html
-            stat.S_IRUSR  # readable by owner
-            | stat.S_IWUSR  # writeable by owner
-            | stat.S_IXUSR  # executable by owner
-        )
-        self.chmod(self._path.stat().st_mode & owner_permissions)
+        restrict_file_permissions(self._path)
 
     def touch(self, permissions_mask: int = 0o600, exist_ok: bool = True) -> None:
         """
@@ -349,6 +344,9 @@ class SecurePath:
         ):
             raise FileTooLargeError(self._path.resolve(), size_limit_in_mb)
 
+    def rename(self, new_name: Union[str | Path]):
+        self._path.rename(new_name)
+
 
 def _raise_file_exists_error(path: Path):
     raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), path)

snowflake/cli/api/secure_utils.py

@@ -12,11 +12,64 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import logging
 import stat
 from pathlib import Path
+from typing import List
 
+from snowflake.connector.compat import IS_WINDOWS
 
-def file_permissions_are_strict(file_path: Path) -> bool:
+log = logging.getLogger(__name__)
+
+
+def _get_windows_whitelisted_users():
+    # whitelisted users list obtained in consultation with prodsec: CASEC-9627
+    import os
+
+    return [
+        "SYSTEM",
+        "Administrators",
+        "Network",
+        "Domain Admins",
+        "Domain Users",
+        os.getlogin(),
+    ]
+
+
+def _run_icacls(file_path: Path) -> str:
+    import subprocess
+
+    return subprocess.check_output(["icacls", str(file_path)], text=True)
+
+
+def _windows_permissions_are_denied(permission_codes: str) -> bool:
+    # according to https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
+    return "(DENY)" in permission_codes or "(N)" in permission_codes
+
+
+def windows_get_not_whitelisted_users_with_access(file_path: Path) -> List[str]:
+    import re
+
+    # according to https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
+    icacls_output_regex = (
+        rf"({re.escape(str(file_path))})?.*\\(?P<user>.*):(?P<permissions>[(A-Z),]+)"
+    )
+    whitelisted_users = _get_windows_whitelisted_users()
+
+    users_with_access = []
+    for permission in re.finditer(icacls_output_regex, _run_icacls(file_path)):
+        if (permission.group("user") not in whitelisted_users) and (
+            not _windows_permissions_are_denied(permission.group("permissions"))
+        ):
+            users_with_access.append(permission.group("user"))
+    return list(set(users_with_access))
+
+
+def _windows_file_permissions_are_strict(file_path: Path) -> bool:
+    return windows_get_not_whitelisted_users_with_access(file_path) == []
+
+
+def _unix_file_permissions_are_strict(file_path: Path) -> bool:
     accessible_by_others = (
         # https://docs.python.org/3/library/stat.html
         stat.S_IRGRP  # readable by group
@@ -27,3 +80,39 @@ def file_permissions_are_strict(file_path: Path) -> bool:
         | stat.S_IXOTH  # executable by others
     )
     return (file_path.stat().st_mode & accessible_by_others) == 0
+
+
+def file_permissions_are_strict(file_path: Path) -> bool:
+    if IS_WINDOWS:
+        return _windows_file_permissions_are_strict(file_path)
+    return _unix_file_permissions_are_strict(file_path)
+
+
+def chmod(path: Path, permissions_mask: int) -> None:
+    log.info("Update permissions of file %s to %s", path, oct(permissions_mask))
+    path.chmod(permissions_mask)
+
+
+def _unix_restrict_file_permissions(path: Path) -> None:
+    owner_permissions = (
+        # https://docs.python.org/3/library/stat.html
+        stat.S_IRUSR  # readable by owner
+        | stat.S_IWUSR  # writeable by owner
+        | stat.S_IXUSR  # executable by owner
+    )
+    chmod(path, path.stat().st_mode & owner_permissions)
+
+
+def _windows_restrict_file_permissions(path: Path) -> None:
+    import subprocess
+
+    for user in windows_get_not_whitelisted_users_with_access(path):
+        log.info("Removing permissions of user %s from file %s", user, path)
+        subprocess.run(["icacls", str(path), "/DENY", f"{user}:F"])
+
+
+def restrict_file_permissions(file_path: Path) -> None:
+    if IS_WINDOWS:
+        _windows_restrict_file_permissions(file_path)
+    else:
+        _unix_restrict_file_permissions(file_path)

snowflake/cli/api/sql_execution.py

@@ -21,7 +21,7 @@ from io import StringIO
 from textwrap import dedent
 from typing import Iterable, Optional, Tuple
 
-from snowflake.cli.api.cli_global_context import cli_context
+from snowflake.cli.api.cli_global_context import get_cli_context
 from snowflake.cli.api.console import cli_console
 from snowflake.cli.api.constants import ObjectType
 from snowflake.cli.api.exceptions import (
@@ -35,27 +35,21 @@ from snowflake.cli.api.project.util import (
     unquote_identifier,
 )
 from snowflake.cli.api.utils.cursor import find_first_row
+from snowflake.connector import SnowflakeConnection
 from snowflake.connector.cursor import DictCursor, SnowflakeCursor
 from snowflake.connector.errors import ProgrammingError
 
 
-class SqlExecutionMixin:
-    def __init__(self):
+class SqlExecutor:
+    def __init__(self, connection: SnowflakeConnection | None = None):
         self._snowpark_session = None
+        self._connection = connection
 
     @property
-    def _conn(self):
-        return cli_context.connection
-
-    @property
-    def snowpark_session(self):
-        if not self._snowpark_session:
-            from snowflake.snowpark.session import Session
-
-            self._snowpark_session = Session.builder.configs(
-                {"connection": self._conn}
-            ).create()
-        return self._snowpark_session
+    def _conn(self) -> SnowflakeConnection:
+        if self._connection:
+            return self._connection
+        return get_cli_context().connection
 
     @cached_property
     def _log(self):
@@ -88,6 +82,12 @@ class SqlExecutionMixin:
     def _execute_queries(self, queries: str, **kwargs):
         return list(self._execute_string(dedent(queries), **kwargs))
 
+    def execute_query(self, query: str, **kwargs):
+        return self._execute_query(query, **kwargs)
+
+    def execute_queries(self, queries: str, **kwargs):
+        return self._execute_queries(queries, **kwargs)
+
     def use(self, object_type: ObjectType, name: str):
         try:
             self._execute_query(f"use {object_type.value.sf_name} {name}")
@@ -97,6 +97,13 @@ class SqlExecutionMixin:
                 f"Could not use {object_type} {name}. Object does not exist, or operation cannot be performed."
             )
 
+    def current_role(self) -> str:
+        *_, cursor = self._execute_string(
+            "select current_role()", cursor_class=DictCursor
+        )
+        role_result = cursor.fetchone()
+        return role_result["CURRENT_ROLE()"]
+
     @contextmanager
     def use_role(self, new_role: str):
         """
@@ -117,6 +124,12 @@ class SqlExecutionMixin:
             if is_different_role:
                 self._execute_query(f"use role {prev_role}")
 
+    def session_has_warehouse(self) -> bool:
+        result = self._execute_query(
+            "select current_warehouse() is not null as result", cursor_class=DictCursor
+        ).fetchone()
+        return bool(result.get("RESULT"))
+
     @contextmanager
     def use_warehouse(self, new_wh: str):
         """
@@ -147,11 +160,11 @@ class SqlExecutionMixin:
                 self.use(object_type=ObjectType.WAREHOUSE, name=prev_wh)
 
     def create_password_secret(
-        self, name: str, username: str, password: str
+        self, name: FQN, username: str, password: str
     ) -> SnowflakeCursor:
         return self._execute_query(
             f"""
-            create secret {name}
+            create secret {name.sql_identifier}
             type = password
             username = '{username}'
             password = '{password}'
@@ -159,11 +172,11 @@ class SqlExecutionMixin:
         )
 
     def create_api_integration(
-        self, name: str, api_provider: str, allowed_prefix: str, secret: Optional[str]
+        self, name: FQN, api_provider: str, allowed_prefix: str, secret: Optional[str]
     ) -> SnowflakeCursor:
         return self._execute_query(
             f"""
-            create api integration {name}
+            create api integration {name.sql_identifier}
             api_provider = {api_provider}
             api_allowed_prefixes = ('{allowed_prefix}')
             allowed_authentication_secrets = ({secret if secret else ''})
@@ -254,6 +267,22 @@ class SqlExecutionMixin:
         return show_obj_row
 
 
+class SqlExecutionMixin(SqlExecutor):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self._snowpark_session = None
+
+    @property
+    def snowpark_session(self):
+        if not self._snowpark_session:
+            from snowflake.snowpark.session import Session
+
+            self._snowpark_session = Session.builder.configs(
+                {"connection": self._conn}
+            ).create()
+        return self._snowpark_session
+
+
 class VerboseCursor(SnowflakeCursor):
     def execute(self, command: str, *args, **kwargs):
         cli_console.message(command)

snowflake/cli/api/utils/definition_rendering.py

@@ -26,9 +26,9 @@ from snowflake.cli.api.project.schemas.project_definition import (
     build_project_definition,
 )
 from snowflake.cli.api.project.schemas.updatable_model import context
-from snowflake.cli.api.rendering.jinja import CONTEXT_KEY
+from snowflake.cli.api.rendering.jinja import CONTEXT_KEY, FUNCTION_KEY
 from snowflake.cli.api.rendering.project_definition_templates import (
-    get_project_definition_cli_jinja_env,
+    get_client_side_jinja_env,
 )
 from snowflake.cli.api.utils.dict_utils import deep_merge_dicts, traverse
 from snowflake.cli.api.utils.graph import Graph, Node
@@ -96,7 +96,7 @@ class TemplatedEnvironment:
             )
             or current_attr_chain is not None
         ):
-            raise InvalidTemplate(f"Unexpected templating syntax in {template_value}")
+            raise InvalidTemplate(f"Unexpected template syntax in {template_value}")
 
         for child_node in ast_node.iter_child_nodes():
             all_referenced_vars.update(
@@ -318,7 +318,7 @@ def render_definition_template(
     if definition is None:
         return ProjectProperties(None, {CONTEXT_KEY: {"env": environment_overrides}})
 
-    template_env = TemplatedEnvironment(get_project_definition_cli_jinja_env())
+    template_env = TemplatedEnvironment(get_client_side_jinja_env())
 
     if "definition_version" not in definition or Version(
         definition["definition_version"]
@@ -344,7 +344,7 @@ def render_definition_template(
     _validate_env_section(definition.get("env", {}))
 
     # add available templating functions
-    project_context["fn"] = get_templating_functions()
+    project_context[FUNCTION_KEY] = get_templating_functions()
 
     referenced_vars = _get_referenced_vars_in_definition(template_env, definition)
 
@@ -353,9 +353,7 @@ def render_definition_template(
     )
 
     def on_cycle_action(node: Node[TemplateVar]):
-        raise CycleDetectedError(
-            f"Cycle detected in templating variable {node.data.key}"
-        )
+        raise CycleDetectedError(f"Cycle detected in template variable {node.data.key}")
 
     dependencies_graph.dfs(
         visit_action=lambda node: _render_graph_node(template_env, node),
@@ -374,10 +372,22 @@ def render_definition_template(
     )
 
     project_definition = build_project_definition(**definition)
+
+    # Use the values originally provided by the user as the template context
+    # This intentionally doesn't reflect any field changes made by
+    # validators, to minimize user surprise when templating values
     project_context[CONTEXT_KEY] = definition
+
     # Use `ProjectEnvironment` in project context in order to
     # handle env variables overrides from OS env and from CLI arguments.
     project_context[CONTEXT_KEY]["env"] = ProjectEnvironment(
         default_env=project_context[CONTEXT_KEY].get("env"), override_env=override_env
     )
     return ProjectProperties(project_definition, project_context)
+
+
+def raw_project_properties(definition: Definition) -> ProjectProperties:
+    """
+    Returns the raw project definition data without any templating.
+    """
+    return ProjectProperties(build_project_definition(**definition), {})

{snowflake_cli_labs-2.8.0rc1.dist-info → snowflake_cli_labs-3.0.0rc1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: snowflake-cli-labs
-Version: 2.8.0rc1
+Version: 3.0.0rc1
 Summary: Snowflake CLI
 Project-URL: Source code, https://github.com/snowflakedb/snowflake-cli
 Project-URL: Bug Tracker, https://github.com/snowflakedb/snowflake-cli/issues
@@ -216,7 +216,7 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
-Requires-Python: >=3.8
+Requires-Python: >=3.10
 Requires-Dist: gitpython==3.1.43
 Requires-Dist: jinja2==3.1.4
 Requires-Dist: packaging
@@ -225,20 +225,20 @@ Requires-Dist: pluggy==1.5.0
 Requires-Dist: pydantic==2.8.2
 Requires-Dist: pyyaml==6.0.1
 Requires-Dist: requests==2.32.3
-Requires-Dist: requirements-parser==0.9.0
+Requires-Dist: requirements-parser==0.11.0
 Requires-Dist: rich==13.7.1
-Requires-Dist: setuptools==70.3.0
-Requires-Dist: snowflake-connector-python[secure-local-storage]==3.11.0
+Requires-Dist: setuptools==74.1.0
+Requires-Dist: snowflake-connector-python[secure-local-storage]==3.12.1
 Requires-Dist: snowflake-core==0.8.0; python_version < '3.12'
 Requires-Dist: snowflake-snowpark-python>=1.15.0; python_version < '3.12'
-Requires-Dist: tomlkit==0.13.0
-Requires-Dist: typer==0.12.3
+Requires-Dist: tomlkit==0.13.2
+Requires-Dist: typer==0.12.5
 Requires-Dist: urllib3<2.3,>=1.24.3
 Provides-Extra: development
-Requires-Dist: coverage==7.6.0; extra == 'development'
+Requires-Dist: coverage==7.6.1; extra == 'development'
 Requires-Dist: pre-commit>=3.5.0; extra == 'development'
 Requires-Dist: pytest-randomly==3.15.0; extra == 'development'
-Requires-Dist: pytest==8.3.1; extra == 'development'
+Requires-Dist: pytest==8.3.2; extra == 'development'
 Requires-Dist: syrupy==4.6.1; extra == 'development'
 Description-Content-Type: text/markdown
 
@@ -282,12 +282,12 @@ Cheatsheet: https://github.com/Snowflake-Labs/sf-cheatsheets/blob/main/snowflake
 
 ## Install Snowflake CLI
 
-### Install with pip (PyPi)
+### Install with pipx (PyPi)
 
-Requires Python >= 3.8
+We recommend installing Snowflake CLI in isolated environment using [pipx](https://pipx.pypa.io/stable/). Requires Python >= 3.10
 
 ```bash
-pip install snowflake-cli-labs
+pipx install snowflake-cli-labs
 snow --help
 ```
 
@@ -303,7 +303,7 @@ snow --help
 
 ### Install from source
 
-Requires Python >= 3.8 and git
+Requires Python >= 3.10 and git
 
 ```bash
 git clone https://github.com/snowflakedb/snowflake-cli