snowflake-cli 3.0.2__py3-none-any.whl → 3.2.0__py3-none-any.whl

snowflake/cli/api/project/definition_conversion.py

@@ -1,14 +1,28 @@
 from __future__ import annotations
 
 import logging
+import shutil
+import tempfile
+from copy import deepcopy
 from pathlib import Path
+from tempfile import TemporaryDirectory, mkstemp
 from typing import Any, Dict, Literal, Optional
 
 from click import ClickException
 from snowflake.cli._plugins.nativeapp.artifacts import (
-    BundleMap,
+    bundle_artifacts,
+)
+from snowflake.cli._plugins.nativeapp.bundle_context import BundleContext
+from snowflake.cli._plugins.nativeapp.codegen.compiler import TEMPLATES_PROCESSOR
+from snowflake.cli._plugins.nativeapp.codegen.templates.templates_processor import (
+    TemplatesProcessor,
+)
+from snowflake.cli._plugins.nativeapp.entities.application_package import (
+    ApplicationPackageEntityModel,
 )
 from snowflake.cli._plugins.snowpark.common import is_name_a_templated_one
+from snowflake.cli.api.cli_global_context import get_cli_context
+from snowflake.cli.api.console import cli_console
 from snowflake.cli.api.constants import (
     DEFAULT_ENV_FILE,
     DEFAULT_PAGES_DIR,
@@ -17,7 +31,9 @@ from snowflake.cli.api.constants import (
     SNOWPARK_SHARED_MIXIN,
 )
 from snowflake.cli.api.entities.utils import render_script_template
+from snowflake.cli.api.metrics import CLICounterField
 from snowflake.cli.api.project.schemas.entities.common import (
+    MetaField,
     SqlScriptHookType,
 )
 from snowflake.cli.api.project.schemas.project_definition import (
@@ -37,9 +53,26 @@ from snowflake.cli.api.project.schemas.v1.snowpark.callable import (
 from snowflake.cli.api.project.schemas.v1.snowpark.snowpark import Snowpark
 from snowflake.cli.api.project.schemas.v1.streamlit.streamlit import Streamlit
 from snowflake.cli.api.rendering.jinja import get_basic_jinja_env
+from snowflake.cli.api.utils.definition_rendering import render_definition_template
+from snowflake.cli.api.utils.dict_utils import deep_merge_dicts
 
 log = logging.getLogger(__name__)
 
+# A directory to hold temporary files created during in-memory definition conversion
+# We need a global reference to this directory to prevent the object from being
+# garbage collected before the files in the directory are used by other parts
+# of the CLI. The directory will then be deleted on interpreter exit
+_IN_MEMORY_CONVERSION_TEMP_DIR: TemporaryDirectory | None = None
+
+
+def _get_temp_dir() -> TemporaryDirectory:
+    global _IN_MEMORY_CONVERSION_TEMP_DIR
+    if _IN_MEMORY_CONVERSION_TEMP_DIR is None:
+        _IN_MEMORY_CONVERSION_TEMP_DIR = TemporaryDirectory(
+            suffix="_pdf_conversion", ignore_cleanup_errors=True
+        )
+    return _IN_MEMORY_CONVERSION_TEMP_DIR
+
 
 def _is_field_defined(template_context: Optional[Dict[str, Any]], *path: str) -> bool:
     """
@@ -66,20 +99,29 @@ def _is_field_defined(template_context: Optional[Dict[str, Any]], *path: str) ->
 
 def convert_project_definition_to_v2(
     project_root: Path,
-    pd: ProjectDefinition,
+    definition_v1: ProjectDefinition,
     accept_templates: bool = False,
     template_context: Optional[Dict[str, Any]] = None,
+    in_memory: bool = False,
 ) -> ProjectDefinitionV2:
-    _check_if_project_definition_meets_requirements(pd, accept_templates)
+    _check_if_project_definition_meets_requirements(definition_v1, accept_templates)
 
-    snowpark_data = convert_snowpark_to_v2_data(pd.snowpark) if pd.snowpark else {}
-    streamlit_data = convert_streamlit_to_v2_data(pd.streamlit) if pd.streamlit else {}
-    native_app_data = (
-        convert_native_app_to_v2_data(project_root, pd.native_app, template_context)
-        if pd.native_app
+    snowpark_data = (
+        convert_snowpark_to_v2_data(definition_v1.snowpark)
+        if definition_v1.snowpark
         else {}
     )
-    envs = convert_envs_to_v2(pd)
+    streamlit_data = (
+        convert_streamlit_to_v2_data(definition_v1.streamlit)
+        if definition_v1.streamlit
+        else {}
+    )
+    native_app_data, native_app_template_context = (
+        convert_native_app_to_v2_data(definition_v1.native_app, template_context)
+        if definition_v1.native_app
+        else ({}, {})
+    )
+    envs = convert_envs_to_v2(definition_v1)
 
     data = {
         "definition_version": "2",
@@ -89,10 +131,31 @@ def convert_project_definition_to_v2(
             native_app_data.get("entities", {}),
         ),
         "mixins": snowpark_data.get("mixins", None),
-        "env": envs,
     }
+    if envs is not None:
+        data["env"] = envs
+
+    if in_memory:
+        # If this is an in-memory conversion, we need to evaluate templates right away
+        # since the file won't be re-read as it would be for a permanent conversion
+        definition_v2 = render_definition_template(data, {}).project_definition
+    else:
+        definition_v2 = ProjectDefinitionV2(**data)
+
+    # If the user's files have any template tags in them, they
+    # also need to be migrated to point to the v2 entities
+    replacement_template_context = deepcopy(template_context) or {}
+    deep_merge_dicts(replacement_template_context, native_app_template_context)
+    if replacement_template_context:
+        _convert_templates_in_files(
+            project_root,
+            definition_v1,
+            definition_v2,
+            in_memory,
+            replacement_template_context,
+        )
 
-    return ProjectDefinitionV2(**data)
+    return definition_v2
 
 
 def convert_snowpark_to_v2_data(snowpark: Snowpark) -> Dict[str, Any]:
@@ -196,10 +259,9 @@ def convert_streamlit_to_v2_data(streamlit: Streamlit) -> Dict[str, Any]:
 
 
 def convert_native_app_to_v2_data(
-    project_root,
     native_app: NativeApp,
     template_context: Optional[Dict[str, Any]] = None,
-) -> Dict[str, Any]:
+) -> tuple[dict[str, Any], dict[str, Any]]:
     def _make_meta(obj: Application | Package):
         meta = {}
         if obj.role:
@@ -210,62 +272,6 @@ def convert_native_app_to_v2_data(
             meta["post_deploy"] = obj.post_deploy
         return meta
 
-    def _find_manifest():
-        # We don't know which file in the project directory is the actual manifest,
-        # and we can't iterate through the artifacts property since the src can contain
-        # glob patterns. The simplest solution is to bundle the app and find the
-        # manifest file from the resultant BundleMap, since the bundle process ensures
-        # that only a single source path can map to the corresponding destination path
-        bundle_map = BundleMap(
-            project_root=project_root, deploy_root=Path(native_app.deploy_root)
-        )
-        for artifact in native_app.artifacts:
-            bundle_map.add(artifact)
-
-        manifest_path = next(
-            (
-                src
-                for src, dest in bundle_map.all_mappings(
-                    absolute=True, expand_directories=True
-                )
-                if dest.name == "manifest.yml"
-            ),
-            None,
-        )
-        if not manifest_path:
-            # The manifest field is required, so we can't gracefully handle it being missing
-            raise ClickException(
-                "manifest.yml file not found in any Native App artifact sources, "
-                "unable to perform migration"
-            )
-
-        # Use a POSIX path to be consistent with other migrated fields
-        # which use POSIX paths as default values
-        return manifest_path.relative_to(project_root).as_posix()
-
-    def _make_template(template: str) -> str:
-        return f"{PROJECT_TEMPLATE_VARIABLE_OPENING} {template} {PROJECT_TEMPLATE_VARIABLE_CLOSING}"
-
-    def _convert_package_script_files(package_scripts: list[str]):
-        # PDFv2 doesn't support package scripts, only post-deploy scripts, so we
-        # need to convert the Jinja syntax from {{ }} to <% %>
-        # Luckily, package scripts only support {{ package_name }}, so let's convert that tag
-        # to v2 template syntax by running it though the template process with a fake
-        # package name that's actually a valid v2 template, which will be evaluated
-        # when the script is used as a post-deploy script
-        fake_package_replacement_template = _make_template(
-            f"ctx.entities.{package_entity_name}.identifier"
-        )
-        jinja_context = dict(package_name=fake_package_replacement_template)
-        post_deploy_hooks = []
-        for script_file in package_scripts:
-            new_contents = render_script_template(
-                project_root, jinja_context, script_file, get_basic_jinja_env()
-            )
-            (project_root / script_file).write_text(new_contents)
-            post_deploy_hooks.append(SqlScriptHookType(sql_script=script_file))
-        return post_deploy_hooks
-
     package_entity_name = "pkg"
     if (
         native_app.package
@@ -281,7 +287,6 @@ def convert_native_app_to_v2_data(
     package = {
         "type": "application package",
         "identifier": package_identifier,
-        "manifest": _find_manifest(),
         "artifacts": native_app.artifacts,
     }
 
@@ -303,12 +308,11 @@ def convert_native_app_to_v2_data(
             package["distribution"] = native_app.package.distribution
         package_meta = _make_meta(native_app.package)
         if native_app.package.scripts:
-            converted_post_deploy_hooks = _convert_package_script_files(
-                native_app.package.scripts
-            )
-            package_meta["post_deploy"] = (
-                package_meta.get("post_deploy", []) + converted_post_deploy_hooks
-            )
+            # Package scripts are not supported in PDFv2 but we
+            # don't convert them here, conversion is deferred until
+            # the final v2 Pydantic model is available
+            # (see _convert_templates_in_files())
+            pass
         if package_meta:
             package["meta"] = package_meta
 
@@ -337,12 +341,63 @@ def convert_native_app_to_v2_data(
         ):
             app["debug"] = native_app.application.debug
 
-    return {
+    pdfv2_yml = {
         "entities": {
             package_entity_name: package,
             app_entity_name: app,
         }
     }
+    template_replacements = {
+        "ctx": {
+            "native_app": {
+                "name": native_app.name,  # This is a literal since there's no equivalent in v2
+                # omitting "artifacts" since lists are not supported in templates
+                "bundle_root": _make_template(
+                    f"ctx.entities.{package_entity_name}.bundle_root"
+                ),
+                "deploy_root": _make_template(
+                    f"ctx.entities.{package_entity_name}.deploy_root"
+                ),
+                "generated_root": _make_template(
+                    f"ctx.entities.{package_entity_name}.generated_root"
+                ),
+                "source_stage": _make_template(
+                    f"ctx.entities.{package_entity_name}.stage"
+                ),
+                "scratch_stage": _make_template(
+                    f"ctx.entities.{package_entity_name}.scratch_stage"
+                ),
+                "package": {
+                    # omitting "scripts" since lists are not supported in templates
+                    "role": _make_template(
+                        f"ctx.entities.{package_entity_name}.meta.role"
+                    ),
+                    "name": _make_template(
+                        f"ctx.entities.{package_entity_name}.identifier"
+                    ),
+                    "warehouse": _make_template(
+                        f"ctx.entities.{package_entity_name}.meta.warehouse"
+                    ),
+                    "distribution": _make_template(
+                        f"ctx.entities.{package_entity_name}.distribution"
+                    ),
+                    # omitting "post_deploy" since lists are not supported in templates
+                },
+                "application": {
+                    "role": _make_template(f"ctx.entities.{app_entity_name}.meta.role"),
+                    "name": _make_template(
+                        f"ctx.entities.{app_entity_name}.identifier"
+                    ),
+                    "warehouse": _make_template(
+                        f"ctx.entities.{app_entity_name}.meta.warehouse"
+                    ),
+                    "debug": _make_template(f"ctx.entities.{app_entity_name}.debug"),
+                    # omitting "post_deploy" since lists are not supported in templates
+                },
+            }
+        }
+    }
+    return pdfv2_yml, template_replacements
 
 
 def convert_envs_to_v2(pd: ProjectDefinition):
@@ -352,6 +407,167 @@ def convert_envs_to_v2(pd: ProjectDefinition):
     return None
 
 
+def _convert_templates_in_files(
+    project_root: Path,
+    definition_v1: ProjectDefinition,
+    definition_v2: ProjectDefinitionV2,
+    in_memory: bool,
+    replacement_template_context: dict[str, Any],
+):
+    """Converts templates in other files to the new format"""
+    # Set up fakers so that references to ctx.env. and fn.
+    # get templated to the same literal, since those references
+    # are the same in v1 and v2
+    replacement_template_context["ctx"]["env"] = _EnvFaker()
+    replacement_template_context["fn"] = _FnFaker()
+
+    metrics = get_cli_context().metrics
+
+    if na := definition_v1.native_app:
+        # If the v1 definition has a Native App, we know
+        # that the v2 definition will have exactly one application package entity
+        pkg_model: ApplicationPackageEntityModel = list(
+            definition_v2.get_entities_by_type(
+                ApplicationPackageEntityModel.get_type()
+            ).values()
+        )[0]
+
+        # Convert templates in artifacts by passing them through the TemplatesProcessor
+        # but providing a context that maps v1 template references to the equivalent v2
+        # references instead of resolving to literals
+        # For example, replacement_template_context might look like
+        # {
+        #     "ctx": {
+        #         "native_app": {
+        #             "bundle_root": "<% ctx.entities.pkg.bundle_root %>",
+        #             "deploy_root": "<% ctx.entities.pkg.deploy_root %>",
+        #             "application": {
+        #                 "name": "<% ctx.entities.app.identifier %>",
+        #             }
+        #             and so on...
+        #          }
+        #     }
+        # }
+        # We only convert files on-disk if the "templates" processor is used in the artifacts
+        # and if we're doing a permanent conversion. If we're doing an in-memory conversion,
+        # the CLI global template context is already populated with the v1 definition, so
+        # we don't want to convert the v1 template references in artifact files
+        metrics.set_counter_default(CLICounterField.TEMPLATES_PROCESSOR, 0)
+        artifacts_to_template = [
+            artifact
+            for artifact in pkg_model.artifacts
+            for processor in artifact.processors
+            if processor.name == TEMPLATES_PROCESSOR
+        ]
+        if not in_memory and artifacts_to_template:
+            metrics.set_counter(CLICounterField.TEMPLATES_PROCESSOR, 1)
+
+            # Create a temporary directory to hold the expanded templates,
+            # as if a bundle step had been run but without affecting any
+            # files on disk outside of the artifacts we want to convert
+            with tempfile.TemporaryDirectory() as d:
+                deploy_root = Path(d)
+                bundle_ctx = BundleContext(
+                    package_name=pkg_model.identifier,
+                    artifacts=pkg_model.artifacts,
+                    project_root=project_root,
+                    bundle_root=project_root / pkg_model.bundle_root,
+                    deploy_root=deploy_root,
+                    generated_root=(
+                        project_root / deploy_root / pkg_model.generated_root
+                    ),
+                )
+                template_processor = TemplatesProcessor(bundle_ctx)
+                bundle_map = bundle_artifacts(
+                    project_root, deploy_root, artifacts_to_template
+                )
+                for src, dest in bundle_map.all_mappings(
+                    absolute=True, expand_directories=True
+                ):
+                    if src.is_dir():
+                        continue
+                    # We call the implementation directly instead of calling process()
+                    # since we need access to the BundleMap to copy files anyways
+                    template_processor.expand_templates_in_file(
+                        src, dest, replacement_template_context
+                    )
+                    # Copy the expanded file back to its original source location if it was modified
+                    if not dest.is_symlink():
+                        shutil.copyfile(dest, src)
+
+        # Convert package script files to post-deploy hooks
+        metrics.set_counter_default(CLICounterField.PACKAGE_SCRIPTS, 0)
+        if (pkg := na.package) and pkg.scripts:
+            metrics.set_counter(CLICounterField.PACKAGE_SCRIPTS, 1)
+            cli_console.warning(
+                "WARNING: native_app.package.scripts is deprecated. "
+                "Please migrate to using native_app.package.post_deploy."
+            )
+
+            converted_post_deploy_hooks = _convert_package_script_files(
+                project_root, pkg.scripts, pkg_model, in_memory
+            )
+            if pkg_model.meta is None:
+                pkg_model.meta = MetaField()
+            if pkg_model.meta.post_deploy is None:
+                pkg_model.meta.post_deploy = []
+            pkg_model.meta.post_deploy += converted_post_deploy_hooks
+
+
+def _convert_package_script_files(
+    project_root: Path,
+    package_scripts: list[str],
+    pkg_model: ApplicationPackageEntityModel,
+    in_memory: bool,
+):
+    # PDFv2 doesn't support package scripts, only post-deploy scripts, so we
+    # need to convert the Jinja syntax from {{ }} to <% %>
+    # Luckily, package scripts only support {{ package_name }}, so let's convert that tag
+    # to v2 template syntax by running it though the template process with a fake
+    # package name that's actually a valid v2 template, which will be evaluated
+    # when the script is used as a post-deploy script
+    # If we're doing an in-memory conversion, we can just hardcode the converted
+    # package name directly into the script since it's being written to a temporary file
+    package_name_replacement = (
+        pkg_model.fqn.name
+        if in_memory
+        else _make_template(f"ctx.entities.{pkg_model.entity_id}.identifier")
+    )
+    jinja_context = dict(package_name=package_name_replacement)
+    post_deploy_hooks = []
+    for script_file in package_scripts:
+        original_script_file = script_file
+        new_contents = render_script_template(
+            project_root, jinja_context, script_file, get_basic_jinja_env()
+        )
+        if in_memory:
+            # If we're converting the definition in-memory, we can't touch
+            # the package scripts on disk, so we'll write them to a temporary file
+            d = _get_temp_dir().name
+            _, script_file = mkstemp(dir=d, suffix="_converted.sql", text=True)
+        (project_root / script_file).write_text(new_contents)
+        hook = SqlScriptHookType(sql_script=script_file)
+        hook._display_path = original_script_file  # noqa: SLF001
+        post_deploy_hooks.append(hook)
+    return post_deploy_hooks
+
+
+class _EnvFaker:
+    def __getitem__(self, item):
+        return _make_template(f"ctx.env.{item}")
+
+
+class _FnFaker:
+    def __getitem__(self, item):
+        return lambda *args: _make_template(
+            f"fn.{item}({', '.join(repr(a) for a in args)})"
+        )
+
+
+def _make_template(template: str) -> str:
+    return f"{PROJECT_TEMPLATE_VARIABLE_OPENING} {template} {PROJECT_TEMPLATE_VARIABLE_CLOSING}"
+
+
 def _check_if_project_definition_meets_requirements(
     pd: ProjectDefinition, accept_templates: bool
 ):

snowflake/cli/api/project/schemas/entities/common.py

@@ -28,6 +28,17 @@ from snowflake.cli.api.project.schemas.updatable_model import (
 class SqlScriptHookType(UpdatableModel):
     sql_script: str = Field(title="SQL file path relative to the project root")
 
+    # Used to store a user-friendly path for this script, when the
+    # value of `sql_script` is a path to a different file
+    # This is used in the UI to display the path relative to the
+    # project root when `sql_script` is a actually path to a temp file
+    # generated by the in-memory PDF v1 to v2 conversion
+    _display_path: str = PrivateAttr(default="")
+
+    @property
+    def display_path(self):
+        return self._display_path or self.sql_script
+
 
 # Currently sql_script is the only supported hook type. Change to a Union once other hook types are added
 PostDeployHook = SqlScriptHookType

snowflake/cli/api/project/schemas/project_definition.py

@@ -19,6 +19,7 @@ from typing import Any, Dict, List, Optional, Union
 
 from packaging.version import Version
 from pydantic import Field, ValidationError, field_validator, model_validator
+from pydantic_core.core_schema import ValidationInfo
 from snowflake.cli._plugins.nativeapp.entities.application import ApplicationEntityModel
 from snowflake.cli.api.project.errors import SchemaValidationError
 from snowflake.cli.api.project.schemas.entities.common import (
@@ -115,7 +116,17 @@ class DefinitionV11(DefinitionV10):
 
 
 class DefinitionV20(_ProjectDefinitionBase):
-    entities: Dict[str, AnnotatedEntity] = Field(title="Entity definitions.")
+    entities: Dict[str, AnnotatedEntity] = Field(
+        title="Entity definitions.", default={}
+    )
+    env: Optional[Dict[str, Union[str, int, bool]]] = Field(
+        title="Default environment specification for this project.",
+        default=None,
+    )
+    mixins: Optional[Dict[str, Dict]] = Field(
+        title="Mixins to apply to entities",
+        default=None,
+    )
 
     @model_validator(mode="after")
     def validate_entities_identifiers(self):
@@ -163,38 +174,32 @@ class DefinitionV20(_ProjectDefinitionBase):
                 f"Target type mismatch. Expected {target_type.__name__}, got {actual_target_type.__name__}"
             )
 
-    env: Optional[Dict[str, Union[str, int, bool]]] = Field(
-        title="Default environment specification for this project.",
-        default=None,
-    )
-
-    mixins: Optional[Dict[str, Dict]] = Field(
-        title="Mixins to apply to entities",
-        default=None,
-    )
-
     @model_validator(mode="before")
     @classmethod
-    def apply_mixins(cls, data: Dict) -> Dict:
+    def apply_mixins(cls, data: Dict, info: ValidationInfo) -> Dict:
         """
         Applies mixins to those entities, whose meta field contains the mixin name.
         """
         if "mixins" not in data or "entities" not in data:
             return data
 
-        entities = data["entities"]
-        for entity_name, entity in entities.items():
-            entity_mixins = entity_mixins_to_list(
-                entity.get("meta", {}).get("use_mixins")
-            )
+        duplicated_run = (
+            info.context.get("is_duplicated_run", False) if info.context else False
+        )
+        if not duplicated_run:
+            entities = data["entities"]
+            for entity_name, entity in entities.items():
+                entity_mixins = entity_mixins_to_list(
+                    entity.get("meta", {}).get("use_mixins")
+                )
 
-            merged_values = cls._merge_mixins_with_entity(
-                entity_id=entity_name,
-                entity=entity,
-                entity_mixins_names=entity_mixins,
-                mixin_defs=data["mixins"],
-            )
-            entities[entity_name] = merged_values
+                merged_values = cls._merge_mixins_with_entity(
+                    entity_id=entity_name,
+                    entity=entity,
+                    entity_mixins_names=entity_mixins,
+                    mixin_defs=data["mixins"],
+                )
+                entities[entity_name] = merged_values
         return data
 
     @classmethod
@@ -325,6 +330,6 @@ def get_allowed_fields_for_entity(entity: Dict[str, Any]) -> List[str]:
 def _unique_extend(list_a: List, list_b: List) -> List:
     new_list = list(list_a)
     for item in list_b:
-        if item not in list_a:
+        if all(item != x for x in list_a):
             new_list.append(item)
     return new_list

snowflake/cli/api/rest_api.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 import json
 import logging
 from typing import Any, Dict, Optional
+from urllib.parse import parse_qsl, urlencode, urlparse
 
 from click import ClickException
 from snowflake.cli.api.constants import SF_REST_API_URL_PREFIX
@@ -107,7 +108,9 @@ class RestApi:
         url = f"{SF_REST_API_URL_PREFIX}/databases/{db_name}/schemas/{schema_name}"
         return self._fetch_endpoint_exists(url)
 
-    def determine_url_for_create_query(self, object_type: str) -> str:
+    def determine_url_for_create_query(
+        self, object_type: str, replace: bool = False, if_not_exists: bool = False
+    ) -> str:
         """
         Determine an url for creating an object of given type via REST API.
         If URL cannot be determined, the function throws CannotDetermineCreateURLException exception.
@@ -124,10 +127,16 @@ class RestApi:
         """
         plural_object_type = _pluralize_object_type(object_type)
 
+        query_params = {}
+
+        if replace or if_not_exists:
+            param = "ifNotExists" if if_not_exists else "orReplace"
+            query_params = {"createMode": param}
+
         if self.get_endpoint_exists(
             url := f"{SF_REST_API_URL_PREFIX}/{plural_object_type}/"
         ):
-            return url
+            return self._add_query_parameters_to_url(url, query_params)
 
         db = self.conn.database
         if not db:
@@ -139,7 +148,7 @@ class RestApi:
         if self.get_endpoint_exists(
             url := f"{SF_REST_API_URL_PREFIX}/databases/{db}/{plural_object_type}/"
         ):
-            return url
+            return self._add_query_parameters_to_url(url, query_params)
 
         schema = self.conn.schema
         if not schema:
@@ -151,12 +160,25 @@ class RestApi:
         if self.get_endpoint_exists(
             url := f"{SF_REST_API_URL_PREFIX}/databases/{self.conn.database}/schemas/{self.conn.schema}/{plural_object_type}/"
         ):
-            return url
+            return self._add_query_parameters_to_url(url, query_params)
 
         raise CannotDetermineCreateURLException(
             f"Create operation for type {object_type} is not supported. Try using `sql -q 'CREATE ...'` command."
         )
 
+    @staticmethod
+    def _add_query_parameters_to_url(url: str, query_params: Dict[str, Any]) -> str:
+        """
+        Updates existing url with new query parameters.
+        They should be passed as key-value pairs in query_params dict.
+        """
+        if not query_params:
+            return url
+        url_parts = urlparse(url)
+        query = dict(parse_qsl(url_parts.query))
+        query.update(query_params)
+        return url_parts._replace(query=urlencode(query)).geturl()
+
 
 class DatabaseNotDefinedException(ClickException):
     pass

snowflake/cli/api/secure_utils.py

@@ -108,7 +108,7 @@ def _windows_restrict_file_permissions(path: Path) -> None:
 
     for user in windows_get_not_whitelisted_users_with_access(path):
         log.info("Removing permissions of user %s from file %s", user, path)
-        subprocess.run(["icacls", str(path), "/DENY", f"{user}:F"])
+        subprocess.run(["icacls", str(path), "/remove:g", f"{user}"])
 
 
 def restrict_file_permissions(file_path: Path) -> None: