snowflake-cli 3.22.0__tar.gz → 3.22.1__tar.gz

{snowflake_cli-3.22.0 → snowflake_cli-3.22.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-cli
-Version: 3.22.0
+Version: 3.22.1
 Summary: Snowflake CLI
 Project-URL: Source code, https://github.com/snowflakedb/snowflake-cli
 Project-URL: Bug Tracker, https://github.com/snowflakedb/snowflake-cli/issues

{snowflake_cli-3.22.0 → snowflake_cli-3.22.1}/RELEASE-NOTES.md

@@ -23,6 +23,12 @@
 ## Fixes and improvements
 
 
+# v3.22.1
+
+## Fixes and improvements
+* `snow streamlit deploy`: fix re-deploy incorrectly attempting to UNSET schema-inherited governance tags the deploying role has no APPLY privilege on. Omitting the `tags:` property from `snowflake.yml` now leaves directly-set tags untouched; use `tags: []` to explicitly clear all directly-set tags.
+
+
 # v3.22.0
 
 ## Deprecations

{snowflake_cli-3.22.0 → snowflake_cli-3.22.1}/src/snowflake/cli/__about__.py

@@ -19,7 +19,7 @@ import re
 import subprocess
 from enum import Enum, unique
 
-VERSION = "3.22.0"
+VERSION = "3.22.1"
 
 
 def get_display_version() -> str:

{snowflake_cli-3.22.0 → snowflake_cli-3.22.1}/src/snowflake/cli/_plugins/streamlit/streamlit_entity.py

@@ -1,7 +1,7 @@
 import json
 import logging
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, NamedTuple, Optional
 
 from click import ClickException
 from snowflake.cli._plugins.connection.util import make_snowsight_url
@@ -31,6 +31,11 @@ from snowflake.connector.cursor import DictCursor, SnowflakeCursor
 log = logging.getLogger(__name__)
 
 
+class _TagRef(NamedTuple):
+    name: str
+    fqn: str
+
+
 def _main_file_covered_by_artifacts(
     main_file: str, artifacts: list[PathMapping]
 ) -> bool:
@@ -329,27 +334,44 @@ class StreamlitEntity(EntityBase[StreamlitEntityModel]):
         tag_list = Tag.to_sql_tag_list(self.model.tags)
         return f"ALTER STREAMLIT {self._get_sql_identifier()} SET TAG {tag_list};"
 
-    def get_unset_tag_sql(self, tag_names: list) -> str:
+    def get_unset_tag_sql(self, tag_fqns: list[str]) -> str:
         return (
             f"ALTER STREAMLIT {self._get_sql_identifier()} UNSET TAG "
-            + ",".join(tag_names)
+            + ",".join(tag_fqns)
             + ";"
         )
 
-    def _get_current_tag_names(self) -> list:
+    def _get_current_tags(self) -> list[_TagRef]:
+        """Return one _TagRef per tag directly set on this object.
+
+        Filtering by LEVEL = 'STREAMLIT' excludes schema- and database-inherited
+        tags, which the deploying role may not have APPLY privilege on and
+        therefore cannot UNSET.
+        """
         fqn = self._get_fqn()
+        db_prefix = f"{to_identifier(fqn.database)}." if fqn.database else ""
         rows = self._execute_query(
-            f"SELECT TAG_NAME FROM TABLE(information_schema.tag_references("
-            f"{to_string_literal(fqn.identifier)}, 'STREAMLIT'))"
+            f"SELECT TAG_DATABASE, TAG_SCHEMA, TAG_NAME "
+            f"FROM TABLE({db_prefix}information_schema.tag_references("
+            f"{to_string_literal(fqn.identifier)}, 'STREAMLIT')) "
+            f"WHERE LEVEL = 'STREAMLIT'"
         ).fetchall()
-        return [row[0] for row in rows]
+        return [
+            _TagRef(
+                name=row[2].upper(),
+                fqn=f"{to_identifier(row[0])}.{to_identifier(row[1])}.{to_identifier(row[2])}",
+            )
+            for row in rows
+        ]
 
     def _sync_tags(self) -> None:
-        current = set(self._get_current_tag_names())
-        desired = {t.name.upper() for t in (self.model.tags or [])}
-        to_unset = list(current - desired)
-        if to_unset:
-            self._execute_query(self.get_unset_tag_sql(to_unset))
+        if self.model.tags is None:
+            return
+        current = self._get_current_tags()
+        desired = {t.name.upper() for t in self.model.tags}
+        to_unset_fqns = [ref.fqn for ref in current if ref.name not in desired]
+        if to_unset_fqns:
+            self._execute_query(self.get_unset_tag_sql(to_unset_fqns))
         set_tag_sql = self.get_set_tag_sql()
         if set_tag_sql:
             self._execute_query(set_tag_sql)

{snowflake_cli-3.22.0 → snowflake_cli-3.22.1}/tests/streamlit/test_streamlit_entity.py

@@ -3,7 +3,7 @@ from unittest import mock
 
 import pytest
 from snowflake.cli._plugins.object.common import Tag
-from snowflake.cli._plugins.streamlit.streamlit_entity import StreamlitEntity
+from snowflake.cli._plugins.streamlit.streamlit_entity import StreamlitEntity, _TagRef
 from snowflake.cli._plugins.streamlit.streamlit_entity_model import (
     SPCS_RUNTIME_V2_NAME,
     StreamlitEntityModel,
@@ -14,6 +14,7 @@ from snowflake.cli.api.console.abc import AbstractConsole
 from snowflake.cli.api.exceptions import CliError
 from snowflake.cli.api.project.schemas.entities.common import PathMapping
 
+from tests.conftest import MockCursor
 from tests.streamlit.streamlit_test_class import STREAMLIT_NAME, StreamlitTestClass
 
 CONNECTOR = "snowflake.connector.connect"
@@ -876,11 +877,11 @@ class TestStreamlitEntity(StreamlitTestClass):
         model.set_entity_id("test_streamlit")
         entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
 
-        sql = entity.get_unset_tag_sql(["cost_center", "owner"])
+        sql = entity.get_unset_tag_sql(["MYDB.PUBLIC.COST_CENTER", "MYDB.PUBLIC.OWNER"])
 
         assert (
             sql
-            == "ALTER STREAMLIT IDENTIFIER('test_streamlit') UNSET TAG cost_center,owner;"
+            == "ALTER STREAMLIT IDENTIFIER('test_streamlit') UNSET TAG MYDB.PUBLIC.COST_CENTER,MYDB.PUBLIC.OWNER;"
         )
 
     def test_sync_tags_unsets_removed_and_sets_desired(self, workspace_context):
@@ -897,15 +898,15 @@ class TestStreamlitEntity(StreamlitTestClass):
         with (
             mock.patch.object(
                 entity,
-                "_get_current_tag_names",
-                return_value=["old_tag"],  # already parsed strings
+                "_get_current_tags",
+                return_value=[_TagRef("OLD_TAG", "MYDB.MYSCHEMA.OLD_TAG")],
             ),
             mock.patch.object(entity, "_execute_query") as mock_exec,
         ):
             entity._sync_tags()  # noqa: SLF001
 
         calls = [str(c.args[0]) for c in mock_exec.call_args_list]
-        assert any("UNSET TAG old_tag" in c for c in calls)
+        assert any("UNSET TAG MYDB.MYSCHEMA.OLD_TAG" in c for c in calls)
         assert any("SET TAG new_tag='v'" in c for c in calls)
 
     def test_sync_tags_unsets_all_when_no_desired_tags(self, workspace_context):
@@ -914,13 +915,19 @@ class TestStreamlitEntity(StreamlitTestClass):
             identifier="test_streamlit",
             main_file="streamlit_app.py",
             artifacts=["streamlit_app.py"],
+            tags=[],
         )
         model.set_entity_id("test_streamlit")
         entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
 
         with (
             mock.patch.object(
-                entity, "_get_current_tag_names", return_value=["tag_a", "tag_b"]
+                entity,
+                "_get_current_tags",
+                return_value=[
+                    _TagRef("TAG_A", "MYDB.MYSCHEMA.TAG_A"),
+                    _TagRef("TAG_B", "MYDB.MYSCHEMA.TAG_B"),
+                ],
             ),
             mock.patch.object(entity, "_execute_query") as mock_exec,
         ):
@@ -931,20 +938,119 @@ class TestStreamlitEntity(StreamlitTestClass):
         assert "UNSET TAG" in unset_sql
         assert " SET TAG " not in unset_sql
 
-    def test_sync_tags_no_current_no_desired_is_noop(self, workspace_context):
+    def test_sync_tags_skips_when_tags_property_absent(self, workspace_context):
+        """When tags is not set in snowflake.yml (None), _sync_tags must be a no-op.
+        Neither _get_current_tags nor any query should be issued."""
+        model = StreamlitEntityModel(
+            type="streamlit",
+            identifier="test_streamlit",
+            main_file="streamlit_app.py",
+            artifacts=["streamlit_app.py"],
+        )
+        model.set_entity_id("test_streamlit")
+        entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
+
+        with (
+            mock.patch.object(entity, "_get_current_tags") as mock_get,
+            mock.patch.object(entity, "_execute_query") as mock_exec,
+        ):
+            entity._sync_tags()  # noqa: SLF001
+
+        mock_get.assert_not_called()
+        mock_exec.assert_not_called()
+
+    def test_sync_tags_unsets_all_when_tags_explicitly_empty(self, workspace_context):
+        """tags: [] explicitly means 'manage tags and remove all' — unset everything currently set."""
         model = StreamlitEntityModel(
             type="streamlit",
             identifier="test_streamlit",
             main_file="streamlit_app.py",
             artifacts=["streamlit_app.py"],
+            tags=[],
         )
         model.set_entity_id("test_streamlit")
         entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
 
         with (
-            mock.patch.object(entity, "_get_current_tag_names", return_value=[]),
+            mock.patch.object(entity, "_get_current_tags", return_value=[]),
             mock.patch.object(entity, "_execute_query") as mock_exec,
         ):
             entity._sync_tags()  # noqa: SLF001
 
         mock_exec.assert_not_called()
+
+    def test_get_current_tags_qualifies_information_schema_with_database(
+        self, workspace_context
+    ):
+        """information_schema must be qualified with the resolved database so the query
+        works when no default database is active in the session."""
+        self.mock_conn.database = "MYDB"
+        model = StreamlitEntityModel(
+            type="streamlit",
+            identifier="test_streamlit",
+            main_file="streamlit_app.py",
+            artifacts=["streamlit_app.py"],
+        )
+        model.set_entity_id("test_streamlit")
+        entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
+
+        self.mock_execute.return_value = MockCursor.from_input(
+            [("MYDB", "MYSCHEMA", "MY_TAG")], ["TAG_DATABASE", "TAG_SCHEMA", "TAG_NAME"]
+        )
+
+        result = entity._get_current_tags()  # noqa: SLF001
+
+        issued_sql = self.mock_execute.call_args.args[0]
+        assert "MYDB.information_schema.tag_references" in issued_sql
+        assert "WHERE LEVEL = 'STREAMLIT'" in issued_sql
+        assert result == [_TagRef("MY_TAG", "MYDB.MYSCHEMA.MY_TAG")]
+
+    def test_get_current_tags_falls_back_to_unqualified_when_no_database(
+        self, workspace_context
+    ):
+        """When neither the model nor the connection has a database, information_schema
+        is left unqualified (matching the pre-existing behaviour)."""
+        self.mock_conn.database = None
+        model = StreamlitEntityModel(
+            type="streamlit",
+            identifier="test_streamlit",
+            main_file="streamlit_app.py",
+            artifacts=["streamlit_app.py"],
+        )
+        model.set_entity_id("test_streamlit")
+        entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
+
+        self.mock_execute.return_value = MockCursor.from_input([], [])
+
+        entity._get_current_tags()  # noqa: SLF001
+
+        issued_sql = self.mock_execute.call_args.args[0]
+        assert issued_sql.startswith(
+            "SELECT TAG_DATABASE, TAG_SCHEMA, TAG_NAME FROM TABLE(information_schema"
+        )
+
+    def test_sync_tags_uses_fqn_for_unset(self, workspace_context):
+        """UNSET TAG must use FQN so it resolves correctly outside the tag's schema."""
+        model = StreamlitEntityModel(
+            type="streamlit",
+            identifier="test_streamlit",
+            main_file="streamlit_app.py",
+            artifacts=["streamlit_app.py"],
+            tags=[],
+        )
+        model.set_entity_id("test_streamlit")
+        entity = StreamlitEntity(workspace_ctx=workspace_context, entity_model=model)
+
+        with (
+            mock.patch.object(
+                entity,
+                "_get_current_tags",
+                return_value=[_TagRef("GOV_TAG", "GOV_DB.GOV_SCHEMA.GOV_TAG")],
+            ),
+            mock.patch.object(entity, "_execute_query") as mock_exec,
+        ):
+            entity._sync_tags()  # noqa: SLF001
+
+        unset_sql = mock_exec.call_args.args[0]
+        assert "GOV_DB.GOV_SCHEMA.GOV_TAG" in unset_sql
+        assert "UNSET TAG GOV_DB.GOV_SCHEMA.GOV_TAG" in unset_sql

{snowflake_cli-3.22.0 → snowflake_cli-3.22.1}/tests_integration/test_streamlit.py

@@ -300,6 +300,85 @@ def test_streamlit_tags_alter_flow(
         sql_helper.execute_single_sql(f"DROP TAG IF EXISTS {tag_b}")
 
 
+@pytest.mark.integration
+def test_streamlit_redeploy_does_not_unset_inherited_schema_tags(
+    _streamlit_test_steps,
+    project_directory,
+    snowflake_session,
+):
+    """
+    Regression test for https://github.com/snowflakedb/snowflake-cli/issues/3142
+
+    When the schema carries governance tags inherited by the Streamlit object,
+    re-deploy must not attempt to UNSET those tags and must not destroy the
+    inherited tag association.
+
+    The governance tag lives in a separate schema so it can't be resolved by its
+    short name in the app schema, reproducing the exact failure condition.
+    """
+    entity_id = "app_1"
+    sql = _streamlit_test_steps.setup.sql_test_helper.execute_single_sql
+    runner = _streamlit_test_steps.setup.runner
+    db = snowflake_session.database
+    # Capture schema before CREATE SCHEMA below implicitly switches the session schema.
+    schema = snowflake_session.schema
+
+    gov_schema = "cli_test_gov_schema"
+    gov_tag = "cli_test_schema_level_tag"
+
+    def get_gov_tag_value():
+        rows = sql(
+            f"SELECT SYSTEM$GET_TAG('{db}.{gov_schema}.{gov_tag}', "
+            f"'{db}.{schema}.{entity_id}', 'STREAMLIT') AS v"
+        )
+        return rows[0]["V"]
+
+    try:
+        sql(f"CREATE SCHEMA IF NOT EXISTS {db}.{gov_schema}")
+        sql(f"CREATE TAG IF NOT EXISTS {db}.{gov_schema}.{gov_tag}")
+        # Apply the governance tag at the schema level — all objects in the
+        # test schema inherit it, but the tag only resolves via its FQN.
+        sql(
+            f"ALTER SCHEMA {db}.{schema} "
+            f"SET TAG {db}.{gov_schema}.{gov_tag} = 'governed'"
+        )
+
+        with project_directory("streamlit_v2"):
+            # First deploy: creates the app.
+            result = runner.invoke_with_connection_json(
+                ["streamlit", "deploy", entity_id]
+            )
+            assert result.exit_code == 0, result.output
+
+            # Governance tag must be inherited from schema immediately after deploy.
+            assert (
+                get_gov_tag_value() == "governed"
+            ), "Governance tag should be inherited by the streamlit app from its schema"
+
+            # Re-deploy: snowflake.yml has no `tags:` property, so _sync_tags
+            # returns early without touching any tags.
+            result = runner.invoke_with_connection_json(
+                ["streamlit", "deploy", entity_id, "--replace"]
+            )
+            assert result.exit_code == 0, (
+                "Re-deploy must succeed: _sync_tags should skip when tags "
+                "property is absent in snowflake.yml\n" + result.output
+            )
+
+            # Governance tag must still be inherited after re-deploy.
+            assert (
+                get_gov_tag_value() == "governed"
+            ), "Governance tag must still be inherited after re-deploy"
+    finally:
+        try:
+            sql(f"ALTER SCHEMA {db}.{schema} UNSET TAG {db}.{gov_schema}.{gov_tag}")
+        except Exception:
+            pass
+        sql(f"DROP TAG IF EXISTS {db}.{gov_schema}.{gov_tag}")
+        sql(f"DROP SCHEMA IF EXISTS {db}.{gov_schema}")
+        sql(f"DROP STREAMLIT IF EXISTS {entity_id}")
+
+
 @pytest.mark.integration
 def test_streamlit_grants_experimental_flow(
     _streamlit_test_steps,