snowflake-sql-api 0.1.0__tar.gz → 0.1.2__tar.gz

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: snowflake-sql-api
-Version: 0.1.0
+Version: 0.1.2
 Summary: Lightweight, pure-Python client for Snowflake's SQL API v2
 Project-URL: Homepage, https://github.com/hampsterx/snowflake-sql-api
 Project-URL: Repository, https://github.com/hampsterx/snowflake-sql-api
@@ -72,9 +72,10 @@ A lightweight, pure-Python client for [Snowflake's SQL API v2](https://docs.snow
 ## Why
 
 The official [`snowflake-connector-python`](https://pypi.org/project/snowflake-connector-python/)
-is ~75 MB installed (150 MB with pandas/pyarrow), has an 8-20 s cold start, and
-ships a compiled extension that slows container builds. For serverless and AWS
-Lambda workloads that only need to run SQL, that is a lot of weight.
+is ~75 MB installed (150 MB with pandas/pyarrow) and ships a compiled extension
+that slows container builds and inflates cold starts (its import alone is ~1.5 s
+versus ~0.3 s for this client). For serverless and AWS Lambda workloads that only
+need to run SQL, that is a lot of weight.
 
 `snowflake-sql-api` talks to Snowflake's SQL API over plain HTTP (`httpx`), so it
 stays small and cold-starts quickly. Core dependencies: `httpx`, `PyJWT`,

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/README.md

@@ -8,9 +8,10 @@ A lightweight, pure-Python client for [Snowflake's SQL API v2](https://docs.snow
 ## Why
 
 The official [`snowflake-connector-python`](https://pypi.org/project/snowflake-connector-python/)
-is ~75 MB installed (150 MB with pandas/pyarrow), has an 8-20 s cold start, and
-ships a compiled extension that slows container builds. For serverless and AWS
-Lambda workloads that only need to run SQL, that is a lot of weight.
+is ~75 MB installed (150 MB with pandas/pyarrow) and ships a compiled extension
+that slows container builds and inflates cold starts (its import alone is ~1.5 s
+versus ~0.3 s for this client). For serverless and AWS Lambda workloads that only
+need to run SQL, that is a lot of weight.
 
 `snowflake-sql-api` talks to Snowflake's SQL API over plain HTTP (`httpx`), so it
 stays small and cold-starts quickly. Core dependencies: `httpx`, `PyJWT`,

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/pyproject.toml

@@ -41,8 +41,11 @@ dev = [
     "pytest-asyncio>=0.21",
     "respx>=0.20",
     "ruff>=0.4",
-    # Capped below 25.10: 25.12.0+ drop Python 3.9, which the package still
-    # supports. Keeps CI and the pinned pre-commit hook on the same black.
+    # Capped below 25.10 so CI formats with the same black the pre-commit hook
+    # pins (rev 25.9.0 in .pre-commit-config.yaml). Move the two together by
+    # hand; Dependabot ignores black (.github/dependabot.yml). Keep the cap at
+    # or below 25.12 while Python 3.9 is supported: 25.12.0+ require 3.10, so
+    # a higher cap resolves a different black per interpreter.
     "black>=24.0,<25.10",
     "mypy>=1.8",
     "build>=1.0",
@@ -134,9 +137,9 @@ markers = [
 [tool.coverage.run]
 source = ["snowflake_sql_api"]
 branch = true
-# cli.py is exercised end-to-end by the smoke suite; row_mapping.py is a Phase 8
-# stub. Both are out of the Phase 2 core-coverage scope.
-omit = ["snowflake_sql_api/cli.py", "snowflake_sql_api/row_mapping.py"]
+# row_mapping.py is a Phase 8 stub, out of the Phase 2 core-coverage scope.
+# cli.py is covered by tests/test_cli.py.
+omit = ["snowflake_sql_api/row_mapping.py"]
 
 [tool.coverage.report]
 show_missing = true

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/snowflake_sql_api/__init__.py

@@ -33,6 +33,7 @@ from .exceptions import (
     SnowflakeAuthError,
     SnowflakeConfigError,
     SnowflakeError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
     SnowflakeRetryError,
@@ -51,6 +52,7 @@ __all__ = [
     "SnowflakeConfigError",
     "SnowflakeAuthError",
     "SnowflakeRequestError",
+    "SnowflakeForbiddenError",
     "SnowflakeProgrammingError",
     "SnowflakeTimeoutError",
     "SnowflakeRetryError",

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/snowflake_sql_api/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.0'
-__version_tuple__ = version_tuple = (0, 1, 0)
+__version__ = version = '0.1.2'
+__version_tuple__ = version_tuple = (0, 1, 2)
 
 __commit_id__ = commit_id = None

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/snowflake_sql_api/cli.py

@@ -68,7 +68,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
         return 2
     if args.command == "query":
         return _run_query(args.sql)
-    return 0
+    return 0  # pragma: no cover - argparse only yields None or a known subcommand
 
 
 if __name__ == "__main__":  # pragma: no cover

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/snowflake_sql_api/exceptions.py

@@ -14,6 +14,7 @@ __all__ = [
     "SnowflakeConfigError",
     "SnowflakeAuthError",
     "SnowflakeRequestError",
+    "SnowflakeForbiddenError",
     "SnowflakeProgrammingError",
     "SnowflakeTimeoutError",
     "SnowflakeRetryError",
@@ -62,6 +63,15 @@ class SnowflakeRequestError(SnowflakeError):
         self.statement_handle = statement_handle
 
 
+class SnowflakeForbiddenError(SnowflakeRequestError):
+    """Snowflake refused an authenticated request (HTTP 403).
+
+    The JWT was accepted but the request is not allowed, so retrying with the
+    same identity will not help. A subclass of :class:`SnowflakeRequestError`,
+    so existing handlers for that type still catch it.
+    """
+
+
 class SnowflakeProgrammingError(SnowflakeRequestError):
     """The submitted SQL failed to compile or execute (HTTP 422).
 

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/snowflake_sql_api/testing.py

@@ -599,7 +599,7 @@ def make_client(
     from .client import SnowflakeClient
 
     _reject_managed_kwargs("make_client", kwargs)
-    return SnowflakeClient(
+    client = SnowflakeClient(
         account,
         user,
         private_key=_throwaway_key(),
@@ -607,6 +607,8 @@ def make_client(
         poll_interval=poll_interval,
         **kwargs,
     )
+    client._transport._owns_client = True
+    return client
 
 
 def make_async_client(
@@ -621,7 +623,7 @@ def make_async_client(
     from .aclient import AsyncSnowflakeClient
 
     _reject_managed_kwargs("make_async_client", kwargs)
-    return AsyncSnowflakeClient(
+    client = AsyncSnowflakeClient(
         account,
         user,
         private_key=_throwaway_key(),
@@ -629,6 +631,8 @@ def make_async_client(
         poll_interval=poll_interval,
         **kwargs,
     )
+    client._transport._owns_client = True
+    return client
 
 
 # ---------------------------------------------------------------------------

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/snowflake_sql_api/transport.py

@@ -1,10 +1,11 @@
 """HTTP transport against ``POST /api/v2/statements``.
 
 Owns the actual ``httpx`` calls (sync and async), status-code interpretation
-(200 success, 202 long-running/async, 422 execution failure, 401 auth, 429/5xx
-retryable), the retry loop, and ``requestId`` reuse for idempotent retries. A
-retried submit re-POSTs the identical body with the same ``requestId`` and
-``retry=true`` so Snowflake deduplicates instead of double-applying DML.
+(200 success, 202 long-running/async, 422 execution failure, 401 auth,
+403 forbidden, 429/5xx retryable), the retry loop, and ``requestId`` reuse for
+idempotent retries. A retried submit re-POSTs the identical body with the same
+``requestId`` and ``retry=true`` so Snowflake deduplicates instead of
+double-applying DML.
 
 Higher layers (``client``/``aclient``) talk to the transport, not to ``httpx``.
 """
@@ -19,6 +20,7 @@ import httpx
 
 from .exceptions import (
     SnowflakeAuthError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
     SnowflakeRetryError,
@@ -84,6 +86,14 @@ def _interpret(response: httpx.Response) -> StatementResponse:
         )
     if status == 401:
         raise SnowflakeAuthError(body.get("message", "authentication failed"))
+    if status == 403:
+        raise SnowflakeForbiddenError(
+            body.get("message", "request forbidden"),
+            status_code=status,
+            code=body.get("code"),
+            sql_state=body.get("sqlState"),
+            statement_handle=body.get("statementHandle"),
+        )
     raise SnowflakeRequestError(
         body.get("message", f"HTTP {status}"),
         status_code=status,

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/tests/conftest.py

@@ -25,6 +25,12 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 PASSPHRASE = b"correct horse battery staple"
 
 
+def pytest_configure(config: pytest.Config) -> None:
+    """Load shipped testing fixtures when pytest11 entry points are unavailable."""
+    if not config.pluginmanager.hasplugin("snowflake_sql_api"):
+        config.pluginmanager.import_plugin("snowflake_sql_api.testing")
+
+
 @pytest.fixture
 def fake_account() -> str:
     """A region-suffixed account locator for auth-normalization tests."""

snowflake_sql_api-0.1.2/tests/test_cli.py

@@ -0,0 +1,143 @@
+"""Unit tests for the ``snowflake-sql-api`` CLI (``cli.py``).
+
+Drive ``build_parser()`` / ``main()`` with ``argv`` injection and a stubbed
+client (``from_env`` monkeypatched to a :class:`FakeSnowflake`-backed client), so
+no network and no real account. Covers the exit-code contract documented in
+``docs/cli.md`` plus the ``_json_default`` serializer.
+"""
+
+from __future__ import annotations
+
+import json
+from datetime import date, datetime, time, timezone
+from decimal import Decimal
+
+import pytest
+
+from snowflake_sql_api import cli
+from snowflake_sql_api.client import SnowflakeClient
+from snowflake_sql_api.testing import FakeSnowflake, make_client
+
+
+@pytest.fixture
+def stub_from_env(monkeypatch: pytest.MonkeyPatch) -> FakeSnowflake:
+    """Point ``SnowflakeClient.from_env`` at a fresh FakeSnowflake-backed client.
+
+    Returns the fake so a test can register results before invoking the CLI.
+    """
+    fake = FakeSnowflake()
+
+    def _from_env() -> SnowflakeClient:
+        return make_client(fake)
+
+    monkeypatch.setattr(SnowflakeClient, "from_env", staticmethod(_from_env))
+    return fake
+
+
+# ---------------------------------------------------------------------------
+# build_parser / argv plumbing
+# ---------------------------------------------------------------------------
+
+
+def test_build_parser_parses_query() -> None:
+    args = cli.build_parser().parse_args(["query", "SELECT 1"])
+    assert args.command == "query"
+    assert args.sql == "SELECT 1"
+
+
+def test_version(capsys: pytest.CaptureFixture[str]) -> None:
+    # argparse's `version` action prints then raises SystemExit(0).
+    from snowflake_sql_api import __version__
+
+    with pytest.raises(SystemExit) as excinfo:
+        cli.main(["--version"])
+    assert excinfo.value.code == 0
+    assert __version__ in capsys.readouterr().out
+
+
+def test_no_subcommand_prints_help_and_exits_2(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    assert cli.main([]) == 2
+    out = capsys.readouterr().out
+    assert "usage:" in out
+    assert "query" in out
+
+
+# ---------------------------------------------------------------------------
+# query command (stubbed client)
+# ---------------------------------------------------------------------------
+
+
+def test_query_happy_path_prints_json(
+    stub_from_env: FakeSnowflake, capsys: pytest.CaptureFixture[str]
+) -> None:
+    stub_from_env.register(
+        "SELECT id, name FROM users",
+        [{"ID": 1, "NAME": "alice"}, {"ID": 2, "NAME": "bob"}],
+    )
+    assert cli.main(["query", "SELECT id, name FROM users"]) == 0
+    out = capsys.readouterr().out
+    assert json.loads(out) == [
+        {"ID": 1, "NAME": "alice"},
+        {"ID": 2, "NAME": "bob"},
+    ]
+
+
+def test_query_serializes_non_json_native_values(
+    stub_from_env: FakeSnowflake, capsys: pytest.CaptureFixture[str]
+) -> None:
+    # Decimal/timestamp/binary travel through _json_default on the way to stdout.
+    stub_from_env.register(
+        "SELECT amount, ts, blob",
+        [
+            {
+                "AMOUNT": Decimal("10.50"),
+                "TS": datetime(2024, 1, 2, 3, 4, 5, tzinfo=timezone.utc),
+                "BLOB": b"\x00\xff",
+            }
+        ],
+    )
+    assert cli.main(["query", "SELECT amount, ts, blob"]) == 0
+    row = json.loads(capsys.readouterr().out)[0]
+    assert row["AMOUNT"] == "10.50"
+    assert row["TS"].startswith("2024-01-02T03:04:05")
+    assert row["BLOB"] == "00ff"
+
+
+def test_query_snowflake_error_exits_1(
+    stub_from_env: FakeSnowflake, capsys: pytest.CaptureFixture[str]
+) -> None:
+    stub_from_env.register_error(
+        "SELECT * FROM nope", "Object 'NOPE' does not exist", code="002003"
+    )
+    assert cli.main(["query", "SELECT * FROM nope"]) == 1
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert captured.err.startswith("error: ")
+    assert "does not exist" in captured.err
+
+
+# ---------------------------------------------------------------------------
+# _json_default serializer (direct unit coverage, incl. the TypeError branch)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("value", "expected"),
+    [
+        (Decimal("1.25"), "1.25"),
+        (datetime(2024, 6, 1, 12, 30, 0), "2024-06-01T12:30:00"),
+        (date(2024, 6, 1), "2024-06-01"),
+        (time(9, 15, 30), "09:15:30"),
+        (b"\xde\xad", "dead"),
+        (bytearray(b"\xbe\xef"), "beef"),
+    ],
+)
+def test_json_default_serializes(value: object, expected: str) -> None:
+    assert cli._json_default(value) == expected
+
+
+def test_json_default_rejects_unsupported() -> None:
+    with pytest.raises(TypeError, match="cannot serialize"):
+        cli._json_default(object())

snowflake_sql_api-0.1.2/tests/test_import_footprint.py

@@ -0,0 +1,108 @@
+"""Guard the install footprint: a bare ``import snowflake_sql_api`` stays light.
+
+The package's whole value proposition is a small install and a fast cold start
+(serverless / Lambda). Two regressions would silently erode that:
+
+1. A heavy optional dependency (pandas / pyarrow) getting imported at module top
+   instead of behind its extra. The ``[pandas]`` feature must stay opt-in.
+2. Import time ballooning for any reason.
+
+Both checks run in a **fresh subprocess** so the parent pytest process's
+already-imported modules can't mask a regression (pandas may well be imported by
+the time these tests run). The leak check installs a recording meta-path finder
+that stubs the forbidden names, so it fires deterministically whether or not the
+real packages are installed: a module-top ``import pandas`` is caught even when
+it is guarded by ``try/except ImportError`` and even in an env without pandas.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+
+# Heavy optional deps that a bare import must never pull in. pandas is the
+# ``[pandas]`` extra; pyarrow/numpy ride in with it. If any is imported at module
+# top, something bypassed the optional-import guard.
+FORBIDDEN_ON_BARE_IMPORT = ("pandas", "pyarrow", "numpy")
+
+# Generous ceiling: the real cold import (httpx + PyJWT + cryptography, all pure
+# Python or fast C imports) is well under a second. This is a coarse backstop
+# against an order-of-magnitude regression, not a precise benchmark, so the bound
+# is deliberately loose and we assert on the best of several samples to stay
+# non-flaky on shared CI runners.
+IMPORT_BUDGET_SECONDS = 2.5
+TIMING_SAMPLES = 3
+
+# Subprocess: record any *attempt* to import a forbidden module during a bare
+# `import snowflake_sql_api`. The recorder returns a stub module for forbidden
+# names, so the import succeeds (and is recorded) regardless of whether the real
+# dependency is installed -- making the guard deterministic across environments.
+_LEAK_SCRIPT = """
+import importlib.abc
+import importlib.machinery
+import sys
+import types
+
+FORBIDDEN = {forbidden!r}
+attempted = []
+
+
+class _Recorder(importlib.abc.MetaPathFinder, importlib.abc.Loader):
+    def find_spec(self, name, path, target=None):
+        if name.split(".")[0] in FORBIDDEN:
+            attempted.append(name.split(".")[0])
+            return importlib.machinery.ModuleSpec(name, self)
+        return None
+
+    def create_module(self, spec):
+        return types.ModuleType(spec.name)
+
+    def exec_module(self, module):
+        pass
+
+
+sys.meta_path.insert(0, _Recorder())
+import snowflake_sql_api  # noqa: F401
+print(",".join(sorted(set(attempted))))
+""".format(
+    forbidden=FORBIDDEN_ON_BARE_IMPORT
+)
+
+_TIMING_SCRIPT = """
+import time
+start = time.perf_counter()
+import snowflake_sql_api  # noqa: F401
+print(time.perf_counter() - start)
+"""
+
+
+def _run(script: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [sys.executable, "-c", script], capture_output=True, text=True
+    )
+
+
+def test_bare_import_pulls_no_heavy_deps() -> None:
+    result = _run(_LEAK_SCRIPT)
+    assert (
+        result.returncode == 0
+    ), f"`import snowflake_sql_api` failed in a clean subprocess:\n{result.stderr}"
+    attempted = [name for name in result.stdout.strip().split(",") if name]
+    assert not attempted, (
+        f"bare `import snowflake_sql_api` tried to import heavy deps: {attempted}. "
+        "Keep optional dependencies behind their extra (lazy import)."
+    )
+
+
+def test_bare_import_is_fast() -> None:
+    samples = []
+    for _ in range(TIMING_SAMPLES):
+        result = _run(_TIMING_SCRIPT)
+        assert result.returncode == 0, result.stderr
+        samples.append(float(result.stdout.strip()))
+    best = min(samples)
+    assert best < IMPORT_BUDGET_SECONDS, (
+        f"fastest of {TIMING_SAMPLES} imports was {best:.3f}s, over the "
+        f"{IMPORT_BUDGET_SECONDS}s budget. A heavy import likely crept into the "
+        "module-load path."
+    )

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/tests/test_package.py

@@ -10,6 +10,7 @@ import snowflake_sql_api as sf
 from snowflake_sql_api.exceptions import (
     ResultNotReady,
     SnowflakeError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
 )
@@ -39,6 +40,8 @@ def test_exception_hierarchy() -> None:
     assert issubclass(ResultNotReady, SnowflakeError)
     # A programming error is a request error (HTTP 422 specialization).
     assert issubclass(SnowflakeProgrammingError, SnowflakeRequestError)
+    # So is a forbidden error (HTTP 403 specialization), keeping 403 non-breaking.
+    assert issubclass(SnowflakeForbiddenError, SnowflakeRequestError)
 
 
 def test_request_error_carries_envelope_fields() -> None:

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/tests/test_regression.py

@@ -1,4 +1,4 @@
-"""Named regression tests for the four spike-discovered bugs.
+"""Named regression tests for the four spike-discovered bugs, plus later fixes.
 
 Each fixed bug gets a test marked ``regression`` so ``pytest -k regression``
 proves they stay fixed. Bug #2 (on_query in the streaming path) lands with
@@ -11,9 +11,13 @@ import httpx
 import pytest
 import respx
 
-from snowflake_sql_api import SnowflakeClient
+from snowflake_sql_api import AsyncSnowflakeClient, SnowflakeClient
 from snowflake_sql_api.auth import normalize_account_locator
-from snowflake_sql_api.exceptions import ResultNotReady
+from snowflake_sql_api.exceptions import (
+    ResultNotReady,
+    SnowflakeForbiddenError,
+    SnowflakeRequestError,
+)
 
 from .support import ACCOUNT, STATEMENTS_URL, USER, ok_body, running_body, statement_url
 
@@ -21,6 +25,13 @@ pytestmark = pytest.mark.regression
 
 INT_COL = [{"name": "N", "type": "fixed", "scale": 0}]
 
+FORBIDDEN_BODY = {
+    "code": "TEST403",
+    "message": "SQL API is not enabled for this account",
+    "sqlState": "TEST1",
+    "statementHandle": "forbidden-handle",
+}
+
 
 def test_regression_bug1_jwt_account_locator_strips_region() -> None:
     """Bug #1: the JWT claim account must drop the region/cloud suffix.
@@ -85,3 +96,48 @@ def test_regression_bug4_fetches_all_partitions(private_key_pem: bytes) -> None:
     client.close()
     # Partition 0 (inline) + partitions 1 and 2, in order, none dropped.
     assert [r["N"] for r in rows] == [0, 1, 2, 3]
+
+
+def _assert_forbidden(exc: SnowflakeForbiddenError) -> None:
+    # Still a SnowflakeRequestError, so existing handlers keep catching 403.
+    assert isinstance(exc, SnowflakeRequestError)
+    assert exc.status_code == 403
+    assert exc.code == "TEST403"
+    assert exc.sql_state == "TEST1"
+    assert exc.statement_handle == "forbidden-handle"
+    assert str(exc) == "SQL API is not enabled for this account"
+
+
+@respx.mock
+def test_regression_403_raises_forbidden_error(private_key_pem: bytes) -> None:
+    """HTTP 403 maps to SnowflakeForbiddenError, not the generic request error.
+
+    An authenticated-but-refused request must be distinguishable from a
+    malformed one without parsing ``status_code``.
+    """
+    route = respx.post(STATEMENTS_URL).mock(
+        return_value=httpx.Response(403, json=FORBIDDEN_BODY)
+    )
+    client = SnowflakeClient(ACCOUNT, USER, private_key=private_key_pem)
+    with pytest.raises(SnowflakeForbiddenError) as info:
+        client.query("SELECT 1")
+    client.close()
+    _assert_forbidden(info.value)
+    # 403 is not retryable: one request, no retry loop.
+    assert route.call_count == 1
+
+
+@respx.mock
+async def test_regression_403_raises_forbidden_error_async(
+    private_key_pem: bytes,
+) -> None:
+    """Async parity for the 403 mapping."""
+    route = respx.post(STATEMENTS_URL).mock(
+        return_value=httpx.Response(403, json=FORBIDDEN_BODY)
+    )
+    client = AsyncSnowflakeClient(ACCOUNT, USER, private_key=private_key_pem)
+    with pytest.raises(SnowflakeForbiddenError) as info:
+        await client.query("SELECT 1")
+    await client.aclose()
+    _assert_forbidden(info.value)
+    assert route.call_count == 1

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/tests/test_testing.py

@@ -46,6 +46,7 @@ def test_make_client_returns_real_client() -> None:
     assert isinstance(client, SnowflakeClient)
     assert client.query_scalar("SELECT 1") == 1
     client.close()
+    assert client._transport._client.is_closed
 
 
 def test_make_client_rejects_managed_kwargs() -> None:
@@ -304,6 +305,7 @@ async def test_async_query() -> None:
     assert isinstance(client, AsyncSnowflakeClient)
     assert await client.query("SELECT id FROM t") == [{"ID": 1}, {"ID": 2}]
     await client.aclose()
+    assert client._transport._client.is_closed
 
 
 async def test_async_submit_and_result() -> None:

{snowflake_sql_api-0.1.0 → snowflake_sql_api-0.1.2}/tests/test_transport.py

@@ -9,6 +9,7 @@ import respx
 from snowflake_sql_api.auth import KeypairAuthenticator
 from snowflake_sql_api.exceptions import (
     SnowflakeAuthError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
     SnowflakeRetryError,
@@ -148,6 +149,28 @@ def test_retry_exhaustion_raises_retry_error(private_key_pem: bytes) -> None:
     assert route.call_count == 3  # max_attempts
 
 
+@respx.mock
+def test_custom_policy_retrying_403_chains_plain_request_error(
+    private_key_pem: bytes,
+) -> None:
+    # Retried statuses never reach _interpret, so an exhausted 403 retry carries
+    # the generic SnowflakeRequestError as its cause, like every other status.
+    route = respx.post(STATEMENTS_URL).mock(
+        return_value=httpx.Response(403, json={"message": "forbidden"})
+    )
+    retry_403 = RetryPolicy(
+        max_attempts=2, base_backoff=0.0, jitter=False, retry_statuses=frozenset({403})
+    )
+    transport = make_transport(private_key_pem, retry=retry_403)
+    with pytest.raises(SnowflakeRetryError) as info:
+        transport.submit({"statement": "x"}, request_id="r1")
+    cause = info.value.__cause__
+    assert isinstance(cause, SnowflakeRequestError)
+    assert not isinstance(cause, SnowflakeForbiddenError)
+    assert cause.status_code == 403
+    assert route.call_count == 2
+
+
 @respx.mock
 def test_network_error_is_retried(private_key_pem: bytes) -> None:
     route = respx.post(STATEMENTS_URL).mock(