snowflake-sql-api 0.1.1__tar.gz → 0.1.2__tar.gz

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: snowflake-sql-api
-Version: 0.1.1
+Version: 0.1.2
 Summary: Lightweight, pure-Python client for Snowflake's SQL API v2
 Project-URL: Homepage, https://github.com/hampsterx/snowflake-sql-api
 Project-URL: Repository, https://github.com/hampsterx/snowflake-sql-api
@@ -47,7 +47,7 @@ Requires-Dist: cryptography>=3.4
 Requires-Dist: httpx>=0.24
 Requires-Dist: pyjwt>=2.4
 Provides-Extra: dev
-Requires-Dist: black<25.12,>=24.0; extra == 'dev'
+Requires-Dist: black<25.10,>=24.0; extra == 'dev'
 Requires-Dist: build>=1.0; extra == 'dev'
 Requires-Dist: coverage[toml]>=7.0; extra == 'dev'
 Requires-Dist: mypy>=1.8; extra == 'dev'
@@ -72,9 +72,10 @@ A lightweight, pure-Python client for [Snowflake's SQL API v2](https://docs.snow
 ## Why
 
 The official [`snowflake-connector-python`](https://pypi.org/project/snowflake-connector-python/)
-is ~75 MB installed (150 MB with pandas/pyarrow), has an 8-20 s cold start, and
-ships a compiled extension that slows container builds. For serverless and AWS
-Lambda workloads that only need to run SQL, that is a lot of weight.
+is ~75 MB installed (150 MB with pandas/pyarrow) and ships a compiled extension
+that slows container builds and inflates cold starts (its import alone is ~1.5 s
+versus ~0.3 s for this client). For serverless and AWS Lambda workloads that only
+need to run SQL, that is a lot of weight.
 
 `snowflake-sql-api` talks to Snowflake's SQL API over plain HTTP (`httpx`), so it
 stays small and cold-starts quickly. Core dependencies: `httpx`, `PyJWT`,

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/README.md

@@ -8,9 +8,10 @@ A lightweight, pure-Python client for [Snowflake's SQL API v2](https://docs.snow
 ## Why
 
 The official [`snowflake-connector-python`](https://pypi.org/project/snowflake-connector-python/)
-is ~75 MB installed (150 MB with pandas/pyarrow), has an 8-20 s cold start, and
-ships a compiled extension that slows container builds. For serverless and AWS
-Lambda workloads that only need to run SQL, that is a lot of weight.
+is ~75 MB installed (150 MB with pandas/pyarrow) and ships a compiled extension
+that slows container builds and inflates cold starts (its import alone is ~1.5 s
+versus ~0.3 s for this client). For serverless and AWS Lambda workloads that only
+need to run SQL, that is a lot of weight.
 
 `snowflake-sql-api` talks to Snowflake's SQL API over plain HTTP (`httpx`), so it
 stays small and cold-starts quickly. Core dependencies: `httpx`, `PyJWT`,

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/pyproject.toml

@@ -41,9 +41,12 @@ dev = [
     "pytest-asyncio>=0.21",
     "respx>=0.20",
     "ruff>=0.4",
-    # Capped below 25.10: 25.12.0+ drop Python 3.9, which the package still
-    # supports. Keeps CI and the pinned pre-commit hook on the same black.
-    "black>=24.0,<25.12",
+    # Capped below 25.10 so CI formats with the same black the pre-commit hook
+    # pins (rev 25.9.0 in .pre-commit-config.yaml). Move the two together by
+    # hand; Dependabot ignores black (.github/dependabot.yml). Keep the cap at
+    # or below 25.12 while Python 3.9 is supported: 25.12.0+ require 3.10, so
+    # a higher cap resolves a different black per interpreter.
+    "black>=24.0,<25.10",
     "mypy>=1.8",
     "build>=1.0",
     "pre-commit>=3.5",

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/snowflake_sql_api/__init__.py

@@ -33,6 +33,7 @@ from .exceptions import (
     SnowflakeAuthError,
     SnowflakeConfigError,
     SnowflakeError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
     SnowflakeRetryError,
@@ -51,6 +52,7 @@ __all__ = [
     "SnowflakeConfigError",
     "SnowflakeAuthError",
     "SnowflakeRequestError",
+    "SnowflakeForbiddenError",
     "SnowflakeProgrammingError",
     "SnowflakeTimeoutError",
     "SnowflakeRetryError",

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/snowflake_sql_api/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.1'
-__version_tuple__ = version_tuple = (0, 1, 1)
+__version__ = version = '0.1.2'
+__version_tuple__ = version_tuple = (0, 1, 2)
 
 __commit_id__ = commit_id = None

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/snowflake_sql_api/exceptions.py

@@ -14,6 +14,7 @@ __all__ = [
     "SnowflakeConfigError",
     "SnowflakeAuthError",
     "SnowflakeRequestError",
+    "SnowflakeForbiddenError",
     "SnowflakeProgrammingError",
     "SnowflakeTimeoutError",
     "SnowflakeRetryError",
@@ -62,6 +63,15 @@ class SnowflakeRequestError(SnowflakeError):
         self.statement_handle = statement_handle
 
 
+class SnowflakeForbiddenError(SnowflakeRequestError):
+    """Snowflake refused an authenticated request (HTTP 403).
+
+    The JWT was accepted but the request is not allowed, so retrying with the
+    same identity will not help. A subclass of :class:`SnowflakeRequestError`,
+    so existing handlers for that type still catch it.
+    """
+
+
 class SnowflakeProgrammingError(SnowflakeRequestError):
     """The submitted SQL failed to compile or execute (HTTP 422).
 

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/snowflake_sql_api/transport.py

@@ -1,10 +1,11 @@
 """HTTP transport against ``POST /api/v2/statements``.
 
 Owns the actual ``httpx`` calls (sync and async), status-code interpretation
-(200 success, 202 long-running/async, 422 execution failure, 401 auth, 429/5xx
-retryable), the retry loop, and ``requestId`` reuse for idempotent retries. A
-retried submit re-POSTs the identical body with the same ``requestId`` and
-``retry=true`` so Snowflake deduplicates instead of double-applying DML.
+(200 success, 202 long-running/async, 422 execution failure, 401 auth,
+403 forbidden, 429/5xx retryable), the retry loop, and ``requestId`` reuse for
+idempotent retries. A retried submit re-POSTs the identical body with the same
+``requestId`` and ``retry=true`` so Snowflake deduplicates instead of
+double-applying DML.
 
 Higher layers (``client``/``aclient``) talk to the transport, not to ``httpx``.
 """
@@ -19,6 +20,7 @@ import httpx
 
 from .exceptions import (
     SnowflakeAuthError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
     SnowflakeRetryError,
@@ -84,6 +86,14 @@ def _interpret(response: httpx.Response) -> StatementResponse:
         )
     if status == 401:
         raise SnowflakeAuthError(body.get("message", "authentication failed"))
+    if status == 403:
+        raise SnowflakeForbiddenError(
+            body.get("message", "request forbidden"),
+            status_code=status,
+            code=body.get("code"),
+            sql_state=body.get("sqlState"),
+            statement_handle=body.get("statementHandle"),
+        )
     raise SnowflakeRequestError(
         body.get("message", f"HTTP {status}"),
         status_code=status,

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/tests/test_package.py

@@ -10,6 +10,7 @@ import snowflake_sql_api as sf
 from snowflake_sql_api.exceptions import (
     ResultNotReady,
     SnowflakeError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
 )
@@ -39,6 +40,8 @@ def test_exception_hierarchy() -> None:
     assert issubclass(ResultNotReady, SnowflakeError)
     # A programming error is a request error (HTTP 422 specialization).
     assert issubclass(SnowflakeProgrammingError, SnowflakeRequestError)
+    # So is a forbidden error (HTTP 403 specialization), keeping 403 non-breaking.
+    assert issubclass(SnowflakeForbiddenError, SnowflakeRequestError)
 
 
 def test_request_error_carries_envelope_fields() -> None:

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/tests/test_regression.py

@@ -1,4 +1,4 @@
-"""Named regression tests for the four spike-discovered bugs.
+"""Named regression tests for the four spike-discovered bugs, plus later fixes.
 
 Each fixed bug gets a test marked ``regression`` so ``pytest -k regression``
 proves they stay fixed. Bug #2 (on_query in the streaming path) lands with
@@ -11,9 +11,13 @@ import httpx
 import pytest
 import respx
 
-from snowflake_sql_api import SnowflakeClient
+from snowflake_sql_api import AsyncSnowflakeClient, SnowflakeClient
 from snowflake_sql_api.auth import normalize_account_locator
-from snowflake_sql_api.exceptions import ResultNotReady
+from snowflake_sql_api.exceptions import (
+    ResultNotReady,
+    SnowflakeForbiddenError,
+    SnowflakeRequestError,
+)
 
 from .support import ACCOUNT, STATEMENTS_URL, USER, ok_body, running_body, statement_url
 
@@ -21,6 +25,13 @@ pytestmark = pytest.mark.regression
 
 INT_COL = [{"name": "N", "type": "fixed", "scale": 0}]
 
+FORBIDDEN_BODY = {
+    "code": "TEST403",
+    "message": "SQL API is not enabled for this account",
+    "sqlState": "TEST1",
+    "statementHandle": "forbidden-handle",
+}
+
 
 def test_regression_bug1_jwt_account_locator_strips_region() -> None:
     """Bug #1: the JWT claim account must drop the region/cloud suffix.
@@ -85,3 +96,48 @@ def test_regression_bug4_fetches_all_partitions(private_key_pem: bytes) -> None:
     client.close()
     # Partition 0 (inline) + partitions 1 and 2, in order, none dropped.
     assert [r["N"] for r in rows] == [0, 1, 2, 3]
+
+
+def _assert_forbidden(exc: SnowflakeForbiddenError) -> None:
+    # Still a SnowflakeRequestError, so existing handlers keep catching 403.
+    assert isinstance(exc, SnowflakeRequestError)
+    assert exc.status_code == 403
+    assert exc.code == "TEST403"
+    assert exc.sql_state == "TEST1"
+    assert exc.statement_handle == "forbidden-handle"
+    assert str(exc) == "SQL API is not enabled for this account"
+
+
+@respx.mock
+def test_regression_403_raises_forbidden_error(private_key_pem: bytes) -> None:
+    """HTTP 403 maps to SnowflakeForbiddenError, not the generic request error.
+
+    An authenticated-but-refused request must be distinguishable from a
+    malformed one without parsing ``status_code``.
+    """
+    route = respx.post(STATEMENTS_URL).mock(
+        return_value=httpx.Response(403, json=FORBIDDEN_BODY)
+    )
+    client = SnowflakeClient(ACCOUNT, USER, private_key=private_key_pem)
+    with pytest.raises(SnowflakeForbiddenError) as info:
+        client.query("SELECT 1")
+    client.close()
+    _assert_forbidden(info.value)
+    # 403 is not retryable: one request, no retry loop.
+    assert route.call_count == 1
+
+
+@respx.mock
+async def test_regression_403_raises_forbidden_error_async(
+    private_key_pem: bytes,
+) -> None:
+    """Async parity for the 403 mapping."""
+    route = respx.post(STATEMENTS_URL).mock(
+        return_value=httpx.Response(403, json=FORBIDDEN_BODY)
+    )
+    client = AsyncSnowflakeClient(ACCOUNT, USER, private_key=private_key_pem)
+    with pytest.raises(SnowflakeForbiddenError) as info:
+        await client.query("SELECT 1")
+    await client.aclose()
+    _assert_forbidden(info.value)
+    assert route.call_count == 1

{snowflake_sql_api-0.1.1 → snowflake_sql_api-0.1.2}/tests/test_transport.py

@@ -9,6 +9,7 @@ import respx
 from snowflake_sql_api.auth import KeypairAuthenticator
 from snowflake_sql_api.exceptions import (
     SnowflakeAuthError,
+    SnowflakeForbiddenError,
     SnowflakeProgrammingError,
     SnowflakeRequestError,
     SnowflakeRetryError,
@@ -148,6 +149,28 @@ def test_retry_exhaustion_raises_retry_error(private_key_pem: bytes) -> None:
     assert route.call_count == 3  # max_attempts
 
 
+@respx.mock
+def test_custom_policy_retrying_403_chains_plain_request_error(
+    private_key_pem: bytes,
+) -> None:
+    # Retried statuses never reach _interpret, so an exhausted 403 retry carries
+    # the generic SnowflakeRequestError as its cause, like every other status.
+    route = respx.post(STATEMENTS_URL).mock(
+        return_value=httpx.Response(403, json={"message": "forbidden"})
+    )
+    retry_403 = RetryPolicy(
+        max_attempts=2, base_backoff=0.0, jitter=False, retry_statuses=frozenset({403})
+    )
+    transport = make_transport(private_key_pem, retry=retry_403)
+    with pytest.raises(SnowflakeRetryError) as info:
+        transport.submit({"statement": "x"}, request_id="r1")
+    cause = info.value.__cause__
+    assert isinstance(cause, SnowflakeRequestError)
+    assert not isinstance(cause, SnowflakeForbiddenError)
+    assert cause.status_code == 403
+    assert route.call_count == 2
+
+
 @respx.mock
 def test_network_error_is_retried(private_key_pem: bytes) -> None:
     route = respx.post(STATEMENTS_URL).mock(