Skip to content

Commit ed6f73f

Browse files
denikclaude
denik
and
claude
authored
direct: support references to/from grants (#4774)
Follow up to #4703 but for grants. Allows references to/from grant objects and removes grants.grants in the path. --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
1 parent 2c24bd3 commit ed6f73f

File tree

28 files changed

+309
-48
lines changed

28 files changed

+309
-48
lines changed

‎acceptance/bundle/invariant/configs/schema_grant_ref.yml.tmpl‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
bundle:
2+
name: test-bundle-$UNIQUE_NAME
3+
4+
resources:
5+
schemas:
6+
schema_b:
7+
catalog_name: main
8+
name: test-schema-b-$UNIQUE_NAME
9+
grants:
10+
- principal: account users
11+
privileges:
12+
- USE_SCHEMA
13+
- principal: admins
14+
privileges:
15+
- CREATE_TABLE
16+
- USE_SCHEMA
17+
18+
schema_a:
19+
catalog_name: main
20+
name: test-schema-a-$UNIQUE_NAME
21+
grants:
22+
# Reference principal and privileges from schema_b by index
23+
- principal: ${resources.schemas.schema_b.grants[0].principal}
24+
privileges:
25+
- USE_SCHEMA
26+
- principal: ${resources.schemas.schema_b.grants[1].principal}
27+
privileges:
28+
- CREATE_TABLE

‎acceptance/bundle/invariant/configs/schema_with_grants.yml.tmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
bundle:
2+
name: test-bundle-$UNIQUE_NAME
3+
4+
resources:
5+
schemas:
6+
foo:
7+
catalog_name: main
8+
name: test-schema-$UNIQUE_NAME
9+
grants:
10+
- principal: account users
11+
privileges:
12+
- USE_SCHEMA

‎acceptance/bundle/invariant/continue_293/out.test.toml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎acceptance/bundle/invariant/continue_293/test.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Cloud = false
22
Slow = true
33

4-
# Cross-resource permission references (${resources.jobs.X.permissions[N].field}) require
5-
# permissions to be part of the job schema, which was added after v0.293.0.
4+
# $resources references to permissions and grants are not supported on v0.293.0
65
EnvMatrixExclude.no_permission_ref = ["INPUT_CONFIG=job_permission_ref.yml.tmpl"]
76
EnvMatrixExclude.no_cross_resource_ref = ["INPUT_CONFIG=job_cross_resource_ref.yml.tmpl"]
7+
EnvMatrixExclude.no_grant_ref = ["INPUT_CONFIG=schema_grant_ref.yml.tmpl"]

‎acceptance/bundle/invariant/migrate/out.test.toml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎acceptance/bundle/invariant/migrate/test.toml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,6 @@ EnvMatrixExclude.no_secret_scope = ["INPUT_CONFIG=secret_scope.yml.tmpl"]
1313
# ends up as the permission level value.
1414
EnvMatrixExclude.no_permission_ref = ["INPUT_CONFIG=job_permission_ref.yml.tmpl"]
1515
EnvMatrixExclude.no_cross_resource_ref = ["INPUT_CONFIG=job_cross_resource_ref.yml.tmpl"]
16+
17+
# Grant cross-references require the EmbeddedSlice pattern not present in terraform mode.
18+
EnvMatrixExclude.no_grant_ref = ["INPUT_CONFIG=schema_grant_ref.yml.tmpl"]

‎acceptance/bundle/invariant/no_drift/out.test.toml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎acceptance/bundle/invariant/test.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ EnvMatrix.INPUT_CONFIG = [
4545
"postgres_project.yml.tmpl",
4646
"registered_model.yml.tmpl",
4747
"schema.yml.tmpl",
48+
"schema_grant_ref.yml.tmpl",
49+
"schema_with_grants.yml.tmpl",
4850
"secret_scope.yml.tmpl",
4951
"synced_database_table.yml.tmpl",
5052
"volume.yml.tmpl",

‎acceptance/bundle/migrate/grants/out.new_state.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
"state": {
2525
"securable_type": "function",
2626
"full_name": "main.schema_grants.mymodel",
27-
"grants": [
27+
"__embed__": [
2828
{
2929
"principal": "[email protected]",
3030
"privileges": [
@@ -52,7 +52,7 @@
5252
"state": {
5353
"securable_type": "schema",
5454
"full_name": "main.schema_grants",
55-
"grants": [
55+
"__embed__": [
5656
{
5757
"principal": "[email protected]",
5858
"privileges": [
@@ -89,7 +89,7 @@
8989
"state": {
9090
"securable_type": "volume",
9191
"full_name": "main.schema_grants.volume_name",
92-
"grants": [
92+
"__embed__": [
9393
{
9494
"principal": "[email protected]",
9595
"privileges": [

‎acceptance/bundle/refschema/out.fields.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,10 @@ resources.catalogs.*.updated_by string REMOTE
253253
resources.catalogs.*.url string INPUT
254254
resources.catalogs.*.grants.full_name string ALL
255255
resources.catalogs.*.grants.securable_type string ALL
256+
resources.catalogs.*.grants[*] catalog.PrivilegeAssignment ALL
257+
resources.catalogs.*.grants[*].principal string ALL
258+
resources.catalogs.*.grants[*].privileges []catalog.Privilege ALL
259+
resources.catalogs.*.grants[*].privileges[*] catalog.Privilege ALL
256260
resources.clusters.*.apply_policy_default_values bool INPUT STATE
257261
resources.clusters.*.autoscale *compute.AutoScale ALL
258262
resources.clusters.*.autoscale.max_workers int ALL
@@ -683,6 +687,10 @@ resources.external_locations.*.updated_by string REMOTE
683687
resources.external_locations.*.url string ALL
684688
resources.external_locations.*.grants.full_name string ALL
685689
resources.external_locations.*.grants.securable_type string ALL
690+
resources.external_locations.*.grants[*] catalog.PrivilegeAssignment ALL
691+
resources.external_locations.*.grants[*].principal string ALL
692+
resources.external_locations.*.grants[*].privileges []catalog.Privilege ALL
693+
resources.external_locations.*.grants[*].privileges[*] catalog.Privilege ALL
686694
resources.jobs.*.budget_policy_id string ALL
687695
resources.jobs.*.continuous *jobs.Continuous ALL
688696
resources.jobs.*.continuous.pause_status jobs.PauseStatus ALL
@@ -2680,6 +2688,10 @@ resources.registered_models.*.updated_by string ALL
26802688
resources.registered_models.*.url string INPUT
26812689
resources.registered_models.*.grants.full_name string ALL
26822690
resources.registered_models.*.grants.securable_type string ALL
2691+
resources.registered_models.*.grants[*] catalog.PrivilegeAssignment ALL
2692+
resources.registered_models.*.grants[*].principal string ALL
2693+
resources.registered_models.*.grants[*].privileges []catalog.Privilege ALL
2694+
resources.registered_models.*.grants[*].privileges[*] catalog.Privilege ALL
26832695
resources.schemas.*.browse_only bool REMOTE
26842696
resources.schemas.*.catalog_name string ALL
26852697
resources.schemas.*.catalog_type catalog.CatalogType REMOTE
@@ -2709,6 +2721,10 @@ resources.schemas.*.updated_by string REMOTE
27092721
resources.schemas.*.url string INPUT
27102722
resources.schemas.*.grants.full_name string ALL
27112723
resources.schemas.*.grants.securable_type string ALL
2724+
resources.schemas.*.grants[*] catalog.PrivilegeAssignment ALL
2725+
resources.schemas.*.grants[*].principal string ALL
2726+
resources.schemas.*.grants[*].privileges []catalog.Privilege ALL
2727+
resources.schemas.*.grants[*].privileges[*] catalog.Privilege ALL
27122728
resources.secret_scopes.*.backend_azure_keyvault *workspace.AzureKeyVaultSecretScopeMetadata STATE
27132729
resources.secret_scopes.*.backend_azure_keyvault.dns_name string STATE
27142730
resources.secret_scopes.*.backend_azure_keyvault.resource_id string STATE
@@ -2871,3 +2887,7 @@ resources.volumes.*.volume_id string REMOTE
28712887
resources.volumes.*.volume_type catalog.VolumeType ALL
28722888
resources.volumes.*.grants.full_name string ALL
28732889
resources.volumes.*.grants.securable_type string ALL
2890+
resources.volumes.*.grants[*] catalog.PrivilegeAssignment ALL
2891+
resources.volumes.*.grants[*].principal string ALL
2892+
resources.volumes.*.grants[*].privileges []catalog.Privilege ALL
2893+
resources.volumes.*.grants[*].privileges[*] catalog.Privilege ALL

0 commit comments

Comments
 (0)