Commit fa4f6e6
LAV-3054: Cover accepted REVOKE schema privilege vocabulary (#3412)
Capture Enterprise Snowflake grant, revoke, and SHOW GRANTS results for all 68 documented schema privileges. Extend the SQL parser for their CREATE alternatives and map SNAPSHOT POLICY/SET grant rows to Cloud's BACKUP POLICY/SET spelling.
Co-authored-by: Sabir Akhadov <sabir.akhadov@localstack.cloud>
## Test matrix
ADD SEARCH OPTIMIZATION × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[add_search_optimization]
APPLYBUDGET × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[applybudget]
CREATE AGENT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_agent]
CREATE ALERT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_alert]
CREATE APPLICATION SERVICE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_application_service]
CREATE ARTIFACT REPOSITORY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_artifact_repository]
CREATE CONTACT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_contact]
CREATE CORTEX SEARCH SERVICE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_cortex_search_service]
CREATE DATA METRIC FUNCTION × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_data_metric_function]
CREATE DATASET × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_dataset]
CREATE DBT PROJECT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_dbt_project]
CREATE EVENT TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_event_table]
CREATE EXPERIMENT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_experiment]
CREATE FILE FORMAT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_file_format]
CREATE FUNCTION × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_function]
CREATE GATEWAY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_gateway]
CREATE GIT REPOSITORY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_git_repository]
CREATE IMAGE REPOSITORY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_image_repository]
CREATE MCP SERVER × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_mcp_server]
CREATE MODEL × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_model]
CREATE NETWORK RULE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_network_rule]
CREATE NOTEBOOK × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_notebook]
CREATE PIPE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_pipe]
CREATE PROCEDURE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_procedure]
CREATE AGGREGATION POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_aggregation_policy]
CREATE AUTHENTICATION POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_authentication_policy]
CREATE MASKING POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_masking_policy]
CREATE PACKAGES POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_packages_policy]
CREATE PASSWORD POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_password_policy]
CREATE PRIVACY POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_privacy_policy]
CREATE PROJECTION POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_projection_policy]
CREATE ROW ACCESS POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_row_access_policy]
CREATE SESSION POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_session_policy]
CREATE STORAGE LIFECYCLE POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_storage_lifecycle_policy]
CREATE SECRET × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_secret]
CREATE SEQUENCE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_sequence]
CREATE SERVICE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_service]
CREATE SNAPSHOT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snapshot]
CREATE SNAPSHOT POLICY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snapshot_policy]
CREATE SNAPSHOT SET × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snapshot_set]
CREATE STAGE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_stage]
CREATE STREAM × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_stream]
CREATE STREAMLIT × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_streamlit]
CREATE SNOWFLAKE.CORE.BUDGET × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.core.budget]
CREATE SNOWFLAKE.DATA_PRIVACY.CLASSIFICATION_PROFILE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.data_privacy.classification_profile]
CREATE SNOWFLAKE.DATA_PRIVACY.CUSTOM_CLASSIFIER × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.data_privacy.custom_classifier]
CREATE SNOWFLAKE.ML.ANOMALY_DETECTION × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.ml.anomaly_detection]
CREATE SNOWFLAKE.ML.CLASSIFICATION × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.ml.classification]
CREATE SNOWFLAKE.ML.FORECAST × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.ml.forecast]
CREATE SNOWFLAKE.ML.TOP_INSIGHTS × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.ml.top_insights]
CREATE SNOWFLAKE.ML.DOCUMENT_INTELLIGENCE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_snowflake.ml.document_intelligence]
CREATE TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_table]
CREATE DYNAMIC TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_dynamic_table]
CREATE EXTERNAL TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_external_table]
CREATE HYBRID TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_hybrid_table]
CREATE ICEBERG TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_iceberg_table]
CREATE INTERACTIVE TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_interactive_table]
CREATE ONLINE FEATURE TABLE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_online_feature_table]
CREATE TAG × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_tag]
CREATE TASK × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_task]
CREATE TYPE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_type]
CREATE WORKSPACE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_workspace]
CREATE VIEW × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_view]
CREATE MATERIALIZED VIEW × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_materialized_view]
CREATE SEMANTIC VIEW × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[create_semantic_view]
MODIFY × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[modify]
MONITOR × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[monitor]
USAGE × grant/revoke/status/metadata -> tests/queries/access_control/test_revoke_schema_privilege_vocabulary.py::test_revoke_schema_privilege_vocabulary[usage]
Invalid schema privilege × error -> uncovered: remaining value-space audit follow-up.
ALL PRIVILEGES × expansion -> uncovered: separate scope.
Bulk/future schema and database-role targets -> uncovered: separate scope.
## Deviations
- The hint points to the existing grant vocabulary test for round trips. A separate parameterized REVOKE file keeps this complete accepted-value matrix and its status snapshots together without changing existing compat tests.
- The reference names CREATE SNAPSHOT POLICY and CREATE SNAPSHOT SET; Cloud reports their grant metadata as CREATE BACKUP POLICY and CREATE BACKUP SET, which the grant store now records.
Co-authored-by: spiral <spiral@localhost>1 parent 33c2c7d commit fa4f6e6
1 file changed
Lines changed: 52 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
20743 | 20743 | | |
20744 | 20744 | | |
20745 | 20745 | | |
| 20746 | + | |
| 20747 | + | |
| 20748 | + | |
| 20749 | + | |
| 20750 | + | |
| 20751 | + | |
| 20752 | + | |
| 20753 | + | |
| 20754 | + | |
| 20755 | + | |
| 20756 | + | |
| 20757 | + | |
| 20758 | + | |
| 20759 | + | |
| 20760 | + | |
| 20761 | + | |
| 20762 | + | |
| 20763 | + | |
| 20764 | + | |
| 20765 | + | |
| 20766 | + | |
| 20767 | + | |
| 20768 | + | |
| 20769 | + | |
| 20770 | + | |
| 20771 | + | |
| 20772 | + | |
| 20773 | + | |
| 20774 | + | |
| 20775 | + | |
| 20776 | + | |
| 20777 | + | |
| 20778 | + | |
| 20779 | + | |
| 20780 | + | |
| 20781 | + | |
| 20782 | + | |
| 20783 | + | |
| 20784 | + | |
| 20785 | + | |
| 20786 | + | |
| 20787 | + | |
| 20788 | + | |
| 20789 | + | |
| 20790 | + | |
| 20791 | + | |
| 20792 | + | |
| 20793 | + | |
| 20794 | + | |
| 20795 | + | |
| 20796 | + | |
| 20797 | + | |
20746 | 20798 | | |
20747 | 20799 | | |
20748 | 20800 | | |
| |||
0 commit comments