aminghadersohi commented on code in PR #46055:
URL: https://github.com/apache/superset/pull/46055#discussion_r4492994469
##########
superset/db_engine_specs/snowflake.py:
##########
@@ -178,6 +178,10 @@ def normalize_custom_sql_metric(cls, expression: str) ->
str:
supports_catalog = supports_dynamic_catalog =
supports_cross_catalog_queries = True
supports_grouping_sets = True
+ # Unquoted identifiers are case-insensitive: `information_schema.databases`
+ # lists `SALES`, while the URI (and so the default catalog) usually says
`sales`.
+ case_insensitive_catalogs = True
Review Comment:
Fixed in 87d1be0aac71707f93dbb3418e19a82e6f3cae29. Snowflake keeps exact
catalog permission matching. Only unquoted URI/SQL catalog identifiers fold to
uppercase, before quoting information is lost; quoted names and physical
catalog listings retain their case.
Regression test:
`tests/unit_tests/security/snowflake_catalog_case_test.py::test_quoted_catalog_grant_is_isolated`
runs real permission sync over a mocked listing of distinct `SALES_DB`,
`Sales_Db`, and `sales_db` databases and grants access to only one. Its 64
cases cover catalog/schema permissions, catalog/schema/table lists, dataset
checks/filters, table access, and quoted SQL. Against
c882dbc47b0c9a34369620caec7957d789386638: 62 failed, 2 passed. After the
change: 64 passed. Additional regressions cover unquoted SQL, quoted URI
defaults, and a quoted grant refusing unquoted SQL. Docker run across the
Snowflake, security-manager, and SQL-parser unit-test files: 2092 passed.
Touched-file pre-commit passed, including mypy, ruff, and pylint.
Siblings checked:
- superset/security/manager.py:2551 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:2615 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:2642 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:2713 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:2763 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:3217 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:3389 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:3396 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:3481 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:3517 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:3530 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:5814 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/security/manager.py:5826 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
- superset/utils/filters.py:30 — not affected: exact permission-set
comparison; Snowflake no longer expands those sets across case variants
- superset/connectors/sqla/models.py:3005 — not affected: exact
permission-set comparison, with the same expansion disabled
- superset/databases/filters.py:31 — not affected: filters Superset
connection names, not Snowflake catalog identities
- superset/commands/database/utils.py:301 — not affected: permission sync
preserves the physical catalog listing
- superset/db_engine_specs/base.py:823 — not affected: defaults to exact
matching; repository-wide search found no other engine enabling
case-insensitive catalogs
- tests/unit_tests/security/manager_test.py — not affected: mocked engines
explicitly select exact catalog matching
- superset/sql/parse.py:3728 — fixed in
87d1be0aac71707f93dbb3418e19a82e6f3cae29
All security-manager entries above inherit exact matching by removing
Snowflake's case-insensitive opt-in. Existing lowercase aliases are not
automatically migrated to uppercase; the upgrade note documents using physical
catalog names. No live Snowflake connection was used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
