Skip to content

[Bug]: Enforce explicit Snowflake session initialization after connect #46

@fas89

Description

@fas89

Problem

After establishing a Snowflake session, forge-cli does not explicitly issue USE ROLE, USE WAREHOUSE, USE DATABASE, and USE SCHEMA. If account or connector defaults leak through, actions can run under the wrong role or session context, which is both a correctness problem and an audit problem.

What should be fixed

  • Add a _initialize_session(conn, resolved_config) helper in fluid_build/providers/snowflake/connection.py.
  • Issue USE ROLE, USE WAREHOUSE, USE DATABASE, and USE SCHEMA in that order when values are present in resolved config.
  • Validate identifiers before interpolation.
  • If any USE statement fails, close the connection and abort with a clear error.
  • Add a strict-session-init feature flag with stricter behavior for apply and plan than for verify.
  • Add a unit test that verifies the USE statements are emitted in order.

Why now

This is a pragmatic hardening fix that improves RBAC correctness and auditability without pulling in the broader warehouse-class or role-class design work.

Trello reference

https://trello.com/c/d6M2PqG9/46-p0-snowflake-enforce-explicit-session-use-role-warehouse-database-schema

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions