-
Notifications
You must be signed in to change notification settings - Fork 3
[Bug]: Enforce explicit Snowflake session initialization after connect #46
Copy link
Copy link
Closed
Description
Problem
After establishing a Snowflake session, forge-cli does not explicitly issue USE ROLE, USE WAREHOUSE, USE DATABASE, and USE SCHEMA. If account or connector defaults leak through, actions can run under the wrong role or session context, which is both a correctness problem and an audit problem.
What should be fixed
- Add a
_initialize_session(conn, resolved_config)helper influid_build/providers/snowflake/connection.py. - Issue
USE ROLE,USE WAREHOUSE,USE DATABASE, andUSE SCHEMAin that order when values are present in resolved config. - Validate identifiers before interpolation.
- If any
USEstatement fails, close the connection and abort with a clear error. - Add a strict-session-init feature flag with stricter behavior for
applyandplanthan forverify. - Add a unit test that verifies the
USEstatements are emitted in order.
Why now
This is a pragmatic hardening fix that improves RBAC correctness and auditability without pulling in the broader warehouse-class or role-class design work.
Trello reference
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels