Skip to content

Parse a Snowflake CREATE DATABASE ROLE by name - #59

Merged
kvlonge merged 1 commit into
mainfrom
fix/snowflake-create-database-role
Nov 5, 2026
Merged

kvlonge merged 1 commit into
mainfrom
fix/snowflake-create-database-role

Conversation

@kvlonge

@kvlonge kvlonge commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Fixes the standing gap the auditor recorded after #56 (D118 c5b1f1e): the documented positive CREATE DATABASE ROLE v1 ; (k2735786d526b, Snowflake-accepted) was rejected on every main since 497ad27.

  • CREATE [ OR REPLACE ] DATABASE ROLE [ IF NOT EXISTS ] <name> [ COMMENT = … ] now parses to a DATABASE ROLE create_object with no source.
  • COMMENT takes a string or an identifier. Snowflake parses COMMENT = m1 there and fails it after parsing (errno 2002).
  • CREATE DATABASE ROLE ; and CREATE DATABASE ROLE CLONE v1 ; still create a database named ROLE (fix(syntax): keep OR REPLACE and quoting on Snowflake database and schema clones #56).
  • Checked against all 38 receipted CREATE … DATABASE ROLE cases: every create-database-role case agrees with its receipt. Still open, and not touched here: CREATE OR ALTER DATABASE ROLE (a separate form, which needs an or_alter field) and CREATE ALTER DATABASE ROLE v1 (opaque, unchanged from main).

The gate result will be posted here.

kvlonge commented Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Gate (D94) on 553656c, base main c793813:

  • CARGO_BUILD_JOBS=1 make check-merge RECORDER=0: exit 0.
  • Coverage diff on catalogue e85aeb3 with evidence 8345244, main binary against head binary: forms +1/-0 (sf.security_admin.create-database-role.create-database-role), obligations +13/-0, nothing lost.
  • Receipt scan over every case, observe rows included: base accepted, head rejected: 0. Head accepted, base rejected: 5, all of which Snowflake parsed (k2735786d526b, k147235299bc1 and k31be2cf579d8 accepted; k67787435f274 2002; kd707a87a7ff5 1004). No refused case becomes accepted.

@kvlonge
kvlonge force-pushed the fix/snowflake-create-database-role branch from 553656c to 6c645a0 Compare November 5, 2026 08:37
CREATE [ OR REPLACE ] DATABASE ROLE [ IF NOT EXISTS ] <name>
[ COMMENT = ... ] now gives a DATABASE ROLE create_object with no source,
where it was rejected before. Snowflake parses COMMENT = <identifier>
there too (errno 2002, after parsing), so the comment takes either.
CREATE DATABASE ROLE ; and CREATE DATABASE ROLE CLONE v1 still create a
database named ROLE.
@kvlonge
kvlonge force-pushed the fix/snowflake-create-database-role branch from 6c645a0 to a398f2e Compare November 5, 2026 08:52

kvlonge commented Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Re-gate (D94) on a398f2e, rebased onto main 45e21bd (#58, checker only; the parser is unchanged since c793813):

  • CARGO_BUILD_JOBS=1 make check-merge RECORDER=0: exit 0.
  • Coverage diff on catalogue 30aab07 with evidence aa78224: forms +1/-0 (sf.security_admin.create-database-role.create-database-role), obligations +13/-0, nothing lost.
  • Receipt scan over every case, observe rows included: base accepted, head rejected: 0. Head accepted, base rejected: 5, all Snowflake-parsed (k2735786d526b, k147235299bc1 and k31be2cf579d8 accepted; k67787435f274 2002; kd707a87a7ff5 1004). No refused case becomes accepted.

@kvlonge
kvlonge merged commit a398f2e into main Nov 5, 2026
kvlonge added a commit that referenced this pull request Nov 5, 2026
Reads the 236 forms whose obligations are all met at main a398f2e,
catalogue 30aab07 and evidence aa78224: 176 approved, 57 findings
(44 all-optional SET bases), 3 withheld. Receipt-direct regression
check against c793813: 0 regressions.
@kvlonge
kvlonge deleted the fix/snowflake-create-database-role branch November 9, 2026 21:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant