deepset-ai / deepset-ai/haystack-core-integrations
Snowflake permissions check too restrictive
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 203
- Forks
- 332
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 80
Description
The Snowflake integration checks if a user has 'select only' access from the latest role assigned to the user. This check is too restrictive, if the user has additional permission outside of select only then the pipeline will fail (pattern="truncate|update|insert|delete|operate|references")
Additionally due to limitations with the connection param integration you cannot pass a snowflake 'role' to the connection params (this issue is related to 1179) if you wanted to specify a role for the connection.
Solution
- Add additional connection parameters to allow for a specific role
- Amend the permissions checker to only check for select access.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by tracing the Snowflake integration's connection-parameter handling and permissions checker, and review related issue 1179 for the role configuration context. Done means a specific Snowflake role can be passed through the connection parameters and permission validation checks only for select access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100