Skip to content

dbt-materialize: quote the schema when copying default privileges #38191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
def- merged 1 commit into from
Aug 13, 2026
Merged

dbt-materialize: quote the schema when copying default privileges #38191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion misc/dbt-materialize/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@
* Fix `deploy_init` when the `CI_TAG` environment variable is set. The
deployment schema was tagged without passing the schema name, so the
operation failed with `COMMENT ON SCHEMA ""`. The deployment schema is
now also created with a quoted name, matching how it is dropped.
now also created with a quoted name, matching how it is dropped and how its
grants and default privileges are copied.

## 1.9.11 - 2026-07-26

Expand Down
2 changes: 1 addition & 1 deletion misc/dbt-materialize/dbt/include/materialize/macros/deploy/deploy_init.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ SELECT
WHEN object_owner = 'PUBLIC' THEN 'FOR ALL ROLES '
ELSE 'FOR ROLE ' || quote_ident(object_owner) || ' '
END ||
'IN SCHEMA {{ to }} ' ||
'IN SCHEMA ' || quote_ident({{ dbt.string_literal(to) }}) || ' ' ||
'GRANT ' || privilege_type || ' ' ||
'ON ' || object_type || 's ' ||
CASE
Expand Down
14 changes: 9 additions & 5 deletions misc/dbt-materialize/tests/adapter/test_deploy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,14 +64,18 @@ def cleanup(self, project):
project.run_sql("DROP ROLE IF EXISTS my_role")
project.run_sql("DROP SCHEMA IF EXISTS blue_schema CASCADE")
project.run_sql("DROP SCHEMA IF EXISTS green_schema CASCADE")
project.run_sql('DROP SCHEMA IF EXISTS "Green_Schema" CASCADE')
project.run_sql("DROP CLUSTER IF EXISTS blue_cluster CASCADE")
project.run_sql("DROP CLUSTER IF EXISTS green_cluster CASCADE")

def test_apply_schema_default_privileges(self, project):
# `deploy_init` creates the deployment schema with a quoted name, so a
# non-lowercase name has to survive into the generated statements too.
@pytest.mark.parametrize("to_schema", ["green_schema", "Green_Schema"])
def test_apply_schema_default_privileges(self, project, to_schema):
project.run_sql("CREATE ROLE my_role")
project.run_sql("GRANT my_role TO materialize")
project.run_sql("CREATE SCHEMA blue_schema")
project.run_sql("CREATE SCHEMA green_schema")
project.run_sql(f'CREATE SCHEMA "{to_schema}"')
project.run_sql(
"ALTER DEFAULT PRIVILEGES FOR ROLE my_role IN SCHEMA blue_schema GRANT SELECT ON TABLES TO my_role"
)
Expand All @@ -81,15 +85,15 @@ def test_apply_schema_default_privileges(self, project):
"run-operation",
"internal_copy_schema_default_privs",
"--args",
"{from: blue_schema, to: green_schema}",
f"{{from: blue_schema, to: {to_schema}}}",
]
)

result = project.run_sql(
"""SELECT count(*) = 1
f"""SELECT count(*) = 1
FROM mz_internal.mz_show_default_privileges
WHERE database = current_database()
AND schema = 'green_schema'
AND schema = '{to_schema}'
AND grantee = 'my_role'
AND object_type = 'table'
AND privilege_type = 'SELECT'""",
Expand Down
Loading