nhi: sync programmatic access tokens as STATIC_SECRET resources (Phase-1 class-B)#126
Open
c1-squire-dev[bot] wants to merge 2 commits into
Open
nhi: sync programmatic access tokens as STATIC_SECRET resources (Phase-1 class-B)#126c1-squire-dev[bot] wants to merge 2 commits into
c1-squire-dev[bot] wants to merge 2 commits into
Conversation
Add programmatic_access_token resource type (TRAIT_SECRET, CREDENTIAL_TYPE_STATIC_SECRET, detail "snowflake.pat") synced per user via SHOW USER PROGRAMMATIC ACCESS TOKENS FOR USER. Enumeration path: per-user fan-out over already-synced users calling SHOW USER PROGRAMMATIC ACCESS TOKENS FOR USER <name> through the Statements API (same mechanism as SHOW SECRETS / DESCRIBE USER). The token value is never returned by Snowflake — only metadata. Gated behind the existing --sync-secrets flag, consistent with rsa_public_key and secret (#124). Users gain a second ChildResourceType annotation for programmatic_access_token when SyncSecrets is true. Doc refs (D-318): - https://docs.snowflake.com/en/sql-reference/sql/show-user-programmatic-access-tokens - https://docs.snowflake.com/en/sql-reference/account-usage/credentials Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Contributor
Connector PR Review: nhi: sync programmatic access tokens as STATIC_SECRET resources (Phase-1 class-B)Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe new commits regenerate Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
…es table New programmatic_access_token resource type (TRAIT_SECRET, CAPABILITY_SYNC) added in the NHI commit now appears in capabilities output. Commit the regenerated artifact and add a matching row to the connector docs table. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 Preview: C1
Summary
Implements the class-B follow-on from the snowbricks grounding report: sync Snowflake Programmatic Access Tokens (PATs) as
programmatic_access_tokenresources (TRAIT_SECRET,CREDENTIAL_TYPE_STATIC_SECRET).SHOW USER PROGRAMMATIC ACCESS TOKENS FOR USER "<name>"over the already-synced user list (same Statements API path asSHOW SECRETS/DESCRIBE USER). [[D-318] ref: https://docs.snowflake.com/en/sql-reference/sql/show-user-programmatic-access-tokens]SNOWFLAKE.ACCOUNT_USAGE.CREDENTIALSview also contains PATs account-wide [[D-318] ref: https://docs.snowflake.com/en/sql-reference/account-usage/credentials] but has up to 2-hour latency; per-user fan-out preferred for freshness.What's new
pkg/snowflake/pat.goProgrammaticAccessTokenstruct +ListProgrammaticAccessTokensclient methodpkg/connector/pat.gopatBuilder— per-user fan-out syncer following the rsa.go exemplarpkg/connector/pat_test.gopkg/connector/resource_types.goprogrammatic_access_tokenresource typepkg/connector/connector.gonewPATBuilderinside theSyncSecretsgate (mirrors #124 pattern)pkg/connector/users.goChildResourceTypeannotation forprogrammatic_access_tokenwhensyncSecretsPattern reference
Follows the rsa.go/secrets.go exemplars from #124:
TRAIT_SECRET+CREDENTIAL_TYPE_STATIC_SECRETper RFC §2.3 (PAT = opaque bearer token, same class as Databricks PAT)WithSecretDetail("snowflake.pat")per §2.8 conventionWithSecretIdentityID(userResourceID)back-ref to the owning userWithSecretCreatedAt/WithSecretExpiresAtwhere non-zeroV1Identifierset (precedent baton-temporalcloud#82 r3380796810)--sync-secretsflagPrivileges required
The connector role must hold
MODIFYon each user object (orUSERADMIN/SECURITYADMINwhich satisfy this transitively). A 422 Unprocessable Entity response is silently skipped per the existing rsa.go pattern.Test plan
go vet ./pkg/...— cleango test ./pkg/...— all tests pass (5 new, existing suite unchanged)go build ./...— cleanBuilt with pqprime (bd pqprime-16u) · NHI Phase-1 class-B Snowflake PAT syncer
Exposed endpoints
🏰 Squire environment: silver-quail-73054
Task: 51f1fd08-2c0b-4c22-92cc-b60ed69f18eb