move create/alter app upgrade calls to sql facade to reclassify errors cause by setup script execution

src/snowflake/cli/_plugins/nativeapp/same_account_install_method.py

@@ -1,3 +1,4 @@
+from dataclasses import dataclass
 from typing import Optional
 
 from snowflake.cli._plugins.nativeapp.constants import (
@@ -8,25 +9,15 @@
     ApplicationCreatedExternallyError,
 )
 from snowflake.cli._plugins.stage.manager import StageManager
+from snowflake.cli.api.project.util import to_identifier
 
 
+@dataclass
 class SameAccountInstallMethod:
     _requires_created_by_cli: bool
-    _from_release_directive: bool
-    version: Optional[str]
-    patch: Optional[int]
-
-    def __init__(
-        self,
-        requires_created_by_cli: bool,
-        version: Optional[str] = None,
-        patch: Optional[int] = None,
-        from_release_directive: bool = False,
-    ):
-        self._requires_created_by_cli = requires_created_by_cli
-        self.version = version
-        self.patch = patch
-        self._from_release_directive = from_release_directive
+    version: Optional[str] = None
+    patch: Optional[int] = None
+    _from_release_directive: bool = False
 
     @classmethod
     def unversioned_dev(cls):
@@ -39,7 +30,7 @@ def versioned_dev(cls, version: str, patch: Optional[int] = None):
 
     @classmethod
     def release_directive(cls):
-        return cls(False, from_release_directive=True)
+        return cls(False, _from_release_directive=True)
 
     @property
     def is_dev_mode(self) -> bool:
@@ -53,8 +44,9 @@ def using_clause(
             return ""
 
         if self.version:
+            version_clause = f"version {to_identifier(self.version)}"
             patch_clause = f"patch {self.patch}" if self.patch else ""
-            return f"using version {self.version} {patch_clause}"
+            return f"using {version_clause} {patch_clause}"
 
         stage_name = StageManager.quote_stage_name(stage_fqn)
         return f"using {stage_name}"

src/snowflake/cli/_plugins/nativeapp/sf_facade_exceptions.py

@@ -11,12 +11,30 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+from __future__ import annotations
+
 from typing import NoReturn
 
 from click import ClickException
 from snowflake.cli._plugins.nativeapp.sf_facade_constants import UseObjectType
+from snowflake.cli.api.errno import (
+    APPLICATION_NO_LONGER_AVAILABLE,
+    CANNOT_UPGRADE_FROM_LOOSE_FILES_TO_VERSION,
+    CANNOT_UPGRADE_FROM_VERSION_TO_LOOSE_FILES,
+    NOT_SUPPORTED_ON_DEV_MODE_APPLICATIONS,
+    ONLY_SUPPORTED_ON_DEV_MODE_APPLICATIONS,
+)
 from snowflake.connector import DatabaseError, Error, ProgrammingError
 
+# Reasons why an `alter application ... upgrade` might fail
+UPGRADE_RESTRICTION_CODES = {
+    CANNOT_UPGRADE_FROM_LOOSE_FILES_TO_VERSION,
+    CANNOT_UPGRADE_FROM_VERSION_TO_LOOSE_FILES,
+    ONLY_SUPPORTED_ON_DEV_MODE_APPLICATIONS,
+    NOT_SUPPORTED_ON_DEV_MODE_APPLICATIONS,
+    APPLICATION_NO_LONGER_AVAILABLE,
+}
+
 
 def handle_unclassified_error(err: Error | Exception, context: str) -> NoReturn:
     """
@@ -115,3 +133,12 @@ def __init__(
         if role:
             message += f" using role: {role}"
         super().__init__(message)
+
+
+class UpgradeApplicationRestrictionError(UserInputError):
+    """
+    Raised when an alter application ... upgrade fails due to user error.
+    Must be caught and handled by the caller of an upgrade_application
+    """
+
+    pass

src/snowflake/cli/_plugins/nativeapp/sf_sql_facade.py

@@ -16,23 +16,39 @@
 import logging
 from contextlib import contextmanager
 from textwrap import dedent
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Optional
 
+from snowflake.cli._plugins.nativeapp.constants import (
+    AUTHORIZE_TELEMETRY_COL,
+    SPECIAL_COMMENT,
+)
+from snowflake.cli._plugins.nativeapp.same_account_install_method import (
+    SameAccountInstallMethod,
+)
 from snowflake.cli._plugins.nativeapp.sf_facade_constants import UseObjectType
 from snowflake.cli._plugins.nativeapp.sf_facade_exceptions import (
+    UPGRADE_RESTRICTION_CODES,
     CouldNotUseObjectError,
     InsufficientPrivilegesError,
     UnexpectedResultError,
+    UpgradeApplicationRestrictionError,
+    UserInputError,
     UserScriptError,
     handle_unclassified_error,
 )
+from snowflake.cli.api.cli_global_context import get_cli_context
+from snowflake.cli.api.constants import ObjectType
 from snowflake.cli.api.errno import (
+    APPLICATION_REQUIRES_TELEMETRY_SHARING,
+    CANNOT_DISABLE_MANDATORY_TELEMETRY,
     DOES_NOT_EXIST_OR_CANNOT_BE_PERFORMED,
     INSUFFICIENT_PRIVILEGES,
     NO_WAREHOUSE_SELECTED_IN_SESSION,
 )
 from snowflake.cli.api.identifiers import FQN
+from snowflake.cli.api.metrics import CLICounterField
 from snowflake.cli.api.project.util import (
+    extract_schema,
     identifier_to_show_like_pattern,
     is_valid_unquoted_identifier,
     to_identifier,
@@ -136,6 +152,74 @@ def _use_schema_optional(self, schema_name: str | None):
         """
         return self._use_object_optional(UseObjectType.SCHEMA, schema_name)
 
+    def _grant_privileges_to_role(
+        self,
+        privileges: list[str],
+        object_type: ObjectType,
+        object_identifier: str,
+        to_role: str,
+        role: Optional[str],
+    ) -> None:
+        """
+        Grants one or more access privileges on a securable object to a role
+
+        Args:
+            privileges (list[str]): List of privileges to grant to a role
+            object_type (ObjectType): Type of snowflake object to grant to a role
+            object_identifier (str): Valid identifier of the snowflake object to grant to a role
+            to_role (str): Name of the role to grant privileges to
+            role (Optional[str]): Name of the role to use to grant privileges
+        """
+        comma_separated_privileges_str = ", ".join(privileges)
+        object_type_and_name = f"{object_type.value.sf_name} {object_identifier}"
+
+        with self._use_role_optional(role):
+            self._sql_executor.execute_query(
+                f"grant {comma_separated_privileges_str} on {object_type_and_name} to role {to_role}"
+            )
+
+    def _grant_privileges_for_create_application(
+        self, package_role: str, package_name: str, stage_fqn: str, app_role: str
+    ):
+        """
+        Grants the required privileges to create an application to an
+        app role when the package role and the app role are not the same
+        """
+        try:
+            self._grant_privileges_to_role(
+                privileges=["install", "develop"],
+                object_type=ObjectType.APPLICATION_PACKAGE,
+                object_identifier=package_name,
+                to_role=app_role,
+                role=package_role,
+            )
+
+            stage_schema = extract_schema(stage_fqn)
+            self._grant_privileges_to_role(
+                privileges=["usage"],
+                object_type=ObjectType.SCHEMA,
+                object_identifier=f"{package_name}.{stage_schema}",
+                to_role=app_role,
+                role=package_role,
+            )
+
+            self._grant_privileges_to_role(
+                privileges=["read"],
+                object_type=ObjectType.STAGE,
+                object_identifier=stage_fqn,
+                to_role=app_role,
+                role=package_role,
+            )
+        except ProgrammingError as err:
+            raise UserInputError(
+                f"Failed to grant the required privileges to create an application with the following error message:\n"
+                f"{err.msg}"
+            ) from err
+        except Exception as err:
+            handle_unclassified_error(
+                err, "Failed to grant the required privileges to create an application"
+            )
+
     def execute_user_script(
         self,
         queries: str,
@@ -503,6 +587,148 @@ def show_release_directives(
                 )
             return cursor.fetchall()
 
+    def upgrade_application(
+        self,
+        name: str,
+        current_app_row: dict,
+        install_method: SameAccountInstallMethod,
+        stage_fqn: str,
+        role: str,
+        warehouse: str,
+        debug_mode: bool | None,
+        should_authorize_event_sharing: bool | None,
+    ) -> list[tuple[str]]:
+        """
+        Upgrades an application object using the provided clauses
+        """
+        install_method.ensure_app_usable(
+            app_name=name,
+            app_role=role,
+            show_app_row=current_app_row,
+        )
+        # If all the above checks are in order, proceed to upgrade
+
+        with self._use_role_optional(role), self._use_warehouse_optional(warehouse):
+            try:
+                using_clause = install_method.using_clause(stage_fqn)
+                upgrade_cursor = self._sql_executor.execute_query(
+                    f"alter application {name} upgrade {using_clause}",
+                )
+
+                # if debug_mode is present (controlled), ensure it is up-to-date
+                if install_method.is_dev_mode:
+                    if debug_mode is not None:
+                        self._sql_executor.execute_query(
+                            f"alter application {name} set debug_mode = {debug_mode}"
+                        )
+
+                # Only update event sharing if the current value is different as the one we want to set
+                if should_authorize_event_sharing is not None:
+                    current_authorize_event_sharing = (
+                        self.get_app_properties(name, role)
+                        .get(AUTHORIZE_TELEMETRY_COL, "false")
+                        .lower()
+                        == "true"
+                    )
+                    if (
+                        current_authorize_event_sharing
+                        != should_authorize_event_sharing
+                    ):
+                        self._log.info(
+                            "Setting telemetry sharing authorization to %s",
+                            should_authorize_event_sharing,
+                        )
+                        self._sql_executor.execute_query(
+                            f"alter application {name} set AUTHORIZE_TELEMETRY_EVENT_SHARING = {str(should_authorize_event_sharing).upper()}"
+                        )
+            except ProgrammingError as err:
+                if err.errno in UPGRADE_RESTRICTION_CODES:
+                    raise UpgradeApplicationRestrictionError(err.msg) from err
+                elif err.errno == CANNOT_DISABLE_MANDATORY_TELEMETRY:
+                    get_cli_context().metrics.set_counter(
+                        CLICounterField.EVENT_SHARING_ERROR, 1
+                    )
+                    raise UserInputError(
+                        "Could not disable telemetry event sharing for the application because it contains mandatory events. Please set 'share_mandatory_events' to true in the application telemetry section of the project definition file."
+                    ) from err
+
+                raise UserInputError(
+                    f"Failed to upgrade application {name} with the following error message:\n"
+                    f"{err.msg}"
+                ) from err
+            except Exception as err:
+                handle_unclassified_error(err, f"Failed to upgrade application {name}.")
+            return upgrade_cursor.fetchall()
+
+    def create_application(
+        self,
+        name: str,
+        package_name: str,
+        package_role: str,
+        install_method: SameAccountInstallMethod,
+        stage_fqn: str,
+        role: str,
+        warehouse: str,
+        debug_mode: bool | None,
+        should_authorize_event_sharing: bool | None,
+    ) -> list[tuple[str]]:
+        """
+        Creates a new application object using an application package,
+        running the setup script of the application package
+        """
+
+        if package_role != role:
+            self._grant_privileges_for_create_application(
+                package_role=package_role,
+                package_name=package_name,
+                stage_fqn=stage_fqn,
+                app_role=role,
+            )
+
+        # by default, applications are created in debug mode when possible;
+        # this can be overridden in the project definition
+        debug_mode_clause = ""
+        if install_method.is_dev_mode:
+            initial_debug_mode = debug_mode if debug_mode is not None else True
+            debug_mode_clause = f"debug_mode = {initial_debug_mode}"
+
+        authorize_telemetry_clause = ""
+        if should_authorize_event_sharing is not None:
+            self._log.info(
+                "Setting AUTHORIZE_TELEMETRY_EVENT_SHARING to %s",
+                should_authorize_event_sharing,
+            )
+            authorize_telemetry_clause = f" AUTHORIZE_TELEMETRY_EVENT_SHARING = {str(should_authorize_event_sharing).upper()}"
+
+        using_clause = install_method.using_clause(stage_fqn)
+        with self._use_role_optional(role), self._use_warehouse_optional(warehouse):
+            try:
+                create_cursor = self._sql_executor.execute_query(
+                    dedent(
+                        f"""\
+                    create application {name}
+                        from application package {package_name} {using_clause} {debug_mode_clause}{authorize_telemetry_clause}
+                        comment = {SPECIAL_COMMENT}
+                    """
+                    ),
+                )
+            except ProgrammingError as err:
+                if err.errno == APPLICATION_REQUIRES_TELEMETRY_SHARING:
+                    get_cli_context().metrics.set_counter(
+                        CLICounterField.EVENT_SHARING_ERROR, 1
+                    )
+                    raise UserInputError(
+                        "The application package requires event sharing to be authorized. Please set 'share_mandatory_events' to true in the application telemetry section of the project definition file."
+                    ) from err
+
+                raise UserInputError(
+                    f"Failed to create application {name} with the following error message:\n"
+                    f"{err.msg}"
+                ) from err
+            except Exception as err:
+                handle_unclassified_error(err, f"Failed to create application {name}.")
+            return create_cursor.fetchall()
+
 
 # TODO move this to src/snowflake/cli/api/project/util.py in a separate
 # PR since it's codeowned by the CLI team

src/snowflake/cli/api/constants.py

@@ -62,6 +62,9 @@ class ObjectType(Enum):
         "image-repository", "image repository", "image repositories"
     )
     GIT_REPOSITORY = ObjectNames("git-repository", "git repository", "git repositories")
+    APPLICATION_PACKAGE = ObjectNames(
+        "application-package", "application package", "application packages"
+    )
 
     def __str__(self):
         """This makes using this Enum easier in formatted string"""