Snowflake

-- Edit the following variables
set push_username='PUSH_AI_USER';
set push_password='<a secure password>';
set push_first_name='Push.ai';
set push_last_name='User';
set push_default_warehouse='<warehouse>';
set push_database='<database>';
set push_default_namespace='<database.schema>';
set push_default_role='PUSH_AI_ROLE';
set push_comment='Used for Push.ai integrations';

-- Set role for grants
USE ROLE ACCOUNTADMIN;

-- Create a role for PUSH_AI
CREATE ROLE IF NOT EXISTS identifier($push_default_role)
COMMENT = $push_comment;

-- Create PUSH_AI's user
CREATE USER IF NOT EXISTS identifier($push_username)
PASSWORD=$push_password
FIRST_NAME=$push_first_name
LAST_NAME=$push_last_name
DEFAULT_WAREHOUSE=$push_default_warehouse
DEFAULT_NAMESPACE=$push_default_namespace
DEFAULT_ROLE=$push_default_role
COMMENT=$push_comment;


-- Grant permissions to the role
GRANT ROLE identifier($push_default_role) TO ROLE SYSADMIN;
GRANT USAGE ON WAREHOUSE identifier($push_default_warehouse) TO ROLE identifier($push_default_role);
GRANT ROLE identifier($push_default_role) TO USER identifier($push_username);

GRANT USAGE ON DATABASE identifier($push_database) TO ROLE identifier($push_default_role);
GRANT USAGE ON ALL SCHEMAS IN DATABASE identifier($push_database) TO ROLE identifier($push_default_role);
GRANT SELECT ON ALL TABLES IN DATABASE identifier($push_database) TO ROLE identifier($push_default_role);
GRANT SELECT ON FUTURE TABLES IN DATABASE identifier($push_database) TO ROLE identifier($push_default_role);
GRANT SELECT ON ALL VIEWS IN DATABASE identifier($push_database) TO ROLE identifier($push_default_role);
GRANT SELECT ON FUTURE VIEWS IN DATABASE identifier($push_database) TO ROLE identifier($push_default_role);

-- Grant write access for Push.ai specific schema (required for additional write-related features)
GRANT CREATE SCHEMA ON DATABASE identifier($push_database) TO ROLE identifier($push_default_role);