SNOW-2361367: Notebook Deploy is unable to deploy without CREATE STAGE permission

[paulmech]

SnowCLI version

3.13.0.dev0

Python version

Python 3.10.16

Platform

Linux-6.14.0-29-generic-x86_64-with-glibc2.39

What happened

Issue Experienced
When attempting to deploy a notebook , it will always run CREATE STAGE IF NOT EXISTS stagename even if the stage already exists. This causes notebook deploy to fail, even if the role has privileges to use the specified stage.

Expected Behaviour
I would expect the entity to explicitly check if the stage exists, first, before attempting CREATE STAGE IF NOT EXISTS, which will fail even if the stage exists, if the user does not have the privilege

In a way, running CREATE STAGE IF NOT EXISTS is convenient - if it does not fail, the deployer is guaranteed to be able to write the stage, as they will have ownership on it. But I believe it should be allowed to use an existing stage that the deployer has privilege to use already, and any missing write privileges should be raised up naturally

Workaround

I have to GRANT CREATE STAGE ON SCHEMA... to the deploy role. I would prefer to not do this.

Notes

As this is stemming from src/snowflake/cli/api/entities/utils.py : sync_deploy_root_with_stage() method, this is probably affecting streamlit deploys as well.

In that method, there's a conditional:

    if stage_path_parts.is_vstage:
        # vstages are created by FBE, so no need to do it manually
        pass
    elif not package_name:
        # default entity stage creation behaviour
        (code)
    else:
        # fall through behaviour to cater for native apps with sql_facade
        (code)

I wonder if it might be better restructuring that to

    if stage_path_parts.is_vstage:
        # vstages are created by FBE, so no need to do it manually
        pass
    elif package_name:
        #  cater for native apps with sql_facade
        (code)
    else:
        # default entity stage creation behaviour
        (code)

and let the default entity behaviour incorporate a check to see if the stage already exists (perhaps similar to how it is done in sql_facade)

Console output

How to reproduce

No response