-ammend

Author: rgopalrao-sonata-png

enterprise_data/api/v1/views/lpr_data_source_snowflake.py

@@ -16,17 +16,18 @@
 Required Django settings
 ------------------------
   SNOWFLAKE_SERVICE_USER
-  SNOWFLAKE_SERVICE_PRIVKEY    PEM-encoded private key string (set in Django settings / config)
+  SNOWFLAKE_SERVICE_PRIVKEY    PEM-encoded private key string
   SNOWFLAKE_SERVICE_PASSPHRASE Passphrase to decrypt the private key
 
 Optional Django settings (with defaults)
 -----------------------------------------
   SNOWFLAKE_ACCOUNT                          = 'edx.us-east-1'
+  SNOWFLAKE_ROLE                             = 'ENTERPRISE_SERVICE_USER_ROLE'
   LPR_SNOWFLAKE_WAREHOUSE                    = None
   LPR_SNOWFLAKE_ROLE                         = None
   LPR_SNOWFLAKE_DATABASE                     = 'PROD'
   LPR_SNOWFLAKE_SCHEMA                       = 'ENTERPRISE'
-  LPR_SNOWFLAKE_INTERNAL_TABLE               = 'LEARNER_PROGRESS_REPORT_EXTERNAL'
+  LPR_SNOWFLAKE_INTERNAL_TABLE               = 'LEARNER_PROGRESS_REPORT_INTERNAL'
   LPR_COURSE_PROGRESS_CACHE_TIMEOUT          = 300    (5 min)
   LPR_SNOWFLAKE_LMS_DATABASE                 = 'PROD'
   LPR_SNOWFLAKE_LMS_SCHEMA                   = 'LMS'
@@ -37,11 +38,11 @@
 
 import logging
 from contextlib import contextmanager
+from types import SimpleNamespace
 
 from django.conf import settings
 
 from enterprise_data import cache
-from enterprise_data.clients.snowflake import get_snowflake_connection as _get_snowflake_connection
 
 LOGGER = logging.getLogger(__name__)
 
@@ -52,6 +53,93 @@
 # Batch size for Snowflake queries to avoid unbounded SQL and parameter limits.
 SNOWFLAKE_QUERY_BATCH_SIZE = 500
 
+try:
+    import snowflake.connector as _snowflake_connector
+except ImportError:  # pragma: no cover - depends on runtime extras
+    _snowflake_connector = None
+    LOGGER.warning(
+        '[course_progress] snowflake-connector-python is not installed. '
+        'course_progress will be null. Add snowflake-connector-python to requirements/base.in.'
+    )
+
+_snowflake = SimpleNamespace(connector=_snowflake_connector)
+
+try:
+    from cryptography.hazmat.backends import default_backend as _default_backend
+    from cryptography.hazmat.primitives import serialization as _serialization
+except ImportError:  # pragma: no cover - optional dependency
+    _default_backend = None  # type: ignore[assignment]
+    _serialization = None  # type: ignore[assignment]
+
+
+# ---------------------------------------------------------------------------
+# Module-level connection factory (private-key authentication)
+# ---------------------------------------------------------------------------
+
+def _get_snowflake_connection(warehouse=None, role=None):
+    """
+    Open and return a Snowflake connection using private-key authentication.
+
+    Credentials are read from Django settings.  The returned
+    ``SnowflakeConnection`` supports the context-manager protocol::
+
+        with _get_snowflake_connection(warehouse='MY_WH') as conn:
+            with conn.cursor() as cur:
+                cur.execute(...)
+
+    Args:
+        warehouse (str | None): Snowflake virtual warehouse to activate.
+        role (str | None): Snowflake role to assume.  Defaults to
+            ``settings.SNOWFLAKE_ROLE`` (fallback: ``'ENTERPRISE_SERVICE_USER_ROLE'``),
+            then overridden by the LPR-specific ``LPR_SNOWFLAKE_ROLE`` setting
+            when passed from ``_snowflake_cursor``.
+
+    Raises:
+        ImportError: When snowflake-connector-python is not installed.
+        ValueError: When required credential settings are absent.
+    """
+    if _snowflake.connector is None:
+        raise ImportError(
+            'snowflake-connector-python is required for Snowflake LPR access'
+        )
+
+    user = getattr(settings, 'SNOWFLAKE_SERVICE_USER', None)
+    key_pem = getattr(settings, 'SNOWFLAKE_SERVICE_PRIVKEY', None)
+    passphrase = getattr(settings, 'SNOWFLAKE_SERVICE_PASSPHRASE', None)
+    account = getattr(settings, 'SNOWFLAKE_ACCOUNT', 'edx.us-east-1')
+    default_role = getattr(settings, 'SNOWFLAKE_ROLE', 'ENTERPRISE_SERVICE_USER_ROLE')
+
+    if not user:
+        LOGGER.error('Snowflake credentials missing — SNOWFLAKE_SERVICE_USER is not set.')
+        raise ValueError('SNOWFLAKE_SERVICE_USER must be configured')
+    if not key_pem:
+        LOGGER.error('Snowflake credentials missing — SNOWFLAKE_SERVICE_PRIVKEY is not set.')
+        raise ValueError('SNOWFLAKE_SERVICE_PRIVKEY must be configured')
+    if not passphrase:
+        raise ValueError('SNOWFLAKE_SERVICE_PASSPHRASE must be configured')
+
+    key_data = key_pem.encode() if isinstance(key_pem, str) else key_pem
+    private_key = _serialization.load_pem_private_key(
+        key_data,
+        password=passphrase.encode() if isinstance(passphrase, str) else passphrase,
+        backend=_default_backend(),
+    )
+    private_key_bytes = private_key.private_bytes(
+        encoding=_serialization.Encoding.DER,
+        format=_serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=_serialization.NoEncryption(),
+    )
+
+    connect_kwargs = {
+        'user': user,
+        'account': account,
+        'private_key': private_key_bytes,
+        'role': role or default_role,
+    }
+    if warehouse:
+        connect_kwargs['warehouse'] = warehouse
+    return _snowflake.connector.connect(**connect_kwargs)
+
 
 # ---------------------------------------------------------------------------
 # Base class
@@ -74,8 +162,8 @@ def _get_setting(name, default=None):
     def _snowflake_cursor(self):
         """Yield a Snowflake cursor, managing the connection lifecycle.
 
-        Uses ``_get_snowflake_connection()`` (module-level alias for the shared
-        factory) so that the connection factory can be independently mocked in tests.
+        Uses ``_get_snowflake_connection()`` (module-level) so that the
+        connection factory can be independently mocked in tests.
         """
         warehouse = self._get_setting('LPR_SNOWFLAKE_WAREHOUSE', None)
         role = self._get_setting('LPR_SNOWFLAKE_ROLE', None)
@@ -413,14 +501,6 @@ def get_passing_grade_map(self, courserun_keys):
         differs from ``SnowflakeCourseProgressSource.get_course_progress_map``,
         which **omits** absent keys from the result entirely.
 
-        Security note: the cache key for passing grades is **not** enterprise-
-        scoped because ``LOWEST_PASSING_GRADE`` is a course-level attribute
-        identical across all enterprises.  Callers **must** only supply
-        courserun keys that were obtained from the requesting enterprise's
-        filtered enrollment queryset; passing attacker-influenced keys that
-        do not belong to the enterprise is not supported and would return
-        that course's threshold from cache or Snowflake.
-
         Args:
             courserun_keys (list[str]): Courserun keys to look up.