# Snowflake Permissions Setup

## READ SESSION Permission for CURRENT_USER() Tracking

To enable user tracking (populating `CREATED_BY` field) in the Streamlit application, the `CURRENT_USER()` function must be accessible. By default, Snowflake Streamlit in Snowflake intentionally obfuscates context functions for security reasons.

### Problem

Without the `READ SESSION` privilege, the `CURRENT_USER()` function returns `NULL` in Streamlit in Snowflake apps, preventing proper user tracking.

### Solution

Grant the `READ SESSION` privilege to the role that owns the Streamlit application.

### Required SQL Command

Execute the following command as `ACCOUNTADMIN`:

```sql
USE ROLE ACCOUNTADMIN;
GRANT READ SESSION ON ACCOUNT TO ROLE FANSIFTER_ENGINEERING;
```

### Verification

After granting the privilege, test the application by adding a new artist to any roster table. The `CREATED_BY` field should now contain the username of the user who created the record.

### References

- [Snowflake Documentation: Additional Streamlit Features](https://docs.snowflake.com/en/developer-guide/streamlit/additional-features)
- [Snowflake Community: CURRENT_USER() returns None in Streamlit in Snowflake](https://community.snowflake.com/s/question/0D5Do000014ihc2KAA/currentuser-returns-none-in-streamlit-in-snowflake)

### Security Considerations

The `READ SESSION` privilege allows Streamlit apps to access session context functions including:
- `CURRENT_USER()`
- `CURRENT_ROLE()`
- `CURRENT_WAREHOUSE()`
- Other session context information

This is necessary for audit trails and user tracking but should be granted only to trusted roles that create Streamlit applications.

### Current Status

**Status**: ⏳ Pending - Permission not yet granted

Once the permission is granted, the code in `common/db.py` (`get_current_user()` function) will automatically start populating the `CREATED_BY` field with actual usernames.

### Rollback

If needed, the privilege can be revoked:

```sql
USE ROLE ACCOUNTADMIN;
REVOKE READ SESSION ON ACCOUNT FROM ROLE FANSIFTER_ENGINEERING;
```