Support for roles in grants

dbt/include/dremio/macros/adapters/apply_grants.sql

@@ -17,20 +17,20 @@ limitations under the License.*/
 {%- endmacro -%}
 
 {%- macro dremio__split_grantee(grantee) -%}
-    {%- set splitted = grantee.split(':') %}
-    {%- if splitted | length == 2 %}
-        {%- set type = splitted[0] %}
-        {%- if type in ['user', 'role'] %}
-            {%- set name = splitted[1] %}
-        {%- else %}
+    {%- set splitted = grantee.split(':') -%}
+
+    {%- if splitted | length < 2 -%}
+        {{ return(("user", grantee)) }}
+    {%- else -%}
+        {%- set prefix = splitted[0] -%}
+        {%- set remainder = splitted[1:] | join(':') -%}
+
+        {%- if prefix not in ['user', 'role'] -%}
             {% do exceptions.CompilationError("Invalid prefix. Use either user or role") %}
-        {%- endif %}
-    {%- else %}
-        {%- set type = 'user' %}
-        {%- set name = grantee %}
-    {%- endif %}
+        {%- endif -%}
 
-    {{ return((type, name)) }}
+        {{ return((prefix, remainder)) }}
+    {%- endif -%}
 {%- endmacro -%}
 
 {% macro dremio__get_show_grant_sql(relation) %}

tests/functional/adapter/grants/test_model_grants.py

@@ -111,6 +111,15 @@
         insert: ["role:{{ env_var('DBT_TEST_ROLE_2') }}", "user:{{ env_var('DBT_TEST_USER_3') }}"]
 """
 
+special_character_role_model_schema_yml = """
+version: 2
+models:
+  - name: my_model
+    config:
+      grants:
+        select: ["role:test:role"]
+"""
+
 @pytest.mark.skip(reason="Dremio only supports grants in EE/DC editions.")
 class TestViewGrantsDremio(BaseGrantsDremio, BaseModelGrants):
     def get_test_roles(self):
@@ -176,6 +185,14 @@ def test_view_table_grants(self, project, get_test_users):
         }
         self.assert_expected_grants_match_actual(project, "my_model", expected)
 
+        # special character (:) in role name
+        updated_yaml = self.interpolate_name_overrides(special_character_role_model_schema_yml)
+        write_file(updated_yaml, project.project_root, "models", "schema.yml")
+        (results, log_output) = run_dbt_and_capture(["--debug", "run"])
+        assert len(results) == 1
+        expected = {select_privilege_name: ["role:test:role"]}
+        self.assert_expected_grants_match_actual(project, "my_model", expected)
+
 
 @pytest.mark.skip(reason="Dremio only supports grants in EE/DC editions.")
 class TestTableGrantsDremio(BaseGrantsDremio, BaseModelGrants):