Task LAV-1738: ALTER DATABASE ROLE support (RENAME TO / SET COMMENT / UNSET COMMENT) (apache#2190)

* task LAV-1738: WIP — commit stranded agent work

* Task LAV-1738: fix SHOW GRANTS TO DATABASE ROLE parity for ALTER rename

- synthesize implicit USAGE-on-own-database edge and render grantee_name
  unqualified in __snowflake$show_grants_to_database_role
- emit queryContext:null for 003594 (cross-database rename rejection)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* task LAV-1738: fix CI — cover unqualified SHOW GRANTS TO DATABASE ROLE (patch coverage)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sabir-akhadov-localstack

src/ast/dcl.rs

@@ -249,6 +249,42 @@ impl fmt::Display for AlterRoleOperation {
     }
 }
 
+/// An `ALTER DATABASE ROLE` (`Statement::AlterDatabaseRole`) operation
+/// (Snowflake). The new name of a rename may itself be database-qualified,
+/// which is why this carries an `ObjectName` rather than reusing
+/// `AlterRoleOperation`.
+#[derive(Debug, Clone, PartialEq, PartialOrd, Eq, Ord, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "visitor", derive(Visit, VisitMut))]
+pub enum AlterDatabaseRoleOperation {
+    /// `RENAME TO <new_name>`
+    RenameTo {
+        /// The (optionally database-qualified) new role name.
+        new_name: ObjectName,
+    },
+    /// `SET COMMENT = '<text>'`
+    SetComment {
+        /// The comment text.
+        comment: String,
+    },
+    /// `UNSET COMMENT`
+    UnsetComment,
+}
+
+impl fmt::Display for AlterDatabaseRoleOperation {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            AlterDatabaseRoleOperation::RenameTo { new_name } => {
+                write!(f, "RENAME TO {new_name}")
+            }
+            AlterDatabaseRoleOperation::SetComment { comment } => {
+                write!(f, "SET COMMENT = '{}'", comment.replace('\'', "''"))
+            }
+            AlterDatabaseRoleOperation::UnsetComment => write!(f, "UNSET COMMENT"),
+        }
+    }
+}
+
 /// A `USE` (`Statement::Use`) operation
 #[derive(Debug, Clone, PartialEq, PartialOrd, Eq, Ord, Hash)]
 #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]

src/ast/mod.rs

@@ -58,8 +58,8 @@ pub use self::data_type::{
     ExactNumberInfo, IntervalFields, StructBracketKind, TimezoneInfo,
 };
 pub use self::dcl::{
-    AlterRoleOperation, CreateRole, Grant, ResetConfig, Revoke, RoleOption, SecondaryRoles,
-    SetConfigValue, Use,
+    AlterDatabaseRoleOperation, AlterRoleOperation, CreateRole, Grant, ResetConfig, Revoke,
+    RoleOption, SecondaryRoles, SetConfigValue, Use,
 };
 pub use self::ddl::{
     Alignment, AlterCollation, AlterCollationOperation, AlterColumnOperation, AlterConnectorOwner,
@@ -4210,6 +4210,20 @@ pub enum Statement {
         operation: AlterRoleOperation,
     },
     /// ```sql
+    /// ALTER DATABASE ROLE [IF EXISTS] <name>
+    ///     { RENAME TO <new_name> | SET COMMENT = '...' | UNSET COMMENT }
+    /// ```
+    /// Snowflake database role (scoped to a database, distinct from an
+    /// account-level role).
+    AlterDatabaseRole {
+        /// `true` when `IF EXISTS` was specified.
+        if_exists: bool,
+        /// The (optionally database-qualified) role name being altered.
+        name: ObjectName,
+        /// Operation to perform on the database role.
+        operation: AlterDatabaseRoleOperation,
+    },
+    /// ```sql
     /// ALTER POLICY <NAME> ON <TABLE NAME> [<OPERATION>]
     /// ```
     /// (Postgresql-specific)
@@ -7197,6 +7211,17 @@ impl fmt::Display for Statement {
             Statement::AlterRole { name, operation } => {
                 write!(f, "ALTER ROLE {name} {operation}")
             }
+            Statement::AlterDatabaseRole {
+                if_exists,
+                name,
+                operation,
+            } => {
+                write!(
+                    f,
+                    "ALTER DATABASE ROLE {if_exists}{name} {operation}",
+                    if_exists = if *if_exists { "IF EXISTS " } else { "" },
+                )
+            }
             Statement::AlterPolicy(alter_policy) => write!(f, "{alter_policy}"),
             Statement::AlterConnector {
                 name,

src/ast/spans.rs

@@ -435,6 +435,7 @@ impl Spanned for Statement {
             Statement::AlterOperatorFamily { .. } => Span::empty(),
             Statement::AlterOperatorClass { .. } => Span::empty(),
             Statement::AlterRole { .. } => Span::empty(),
+            Statement::AlterDatabaseRole { .. } => Span::empty(),
             Statement::AlterSession { .. } => Span::empty(),
             Statement::AttachDatabase { .. } => Span::empty(),
             Statement::AttachDuckDBDatabase { .. } => Span::empty(),

src/dialect/snowflake.rs

@@ -28,7 +28,8 @@ use crate::ast::helpers::stmt_data_loading::{
 };
 use crate::ast::{
     AlterExternalVolumeOperation, AlterFileFormatOperation, AlterMaskingPolicyOperation,
-    AlterNetworkRuleOperation, AlterRoleOperation, AlterSnowflakeSecretOperation,
+    AlterDatabaseRoleOperation, AlterNetworkRuleOperation, AlterRoleOperation,
+    AlterSnowflakeSecretOperation,
     AlterProcedure, AlterProcedureOperation, AlterStageOperation, AlterTable, AlterTableOperation,
     AlterTableType, AlterTagOperation, CatalogRestAuthentication, CatalogRestConfig, CatalogSource,
     CatalogSyncNamespaceMode, CatalogTableFormat, ColumnOption, ColumnPolicy, ColumnPolicyProperty,
@@ -372,6 +373,16 @@ impl Dialect for SnowflakeDialect {
             return Some(parse_alter_tag(parser));
         }
 
+        // ALTER DATABASE ROLE [IF EXISTS] <name> { RENAME TO <new> |
+        // SET COMMENT = '…' | UNSET COMMENT } — must win before the ALTER
+        // DATABASE tag form below, which unconditionally consumes ALTER DATABASE.
+        if let Ok(Some(stmt)) = parser.maybe_parse(|p| {
+            p.expect_keywords(&[Keyword::ALTER, Keyword::DATABASE, Keyword::ROLE])?;
+            parse_alter_database_role(p)
+        }) {
+            return Some(Ok(stmt));
+        }
+
         if parser.parse_keywords(&[Keyword::ALTER, Keyword::DATABASE]) {
             // ALTER DATABASE <name> { SET TAG | UNSET TAG }
             return Some(parse_alter_object_set_tags(parser, ObjectType::Database));
@@ -3838,6 +3849,38 @@ fn parse_alter_role(parser: &mut Parser) -> Result<Statement, ParserError> {
     Ok(Statement::AlterRole { name, operation })
 }
 
+/// Parse the Snowflake `ALTER DATABASE ROLE [IF EXISTS] <name>` forms:
+/// `RENAME TO <new_name>`, `SET COMMENT = '<text>'`, `UNSET COMMENT`. Both the
+/// altered name and a rename target may be database-qualified. The leading
+/// `ALTER DATABASE ROLE` keywords are consumed by the caller. Any other trailing
+/// shape returns an error so the enclosing `maybe_parse` backtracks.
+fn parse_alter_database_role(parser: &mut Parser) -> Result<Statement, ParserError> {
+    let if_exists = parser.parse_keywords(&[Keyword::IF, Keyword::EXISTS]);
+    let name = parser.parse_object_name(false)?;
+
+    let operation = if parser.parse_keyword(Keyword::RENAME) {
+        parser.expect_keyword_is(Keyword::TO)?;
+        let new_name = parser.parse_object_name(false)?;
+        AlterDatabaseRoleOperation::RenameTo { new_name }
+    } else if parser.parse_keyword(Keyword::SET) {
+        parser.expect_keyword_is(Keyword::COMMENT)?;
+        parser.expect_token(&Token::Eq)?;
+        let comment = parser.parse_literal_string()?;
+        AlterDatabaseRoleOperation::SetComment { comment }
+    } else if parser.parse_keyword(Keyword::UNSET) {
+        parser.expect_keyword_is(Keyword::COMMENT)?;
+        AlterDatabaseRoleOperation::UnsetComment
+    } else {
+        return parser.expected("RENAME, SET COMMENT, or UNSET COMMENT", parser.peek_token());
+    };
+
+    Ok(Statement::AlterDatabaseRole {
+        if_exists,
+        name,
+        operation,
+    })
+}
+
 /// Parse `SHOW [TERSE] TAGS [ ... ]`
 fn parse_show_tags(terse: bool, parser: &mut Parser) -> Result<Statement, ParserError> {
     let show_options = parser.parse_show_stmt_options()?;

tests/sqlparser_snowflake.rs

@@ -9844,6 +9844,99 @@ fn parse_sf_alter_role_if_exists_is_accepted() {
     );
 }
 
+#[test]
+fn parse_sf_alter_database_role_forms() {
+    // RENAME TO / SET COMMENT / UNSET COMMENT round-trip through Display, with
+    // both the altered name and the rename target optionally database-qualified.
+    match snowflake().verified_stmt("ALTER DATABASE ROLE db.r RENAME TO db.r2") {
+        Statement::AlterDatabaseRole {
+            if_exists,
+            name,
+            operation,
+        } => {
+            assert!(!if_exists);
+            assert_eq!(name, ObjectName::from(vec![Ident::new("db"), Ident::new("r")]));
+            assert_eq!(
+                operation,
+                AlterDatabaseRoleOperation::RenameTo {
+                    new_name: ObjectName::from(vec![Ident::new("db"), Ident::new("r2")])
+                }
+            );
+        }
+        _ => unreachable!(),
+    }
+
+    match snowflake().verified_stmt("ALTER DATABASE ROLE r RENAME TO r2") {
+        Statement::AlterDatabaseRole { name, operation, .. } => {
+            assert_eq!(name, ObjectName::from(vec![Ident::new("r")]));
+            assert_eq!(
+                operation,
+                AlterDatabaseRoleOperation::RenameTo {
+                    new_name: ObjectName::from(vec![Ident::new("r2")])
+                }
+            );
+        }
+        _ => unreachable!(),
+    }
+
+    match snowflake().verified_stmt("ALTER DATABASE ROLE db.r SET COMMENT = 'hello'") {
+        Statement::AlterDatabaseRole { operation, .. } => {
+            assert_eq!(
+                operation,
+                AlterDatabaseRoleOperation::SetComment {
+                    comment: "hello".to_string()
+                }
+            );
+        }
+        _ => unreachable!(),
+    }
+
+    match snowflake().verified_stmt("ALTER DATABASE ROLE db.r UNSET COMMENT") {
+        Statement::AlterDatabaseRole { operation, .. } => {
+            assert_eq!(operation, AlterDatabaseRoleOperation::UnsetComment);
+        }
+        _ => unreachable!(),
+    }
+}
+
+#[test]
+fn parse_sf_alter_database_role_if_exists() {
+    // `IF EXISTS` is carried on the AST node and round-trips through Display.
+    match snowflake().verified_stmt("ALTER DATABASE ROLE IF EXISTS db.r RENAME TO db.r2") {
+        Statement::AlterDatabaseRole {
+            if_exists,
+            operation,
+            ..
+        } => {
+            assert!(if_exists);
+            assert_eq!(
+                operation,
+                AlterDatabaseRoleOperation::RenameTo {
+                    new_name: ObjectName::from(vec![Ident::new("db"), Ident::new("r2")])
+                }
+            );
+        }
+        _ => unreachable!(),
+    }
+}
+
+#[test]
+fn parse_sf_alter_database_role_set_tag_still_intercepted() {
+    // The ALTER DATABASE ROLE interceptor only claims RENAME/COMMENT; the tag
+    // form falls through to the ALTER DATABASE tag interceptor unaffected.
+    match snowflake().verified_stmt("ALTER DATABASE db SET TAG t1='v1'") {
+        Statement::SetTags {
+            object_type,
+            unset,
+            ..
+        } => {
+            assert_eq!(object_type, ObjectType::Database);
+            assert!(!unset);
+        }
+        _ => unreachable!(),
+    }
+}
+
 #[test]
 fn parse_sf_alter_role_set_tag_still_intercepted() {
     // The tag interceptor still wins for the SET/UNSET TAG forms — they become