Task LAV-1788: CREATE/ALTER ROLE ... COMMENT round-trips through SHOW ROLES (apache#2265)

* Task LAV-1788: CREATE/ALTER ROLE COMMENT round-trips through SHOW ROLES

Parse Snowflake CREATE ROLE ... COMMENT = '...', thread the comment
through the create_role UDF, and add the is_from_organization_user_group
column (11th) to SHOW ROLES plus a SHOW TERSE ROLES projection.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Task LAV-1788: assert full 11-column SHOW ROLES in create-role-comment test

The new test stripped is_from_organization_user_group with a stale
'emulator omits' comment, papering over the very column this task adds
(the emulator does emit it — see test_show_roles). Drop the strip and
assert the column (constant 'N') across the round-trip instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Task LAV-1788: waive test_rbac re-record; verified is_inherited drift

* Task LAV-1788: assert 11-column SHOW ROLES in rename/unset/limit tests

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Task LAV-1788: respect INITIALIZE=ON_SCHEDULE in dynamic-table scheduler

The refresh scheduler treated any never-refreshed ACTIVE dynamic table as
immediately due, refreshing ON_SCHEDULE tables on the next poll tick despite
their create-time contract (created empty until the first scheduled refresh).
test_dynamic_tables_never_refreshed raced this poll and flaked under parallel
load. Anchor a never-refreshed ON_SCHEDULE table's first due time at
created_at + TARGET_LAG; other never-refreshed tables stay due immediately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sabir-akhadov-localstack

src/ast/dcl.rs

@@ -399,6 +399,8 @@ pub struct CreateRole {
     // Snowflake
     /// Trailing `WITH TAG (<t> = '<v>' [, ...])` clause; empty when absent.
     pub with_tags: Vec<Tag>,
+    /// Snowflake `COMMENT = '<string>'` clause; `None` when absent.
+    pub comment: Option<String>,
 }
 
 impl fmt::Display for CreateRole {
@@ -474,6 +476,9 @@ impl fmt::Display for CreateRole {
         if let Some(owner) = &self.authorization_owner {
             write!(f, " AUTHORIZATION {owner}")?;
         }
+        if let Some(comment) = &self.comment {
+            write!(f, " COMMENT = '{comment}'")?;
+        }
         if !self.with_tags.is_empty() {
             write!(
                 f,

src/parser/mod.rs

@@ -7395,17 +7395,28 @@ impl<'a> Parser<'a> {
         let if_not_exists = self.parse_keywords(&[Keyword::IF, Keyword::NOT, Keyword::EXISTS]);
         let names = self.parse_comma_separated(|p| p.parse_object_name(false))?;
 
-        // Snowflake: trailing `WITH TAG ( <t> = '<v>' [, ...] )`. It is
-        // trailing-only, so no other role option may follow. `WITH TAG` is
-        // consumed atomically here; a bare `WITH` (or `WITH <other>`) is left
-        // for the generic option loop below.
+        // Snowflake: trailing `COMMENT = '<string>'` and `WITH TAG ( <t> = '<v>'
+        // [, ...] )`. Both are trailing-only and may appear in either order, so
+        // no other role option may follow. `WITH TAG` is consumed atomically
+        // here; a bare `WITH` (or `WITH <other>`) is left for the generic option
+        // loop below.
         let mut with_tags = Vec::new();
-        if dialect_of!(self is SnowflakeDialect)
-            && self.parse_keywords(&[Keyword::WITH, Keyword::TAG])
-        {
-            self.expect_token(&Token::LParen)?;
-            with_tags = self.parse_comma_separated(Parser::parse_tag)?;
-            self.expect_token(&Token::RParen)?;
+        let mut comment = None;
+        if dialect_of!(self is SnowflakeDialect) {
+            loop {
+                if comment.is_none() && self.parse_keyword(Keyword::COMMENT) {
+                    self.expect_token(&Token::Eq)?;
+                    comment = Some(self.parse_literal_string()?);
+                } else if with_tags.is_empty()
+                    && self.parse_keywords(&[Keyword::WITH, Keyword::TAG])
+                {
+                    self.expect_token(&Token::LParen)?;
+                    with_tags = self.parse_comma_separated(Parser::parse_tag)?;
+                    self.expect_token(&Token::RParen)?;
+                } else {
+                    break;
+                }
+            }
         }
 
         let _ = self.parse_keyword(Keyword::WITH); // [ WITH ]
@@ -7627,6 +7638,7 @@ impl<'a> Parser<'a> {
             admin,
             authorization_owner,
             with_tags,
+            comment,
         })
     }
 

tests/sqlparser_snowflake.rs

@@ -5156,6 +5156,35 @@ fn test_create_database_role() {
     snowflake().verified_stmt("DROP DATABASE ROLE IF EXISTS db1.\"role123\"");
 }
 
+#[test]
+fn test_create_role_with_comment() {
+    // Account-role CREATE with the Snowflake `COMMENT = '<string>'` clause.
+    match snowflake().verified_stmt("CREATE ROLE r1 COMMENT = 'hello'") {
+        Statement::CreateRole(create_role) => {
+            assert_eq!(create_role.comment.as_deref(), Some("hello"));
+            assert!(!create_role.if_not_exists);
+        }
+        stmt => panic!("Unexpected statement: {stmt:?}"),
+    }
+
+    match snowflake().verified_stmt("CREATE ROLE IF NOT EXISTS r1 COMMENT = 'hello'") {
+        Statement::CreateRole(create_role) => {
+            assert_eq!(create_role.comment.as_deref(), Some("hello"));
+            assert!(create_role.if_not_exists);
+        }
+        stmt => panic!("Unexpected statement: {stmt:?}"),
+    }
+
+    // COMMENT and WITH TAG coexist and render in a stable order.
+    snowflake().verified_stmt("CREATE ROLE r1 COMMENT = 'hello' WITH TAG (env='prod')");
+
+    // Absent clause leaves `comment` unset.
+    match snowflake().verified_stmt("CREATE ROLE r1") {
+        Statement::CreateRole(create_role) => assert_eq!(create_role.comment, None),
+        stmt => panic!("Unexpected statement: {stmt:?}"),
+    }
+}
+
 #[test]
 fn test_alter_session() {
     assert_eq!(