서비스 프린시펄 (SP) 권한 관리

-- [1회만 실행] 앱 전용 그룹 생성 + 카탈로그 권한 부여
CREATE GROUP IF NOT EXISTS `databricks-apps`;

GRANT USE CATALOG ON CATALOG my_catalog TO `databricks-apps`;
GRANT USE SCHEMA ON CATALOG my_catalog TO `databricks-apps`;
GRANT SELECT ON CATALOG my_catalog TO `databricks-apps`;

# [앱 생성 후] SP를 그룹에 추가 — 이것만 하면 UC 권한 완료
APP_NAME="my-dashboard-app"
SP_ID=$(databricks apps get $APP_NAME -o json | jq -r .service_principal_id)
GROUP_ID=$(databricks groups list --filter "displayName eq 'databricks-apps'" \
  -o json | jq -r '.Resources[0].id')

databricks api patch /api/2.0/preview/scim/v2/Groups/$GROUP_ID --json "{
  \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"],
  \"Operations\": [{
    \"op\": \"add\",
    \"path\": \"members\",
    \"value\": [{\"value\": \"$SP_ID\"}]
  }]
}"

#!/bin/bash
# grant-app-permissions.sh — 앱 생성 후 한 번 실행
# 사용법: ./grant-app-permissions.sh <앱이름> [카탈로그명]

APP_NAME=$1
CATALOG=${2:-"my_catalog"}

SP_CLIENT_ID=$(databricks apps get $APP_NAME -o json | jq -r .service_principal_client_id)
SP_ID=$(databricks apps get $APP_NAME -o json | jq -r .service_principal_id)
echo "=== $APP_NAME SP 권한 설정 (Client ID: $SP_CLIENT_ID) ==="

# 1. 엔타이틀먼트 부여 (workspace-access, databricks-sql-access)
databricks api patch /api/2.0/preview/scim/v2/ServicePrincipals/$SP_ID --json '{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{"op": "add", "value": {
    "entitlements": [
      {"value": "workspace-access"},
      {"value": "databricks-sql-access"}
    ]
  }}]
}'
echo "✓ 엔타이틀먼트 부여 완료"

# 2. SQL Warehouse CAN_USE 권한 (기본 웨어하우스에 부여)
WH_ID=$(databricks warehouses list -o json | jq -r '.[0].id')
TOKEN=$(databricks auth token | jq -r .access_token)
HOST=$(databricks auth env | jq -r .env.DATABRICKS_HOST)

curl -s -X PATCH "$HOST/api/2.0/permissions/warehouses/$WH_ID" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"access_control_list\": [{
    \"service_principal_name\": \"$SP_CLIENT_ID\",
    \"permission_level\": \"CAN_USE\"
  }]}" > /dev/null
echo "✓ SQL Warehouse CAN_USE 부여 완료"

# 3. UC 카탈로그 권한 출력 (노트북에서 실행)
echo ""
echo "아래 SQL을 노트북 또는 SQL Editor에서 실행하세요:"
echo "----------------------------------------"
echo "GRANT USE CATALOG ON CATALOG $CATALOG TO \`$SP_CLIENT_ID\`;"
echo "GRANT USE SCHEMA ON CATALOG $CATALOG TO \`$SP_CLIENT_ID\`;"
echo "GRANT SELECT ON CATALOG $CATALOG TO \`$SP_CLIENT_ID\`;"
echo "----------------------------------------"

# 실행
chmod +x grant-app-permissions.sh
./grant-app-permissions.sh my-dashboard-app my_catalog

resources:
  - name: sql_warehouse
    sql_warehouse:
      id: "abc123"
      permission: "CAN_USE"        # ← SP에 자동 부여
  - name: serving_endpoint
    serving_endpoint:
      name: "my-endpoint"
      permission: "CAN_QUERY"      # ← SP에 자동 부여