Snowflake test script: verify default secondary roles summary

test_verify_default_secondary_roles_summary.sql

USE ROLE USERADMIN;

-- Verification script for DEFAULT_SECONDARY_ROLES test runs.
-- Run this before and after test scripts to compare distribution changes.

-- ============================================================================
-- SECTION 1: SUMMARY COUNT BY DEFAULT_SECONDARY_ROLES BUCKET
-- Captures counts of users in ALL_ENABLED, EMPTY ([]), NULL, and OTHER buckets.
-- ============================================================================
SELECT 'SECTION 1: SUMMARY COUNT BY DSR BUCKET' AS report_section;

SHOW USERS
->> WITH users AS (
        SELECT
            "name" AS user_name,
            COALESCE("default_secondary_roles", 'NULL') AS dsr_value,
            COALESCE("type", 'NULL') AS user_type,
            COALESCE("disabled", 'FALSE') AS disabled_value
        FROM $1
        WHERE "name" <> 'SNOWFLAKE'
    )
    SELECT
        CASE
            WHEN UPPER(dsr_value) IN ('[\'ALL\']', '["ALL"]') THEN 'ALL_ENABLED'
            WHEN dsr_value = '[]' THEN 'EMPTY'
            WHEN UPPER(dsr_value) = 'NULL' THEN 'NULL'
            ELSE 'OTHER'
        END AS dsr_bucket,
        COUNT(*) AS user_count
    FROM users
    GROUP BY dsr_bucket
    ORDER BY dsr_bucket;

-- Detail query: list users with DEFAULT_SECONDARY_ROLES set to ALL.
-- ============================================================================
-- SECTION 2: USER LIST WHERE DEFAULT_SECONDARY_ROLES IS ALL
-- Captures the explicit set of users with ALL secondary roles enabled.
-- ============================================================================
SELECT 'SECTION 2: USERS WITH DSR = ALL' AS report_section;

SHOW USERS
->> WITH users AS (
        SELECT
            "name" AS user_name,
            COALESCE("default_secondary_roles", 'NULL') AS dsr_value,
            COALESCE("type", 'NULL') AS user_type,
            COALESCE("disabled", 'FALSE') AS disabled_value
        FROM $1
        WHERE "name" <> 'SNOWFLAKE'
    )
    SELECT
        user_name,
        user_type,
        disabled_value,
        dsr_value
    FROM users
    WHERE UPPER(dsr_value) IN ('[\'ALL\']', '["ALL"]')
    ORDER BY user_name;

-- Detail query: list users with DEFAULT_SECONDARY_ROLES set to [].
-- ============================================================================
-- SECTION 3: USER LIST WHERE DEFAULT_SECONDARY_ROLES IS []
-- Captures the explicit set of users with no default secondary roles.
-- ============================================================================
SELECT 'SECTION 3: USERS WITH DSR = []' AS report_section;

SHOW USERS
->> WITH users AS (
        SELECT
            "name" AS user_name,
            COALESCE("default_secondary_roles", 'NULL') AS dsr_value,
            COALESCE("type", 'NULL') AS user_type,
            COALESCE("disabled", 'FALSE') AS disabled_value
        FROM $1
        WHERE "name" <> 'SNOWFLAKE'
    )
    SELECT
        user_name,
        user_type,
        disabled_value,
        dsr_value
    FROM users
    WHERE dsr_value = '[]'
    ORDER BY user_name;

-- Optional detail query: list users whose setting is not ALL or EMPTY.
-- ============================================================================
-- SECTION 4: USER LIST WHERE DEFAULT_SECONDARY_ROLES IS NEITHER ALL NOR []
-- Captures potential anomalies and values requiring inspection.
-- ============================================================================
SELECT 'SECTION 4: USERS WITH DSR NOT IN (ALL, [])' AS report_section;

SHOW USERS
->> WITH users AS (
        SELECT
            "name" AS user_name,
            COALESCE("default_secondary_roles", 'NULL') AS dsr_value,
            COALESCE("type", 'NULL') AS user_type,
            COALESCE("disabled", 'FALSE') AS disabled_value
        FROM $1
        WHERE "name" <> 'SNOWFLAKE'
    )
    SELECT
        user_name,
        user_type,
        disabled_value,
        dsr_value
    FROM users
    WHERE UPPER(dsr_value) NOT IN ('[\'ALL\']', '["ALL"]')
      AND dsr_value != '[]'
    ORDER BY user_name;