Task LAV-2305: Policy attachment: ALTER ACCOUNT/USER SET/UNSET policy, the connector table, the drop guard and POLICY_REFERENCES (#2750)

* Task LAV-2305: Policy attachment via one connector table

Attach PASSWORD/SESSION/AUTHENTICATION policies to USER and ACCOUNT
entities through the `policy_attachments` connector table (ADR 093),
visible via POLICY_REFERENCES from both argument forms and undroppable
while attached.

- `policy_attachments` connector table + partial unique index enforcing
  one policy of a kind per entity; duplicate attach → verbatim 003549.
- `__snowflake$attach_policy` / `detach_policy` / `policy_attachment_guard`
  and the account-scoped attach/detach UDFs; DROP and CREATE OR REPLACE of
  an attached policy → verbatim 003531.
- ALTER USER / ALTER ACCOUNT SET/UNSET <kind> POLICY grammar + rewriter;
  the `<kind>_POLICY = <p>` property spelling is rejected (001420).
- Entity- and policy-side cascades: user rename/drop update or remove
  rows; policy rename cascades to live attachments.
- POLICY_REFERENCES gains a connector branch per argument form; the account
  entity is named by CURRENT_ACCOUNT(); a by-entity USER lookup on a missing
  user raises 002003 unpositioned.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Task LAV-2305: pin combined SET policy+property rejection (001003)

Real Snowflake rejects a policy leg combined with an object property in a
single ALTER USER SET list; SET <kind> POLICY is its own statement form.
Add a snapshot-pinned rejection test; no combined form is accepted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Apply cargo fmt

---------

Co-authored-by: Wojciech Padło <wojciech.padlo@localstack.cloud>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: 4 people

src/ast/mod.rs

@@ -15094,11 +15094,30 @@ pub enum AlterAccountOperation {
         /// New account name.
         new_name: Ident,
     },
+    /// `SET { AUTHENTICATION | PASSWORD | SESSION } POLICY <policy_name>`
+    SetPolicy {
+        /// The kind of policy being attached to the account.
+        policy_kind: UserPolicyKind,
+        /// The identifier of the policy to attach.
+        policy: Ident,
+    },
+    /// `UNSET { AUTHENTICATION | PASSWORD | SESSION } POLICY`
+    UnsetPolicy {
+        /// The kind of policy being detached from the account.
+        policy_kind: UserPolicyKind,
+    },
 }
 
 impl fmt::Display for AlterAccountOperation {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
+            AlterAccountOperation::SetPolicy {
+                policy_kind,
+                policy,
+            } => write!(f, "SET {policy_kind} POLICY {policy}"),
+            AlterAccountOperation::UnsetPolicy { policy_kind } => {
+                write!(f, "UNSET {policy_kind} POLICY")
+            }
             AlterAccountOperation::Set { params } => {
                 write!(f, "SET ")?;
                 for (i, p) in params.iter().enumerate() {

src/parser/mod.rs

@@ -12399,6 +12399,14 @@ impl<'a> Parser<'a> {
         let operation = if self.parse_keywords(&[Keyword::RENAME, Keyword::TO]) {
             let new_name = self.parse_identifier()?;
             AlterAccountOperation::RenameTo { new_name }
+        } else if let Some(policy_kind) = self.maybe_parse_policy_kind_clause(Keyword::SET) {
+            let policy = self.parse_identifier()?;
+            AlterAccountOperation::SetPolicy {
+                policy_kind,
+                policy,
+            }
+        } else if let Some(policy_kind) = self.maybe_parse_policy_kind_clause(Keyword::UNSET) {
+            AlterAccountOperation::UnsetPolicy { policy_kind }
         } else if self.parse_keyword(Keyword::SET) {
             let params = self.parse_comma_separated(|p| {
                 let name = p.parse_identifier()?;
@@ -12421,6 +12429,22 @@ impl<'a> Parser<'a> {
         Ok(Statement::AlterAccount { name, operation })
     }
 
+    /// Try to parse a `<lead> { AUTHENTICATION | PASSWORD | SESSION } POLICY`
+    /// clause (where `<lead>` is `SET` or `UNSET`), returning the policy kind and
+    /// consuming the three keywords. Uses `parse_keywords` (all-or-nothing) so a
+    /// non-match — e.g. `SET <param> = …` — leaves the token stream untouched.
+    fn maybe_parse_policy_kind_clause(&mut self, lead: Keyword) -> Option<UserPolicyKind> {
+        if self.parse_keywords(&[lead, Keyword::AUTHENTICATION, Keyword::POLICY]) {
+            Some(UserPolicyKind::Authentication)
+        } else if self.parse_keywords(&[lead, Keyword::PASSWORD, Keyword::POLICY]) {
+            Some(UserPolicyKind::Password)
+        } else if self.parse_keywords(&[lead, Keyword::SESSION, Keyword::POLICY]) {
+            Some(UserPolicyKind::Session)
+        } else {
+            None
+        }
+    }
+
     /// Parse `ALTER TASK [IF EXISTS] <name> { RESUME | SUSPEND | { ADD | REMOVE } AFTER ... }`.
     pub fn parse_alter_task(&mut self) -> Result<Statement, ParserError> {
         let if_exists = self.parse_keywords(&[Keyword::IF, Keyword::EXISTS]);

tests/sqlparser_snowflake.rs

@@ -7915,6 +7915,42 @@ fn test_alter_account_rename_to() {
     }
 }
 
+#[test]
+fn test_alter_account_set_unset_policy() {
+    let sql = "ALTER ACCOUNT SET AUTHENTICATION POLICY p1";
+    match snowflake().verified_stmt(sql) {
+        Statement::AlterAccount { name, operation } => {
+            assert!(name.is_none());
+            match operation {
+                AlterAccountOperation::SetPolicy {
+                    policy_kind,
+                    policy,
+                } => {
+                    assert_eq!(policy_kind, UserPolicyKind::Authentication);
+                    assert_eq!("p1", policy.to_string());
+                }
+                _ => unreachable!(),
+            }
+        }
+        _ => unreachable!(),
+    }
+    snowflake().verified_stmt("ALTER ACCOUNT SET PASSWORD POLICY p1");
+    snowflake().verified_stmt("ALTER ACCOUNT SET SESSION POLICY p1");
+
+    let sql = "ALTER ACCOUNT UNSET SESSION POLICY";
+    match snowflake().verified_stmt(sql) {
+        Statement::AlterAccount { operation, .. } => match operation {
+            AlterAccountOperation::UnsetPolicy { policy_kind } => {
+                assert_eq!(policy_kind, UserPolicyKind::Session);
+            }
+            _ => unreachable!(),
+        },
+        _ => unreachable!(),
+    }
+    snowflake().verified_stmt("ALTER ACCOUNT UNSET PASSWORD POLICY");
+    snowflake().verified_stmt("ALTER ACCOUNT UNSET AUTHENTICATION POLICY");
+}
+
 #[test]
 fn test_drop_account() {
     let sql = "DROP ACCOUNT acc1 GRACE_PERIOD_IN_DAYS = 7";