feat(grants): support SEMANTIC VIEW privileges (CREATE / SELECT ON ALL|FUTURE)

[GClunies]

Summary

Semantic views are the backbone of Cortex Analyst, but granting a role access to them required manual SQL. This registers SEMANTIC VIEW as a grants-only resource type following the CORTEX SEARCH SERVICE precedent (#18) — pure data-driven registration (enum member, SemanticViewPriv, SchemaPriv.CREATE_SEMANTIC_VIEW, PRIVS_FOR_RESOURCE_TYPE + RESOURCE_SCOPES entries), no concrete resource class and zero type-specific branching in the generic grant/fetch/SQL paths.

Closes #30

Changes

• CREATE SEMANTIC VIEW schema privilege: priv: CREATE SEMANTIC VIEW / on: schema db.schema
• Object grants: priv: SELECT|REFERENCES|MONITOR / on: semantic view db.schema.name (on_semantic_view= in Python)
• Bulk/future grants via the uniform on: forms: all semantic views in schema … / future semantic views in schema … (on_all_*/on_future_* kwargs stay rejected repo-wide by design — a test pins the redirect)
• Fix (pre-existing, surfaced by review): drop_grant's ALL branch rendered invalid SQL — missing FROM <role> and singular object type — so removing any on: all … grant failed at apply time; now mirrors the FUTURE branch
• Tests: 12 new unit tests (first coverage of a multi-word plural through the ALL/FUTURE parser), live grant.sql fixture line, strengthened test_revoke_all_grant, and a --snowflake-gated integration round-trip test
• Docs: grant.md examples, snowflake-permissions.md schema-scoped note, new resources/semantic_view.md + mkdocs nav

Before release (manual)

CI runs unit tests only (--ignore=tests/integration), so the new integration test collects-and-skips. Against a live test account (enterprise, if standard lacks the feature), run pytest tests/integration/test_grant_patterns.py --snowflake or manually confirm: SHOW GRANTS round-trips a semantic-view grant with zero plan drift, and GRANT SELECT ON ALL|FUTURE SEMANTIC VIEWS IN SCHEMA … executes.

Follow-up candidates (pre-existing, out of scope)

• tests/fixtures/sql/future_grant.sql is silently skipped by get_sql_fixtures (filename doesn't resolve to a resource class) — the whole file is dead coverage
• grant_yaml reconstructs bulk-grant on: strings in a singular, keyword-less form the parser wouldn't re-accept

[noel]

Thanks @GClunies — clean registration on the proven CORTEX/DBT pattern, and the drop_grant fix is a genuinely valuable catch. I checked out the branch and verified:

• The drop_grant ALL-branch fix is correct. It previously rendered REVOKE <priv> ON ALL <singular-type> IN <scope> — missing FROM <role> and not pluralized — so dropping any on: all … grant (every resource type, not just semantic views) failed at apply. It now mirrors the FUTURE branch exactly.
• Registration is complete and consistent (enum, SemanticViewPriv, SchemaPriv.CREATE_SEMANTIC_VIEW, PRIVS_FOR_RESOURCE_TYPE, RESOURCE_SCOPES), no type-specific branching.
• pluralize("SEMANTIC VIEW") → "SEMANTIC VIEWs", uppercased correctly in drop.
• Ran test_grant / test_lifecycle / test_privs: 269 passed.

Requested change (minor)

1. Apply the same .upper() to create_grant's ALL branch. The FUTURE branch (lifecycle.py:167) and your fixed drop ALL branch both do pluralize(...).upper(), but the create ALL branch (line 183) is still bare pluralize(items_type). Confirmed live:

   • CREATE → GRANT SELECT ON ALL SEMANTIC VIEWs IN SCHEMA DB.SCH TO ROLE R (lowercase s)
   • DROP → REVOKE SELECT ON ALL SEMANTIC VIEWS IN SCHEMA DB.SCH FROM ROLE R

   Functionally harmless (Snowflake keywords are case-insensitive), but it's the exact inconsistency you just fixed in drop_grant — worth uppercasing here too for symmetry.

Requested before release

2. Run the live round-trip (you flagged this): SHOW GRANTS round-trip with zero drift + ON ALL|FUTURE SEMANTIC VIEWS execution against a live enterprise account.

Looks good

• 12 new tests including first multi-word-plural coverage through the ALL/FUTURE parser, plus the strengthened test_revoke_all_grant.
• Honest follow-up notes on the pre-existing dead future_grant.sql fixture and grant_yaml's singular reconstruction — please do file those as separate issues.

Nice work — the drop fix alone is a good find.