Titan plan requires Database Role to be created before grant is analyzed

[toadies]

In my YML file, I have the following

databases:
  - name: SOMEDATABASE_DB
    owner: SYSADMIN
database_roles:
  - name: SOMEDATABASE_DB_RAW_FULL_AR
    database: SOMEDATABASE_DB
    owner: USERADMIN
schemas:
  - name: RAW
    managed_access: true
    owner: SOMEDATABASE_DB_RAW_FULL_AR
grants:
  - priv: USAGE
    on_database: "DV_SOURCES_DB"
    to: SOMEDATABASE_DB_RAW_FULL_AR

SOMEDATABASE_DB_RAW_FULL_AR is not created yet. Below is the error I get.

  File "venv/lib/python3.10/site-packages/titan/blueprint.py", line 668, in fetch_remote_state
    raise MissingResourceException(
titan.exceptions.MissingResourceException: Resource urn::OXB62059:database_role/SOMEDATABASE_DB_RAW_FULL_AR required by urn::OXB62059:grant/GRANT?priv=USAGE&on=database/DV_SOURCES_DB&to=database_role/SOMEDATABASE_DB_RAW_FULL_AR not found or failed to fetch

[teej]

A workaround for this bug is to fully qualify the database role name. In this case:

grants:
  - priv: USAGE
    on_database: "DV_SOURCES_DB"
    to: SOMEDATABASE_DB.SOMEDATABASE_DB_RAW_FULL_AR

[toadies]

Using the following FQN, it fails when trying to get grants SHOW GRANTS OF ROLE.

databases:
  - name: DEV_SOURCES_DB
    owner: SYSADMIN
    comment: AUTO-PROVISION BY TITAN
database_roles:
  - name: DEV_SOURCES_DB_FULL_AR
    database: DEV_SOURCES_DB
    owner: USERADMIN
    comment: AUTO-PROVISION BY TITAN
role_grants:
  - role: DEV_SOURCES_DB.DEV_SOURCES_DB_FULL_AR
    to_role: SYSADMIN

Error

venv/lib/python3.10/site-packages/titan/client.py", line 98, in execute
    raise ProgrammingError(f"failed to execute sql, [{sql_text}]", errno=err.errno) from err
snowflake.connector.errors.ProgrammingError: 002043: failed to execute sql, [SHOW GRANTS OF ROLE DEV_SOURCES_DB.DEV_SOURCES_DB_FULL_AR]

[teej]

There's a new resource type DatabaseRoleGrant.

database_role_grants:
  - database_role: DEV_SOURCES_DB.DEV_SOURCES_DB_FULL_AR
    to_role: SYSADMIN

or for db role-to-db role

database_role_grants:
  - database_role: DEV_SOURCES_DB.DEV_SOURCES_DB_FULL_AR
    to_database_role: DEV_SOURCES_DB.SOME_OTHER_ROLE