Patent ID: 11971876
Assignee: SNOWFLAKE INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 9:
10. A database platform comprising:
at least one hardware processor; and
one or more computer-storage media containing instructions that, when executed by at least one hardware processor, cause the at lea st one hardware processor to perform operations comprising:
storing a plurality of objects across a plurality of disjoint account-level namespaces in a customer account from among a plurality of customer accounts of a database platform, each customer account among the plurality of customer accounts being associated with a different customer of the database platform, each object among the plurality of objects having a corresponding first object name, each object among the plurality of objects being uniquely identifiable within a current account-level namespace of a given database session by the corresponding first object name of a object, each object among the plurality of objects being uniquely identifiable both within and outside of the current account-level namespace of the given database session by a combination of a corresponding account-level namespace in which the corresponding object resides and the corresponding first object name of the corresponding object,
the plurality of disjoint account-level namespaces including an application account-level namespace and a default account-level namespace, each of the plurality of disjoint account-level namespaces comprises a distinct context for resolution of object identifiers such that matching object identifiers in different account-level namespaces in the plurality of disjoint account-level namespaces in the customer account map to different objects and do not collide with respect to object-identifier resolution, the storing of the plurality of objects comprising storing a first portion of the plurality of objects associated with the application account-level namespace while disabling visibility of the first portion of the plurality of objects associated with the application account-level namespace to a plurality of users defined in the default account-level namespace;
receiving, by a provisioning framework system of the database platform, a provisioning request from a client, the provisioning request:
received over a first network path, not including any of a second network path, by a default namespace object previously provisioned for communications with the client over the first network path,
specifying an application hosted by a third party; and
requesting provisioning of an application specific namespace object of the customer account on the database platform, the application specific namespace object configured to provide communications between the application and the database platform over the second network path not including any of the first network path;
in response to receiving the provisioning request, retrieving an application-provisioning file specific to the application, the application-provisioning file being created by the third party, the application-provisioning file including one or more database objects comprising at least:
an application identifier;
a namespace identifier; and
one or more provisioning statements;
executing the application-provisioning file causing:
creating of the application namespace in accordance with the namespace identifier, the application namespace being separate from the default namespace object of the customer account;
creating at least one of the one or more database objects included in the application-provisioning file, the created database objects including the plurality of users and associated user roles;

assigning the application namespace and the application identifier to each of the created database objects to prevent name collisions by allowing the platform to distinguish between the provisioned database objects,
assigning each of the users to one or more user roles such that each user is assigned to one or more security privileges associated with each assigned role, the security privileges enabling the associated user to perform one or more operations in the application;

subsequent to the execution of the application-provisioning file:
receiving, by the database platform, a data request for customer data from the application triggered by the requesting entity;
routing the data request to the application specific namespace object using the application over the second network path;
receiving, by the application specific namespace object, the customer data; and
providing, by the application specific namespace object, the received customer data to the application over the second network path.