René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"SnowflakeRegistry._apply_object UPDATE path missing project_id filter - cross-project overwrites","articleBody":"**Summary**\n\nSnowflakeRegistry._apply_object in `sdk/python/feast/infra/registry/snowflake.py` omits project_id from the WHERE clause on the UPDATE path, allowing an apply_* call for one project to overwrite a same-named object belonging to a different project.\n\n**Problem**\n\nThe _apply_object helper has two SQL branches:\n\n- SELECT (existence check) — correctly scoped:\n`SELECT ... WHERE project_id = '{project}' AND {id_field} = '{name}'`\n- UPDATE (overwrite) — missing project_id:\n`UPDATE ... WHERE {id_field} = '{name}'`\n\nBecause the UPDATE does not include project_id in its WHERE clause, it matches all rows with that name across every project (when registry is shared). This affects every resource type that goes through `_apply_object`: entities, data sources, feature views, feature services, saved datasets, validation references, permissions, and infrastructure objects.\n\n**Reproducer**\n\n- Create a Snowflake-backed registry shared by two projects (project_a and project_b).\n- In project_a, run feast apply with an entity named driver.\n- In project_b, run feast apply with an entity also named driver (but with different configuration).\n- Query project_a's driver entity — it now reflects project_b's definition because the UPDATE overwrote the row without filtering by project_id.\n\n**Expected behavior**\n\nThe UPDATE query should include project_id in the WHERE clause so that only the row for the correct project is updated:\n\n`UPDATE ... WHERE project_id = '{project}' AND {id_field} = '{name}'`\n\n**Impact**\n\nAffects all resource types (entities, data sources, feature views, feature services, saved datasets, validation references, permissions, infra objects).\nAny multi-project deployment sharing a Snowflake registry is at risk of silent data corruption.\n\nNote: The DELETE path (_delete_object) correctly includes project_id, so this bug is limited to the update/overwrite path.\n\n\n","author":{"url":"https://github.com/ntkathole","@type":"Person","name":"ntkathole"},"datePublished":"2026-04-01T05:26:01.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/6208/feast/issues/6208"}