fix: apply grants to the physical layer table on promote

Author: newtonapple

sqlmesh/core/snapshot/evaluator.py

@@ -1937,6 +1937,9 @@ def promote(
             view_properties=model.render_virtual_properties(**render_kwargs),
         )
 
+        # Apply grants to the physical layer table
+        self._apply_grants(model, table_name, GrantsTargetLayer.PHYSICAL)
+
         # Apply grants to the virtual layer view
         self._apply_grants(model, view_name, GrantsTargetLayer.VIRTUAL)
 

tests/core/test_snapshot_evaluator.py

@@ -5013,17 +5013,15 @@ def test_grants_create_model_kind(
 
 
 @pytest.mark.parametrize(
-    "target_layer,apply_on_create,apply_on_promote",
+    "target_layer",
     [
-        (GrantsTargetLayer.PHYSICAL, True, False),
-        (GrantsTargetLayer.VIRTUAL, False, True),
-        (GrantsTargetLayer.ALL, True, True),
+        GrantsTargetLayer.PHYSICAL,
+        GrantsTargetLayer.VIRTUAL,
+        GrantsTargetLayer.ALL,
     ],
 )
 def test_grants_target_layer(
     target_layer: GrantsTargetLayer,
-    apply_on_create: bool,
-    apply_on_promote: bool,
     adapter_mock: Mock,
     mocker: MockerFixture,
     make_snapshot: t.Callable[..., Snapshot],
@@ -5045,19 +5043,17 @@ def test_grants_target_layer(
     snapshot.categorize_as(SnapshotChangeCategory.BREAKING)
 
     evaluator.create([snapshot], {})
-    if apply_on_create:
-        sync_grants_mock.assert_called_once()
-        assert sync_grants_mock.call_args[0][1] == grants
+    if target_layer == GrantsTargetLayer.VIRTUAL:
+        assert sync_grants_mock.call_count == 0
     else:
-        sync_grants_mock.assert_not_called()
-
+        assert sync_grants_mock.call_count == 1
+        assert sync_grants_mock.call_args[0][1] == grants
     sync_grants_mock.reset_mock()
     evaluator.promote([snapshot], EnvironmentNamingInfo(name="prod"))
-    if apply_on_promote:
-        sync_grants_mock.assert_called_once()
-        assert sync_grants_mock.call_args[0][1] == grants
+    if target_layer == GrantsTargetLayer.ALL:
+        assert sync_grants_mock.call_count == 2
     else:
-        sync_grants_mock.assert_not_called()
+        assert sync_grants_mock.call_count == 1
 
 
 def test_grants_update(