ensures default views are owned by group, so anyone can drop/replace them

[tomjemmett]

No description provided.

[Copilot]

Pull request overview

This PR updates the default view-creation scripts to ensure the created/replaced views are reassigned to a shared owning group (so group members can manage/drop/replace them consistently).

Changes:

• Update create(...) to accept an object_owner_group and run ALTER VIEW ... OWNER TO ... after view creation.
• Update CLIs (main()) to use get_spark() and fetch object_owner_group from Databricks secrets via DBUtils.
• Fix/correct main() docstrings for the affected default view scripts.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
src/nhp/data/default/apc.py	Adds ownership reassignment for both APC views; main() now pulls group from secrets and uses get_spark().
src/nhp/data/default/ecds.py	Adds ownership reassignment for the ECDS view; main() now pulls group from secrets and uses get_spark().
src/nhp/data/default/opa.py	Adds ownership reassignment for the OPA view; main() now pulls group from secrets and uses get_spark().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tomjemmett]

@copilot can you re-review and check that prior noted issues are handled now? I've added some steps to prevent sql injection

[Copilot]

@copilot can you re-review and check that prior noted issues are handled now? I've added some steps to prevent sql injection

Re-reviewed the changes. Here's the status of the prior noted issues:

SQL injection (comments on apc.py:34-39, 41-46, ecds.py:25-30, opa.py:25-30): ✅ Addressed by the safe_ident() helper (strict ^[A-Za-z0-9_\.]+$ regex for table/view names) and .replace("", "``")` backtick-escaping for the owner group name.

Missing secret error handling (comment on apc.py:13): was still unhandled. Fixed in fee7080 — added a get_object_owner_group() helper in _default_view.py that wraps dbutils.secrets.get() with a try/except, raising a clear RuntimeError with actionable guidance if the secret is missing or inaccessible. All three entry-point files now use this helper.

[tomjemmett]

closing this, approach doesn't work as the views when owned by the group can't read the data