Secure shared data application access

A data platform comprising:

• one or more processors;
• and
• at least one memory storing instructions that, when executed by the one or more processors, cause the data platform to perform operations comprising:
• receiving, by the data platform from a provider user, a data application to be executed on the data platform and provider granted privileges for the data application, the provider granted privileges including a consumer usage privilege authorizing a consumer user to use the data application and a consumer access to data privilege authorizing the data application, when used by the consumer user, to access a provider database object of the provider user;
• authorizing, by the data platform, the consumer user to access the data platform based on a consumer account privilege;
• receiving, by the data platform from the consumer user, consumer granted privileges, the consumer granted privileges including a provider access to data privilege authorizing the data application provided by the provider user to access a consumer database object of the consumer user;
• authorizing, by the data platform, the consumer user to use the data application based on the consumer usage privilege of the provider granted privileges by attaching a session of the consumer user to a Web socket connection to evaluate a context used to process a request to use the data application in a sandboxed execution environment;
• and
• during an execution of the data application by the data platform in response to a request from the consumer user to use the data application, performing operations comprising:
• authorizing, by the data platform, the data application to access the provider database object based on the consumer access to data privilege included in the provider granted privileges;
• and
• authorizing, by the data platform, the data application to access the consumer database object based on the provider access to data privilege included in the consumer granted privileges.

A computer-storage medium comprising instructions that, when executed by one or more processors of a data platform, cause the data platform to perform operations comprising:

• receiving, by the data platform from a provider user, a data application to be executed on the data platform and provider granted privileges for the data application, the provider granted privileges including a consumer usage privilege authorizing a consumer user to use the data application and a consumer access to data privilege authorizing the data application, when used by the consumer user, second user to access a provider database object of the provider user;
• authorizing, by the data platform, the consumer user to access the data platform based on a consumer account privilege;
• receiving, by the data platform from the consumer user, consumer granted privileges, the consumer granted privileges including a provider access to data privilege authorizing the data application provided by the provider first user to access a consumer database object of the consumer user;
• authorizing, by the data platform, the consumer user to use the data application based on the consumer usage privilege of the provider granted privileges by attaching a session of the consumer user to a Web socket connection to evaluate a context used to process a request to use the data application in a sandboxed execution environment;
• and
• during an execution of the data application by the data platform in response to a request from the consumer user to use the data application, performing operations comprising:
• authorizing, by the data platform, the data application to access the provider database object based on the consumer access to data privilege included in the provider granted privileges;
• and
• authorizing, by the data platform, the data application to access the consumer database object based on the provider access to data privilege included in the consumer granted privileges.