Function parseSecretDDLHead

server/usersecrets/classify.go:115–170

parseSecretDDLHead parses the statement head (through the optional secret name) and returns the classification plus the byte offset just past the head. The fast path for non-secret statements is two short case-folded keyword comparisons — no allocation — so this is safe on hot paths.

(query string)

// head. The fast path for non-secret statements is two short case-folded
// keyword comparisons — no allocation — so this is safe on hot paths.
func parseSecretDDLHead(query string) (Statement, int, bool) {
	rest, ok := skipCommentsAndSpace(query)
	if !ok {
		return Statement{}, 0, false
	}
	toks := newTokenizer(rest)
	headStart := len(query) - len(rest)

	var st Statement
	switch {
	case toks.eatKeyword("CREATE"):
		st.Kind = KindCreate
		if toks.eatKeyword("OR") {
			if !toks.eatKeyword("REPLACE") {
				return Statement{}, 0, false
			}
		}
	case toks.eatKeyword("DROP"):
		st.Kind = KindDrop
	default:
		return Statement{}, 0, false
	}

	if toks.eatKeyword("PERSISTENT") {
		st.Persistent = true
	} else if toks.eatKeyword("TEMPORARY") || toks.eatKeyword("TEMP") {
		st.Temporary = true
	}

	if !toks.eatKeyword("SECRET") {
		return Statement{}, 0, false
	}

	if st.Kind == KindCreate {
		if toks.eatKeyword("IF") {
			if !toks.eatKeyword("NOT") || !toks.eatKeyword("EXISTS") {
				return Statement{}, 0, false
			}
			st.IfNotExists = true
		}
	} else {
		if toks.eatKeyword("IF") {
			if !toks.eatKeyword("EXISTS") {
				return Statement{}, 0, false
			}
		}
	}

	// Optional secret name. For CREATE the next token may instead be the
	// opening paren of the option list (unnamed secret).
	if name, ok := toks.eatIdentifier(); ok {
		st.Name = strings.ToLower(name)
	}

	return st, headStart + toks.i, true
}

// skipCommentsAndSpace removes leading whitespace, line comments (--) and