Function queryHasCreateSecret

server/usersecrets/redact.go:80–95

queryHasCreateSecret reports whether query contains a CREATE SECRET at its head or in any top-level statement. It shares the tokenizer with RedactForLog (parseSecretDDLHead / splitTopLevel) so the query and error redactors can never drift apart. DROP SECRET (which carries only a name) is not a match

(query string)

// (parseSecretDDLHead / splitTopLevel) so the query and error redactors can
// never drift apart. DROP SECRET (which carries only a name) is not a match.
func queryHasCreateSecret(query string) bool {
	if st, _, ok := parseSecretDDLHead(query); ok && st.Kind == KindCreate {
		return true
	}
	// A single top-level statement whose head is not CREATE SECRET cannot hide
	// secret DDL; only multi-statement strings need the per-segment scan.
	if !hasTrailingStatement(query) {
		return false
	}
	for _, seg := range splitTopLevel(query) {
		if st, _, ok := parseSecretDDLHead(seg); ok && st.Kind == KindCreate {
			return true
		}
	}
	return false
}