Function containsWriteCTE

backend/plugin/parser/pg/query_antlr.go:107–122

containsWriteCTE reports whether any common table expression in the tree is data-modifying. Fail-safe by construction — a whitelist, not a denylist: a CTE term is read-only ONLY if it is an *ast.SelectStmt, which is how pg models SELECT, VALUES, TABLE, set operations and WITH RECURSIVE. Anything els

(node ast.Node)

// INSERT/UPDATE/DELETE/MERGE today, or any write node added to the grammar
// tomorrow — counts as a write, so the next forgotten write type fails closed.
func containsWriteCTE(node ast.Node) bool {
	found := false
	ast.Inspect(node, func(n ast.Node) bool {
		if found {
			return false
		}
		if cte, ok := n.(*ast.CommonTableExpr); ok {
			if _, isSelect := cte.Ctequery.(*ast.SelectStmt); !isSelect {
				found = true
				return false
			}
		}
		return true
	})
	return found
}