Snowflake: parse SECRET statement family (CREATE/ALTER/DROP/DESC/SHOW)

Snowflake's schema-level SECRET object, distinct from the DuckDB
Statement::CreateSecret (bare Ident name, Vec<SecretOption>). Options are
captured generically as key-value options so the grammar stays agnostic to
the per-type property matrix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hovaesco

src/ast/ddl.rs

@@ -1556,6 +1556,27 @@ impl fmt::Display for AlterNetworkRuleOperation {
     }
 }
 
+/// An operation on a secret in a Snowflake `ALTER SECRET` statement.
+#[derive(Debug, Clone, PartialEq, PartialOrd, Eq, Ord, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "visitor", derive(Visit, VisitMut))]
+pub enum AlterSnowflakeSecretOperation {
+    /// `SET <option> = <value> [ ... ]` — the type-specific mutable options,
+    /// captured generically as key-value options.
+    Set(KeyValueOptions),
+    /// `UNSET COMMENT`
+    UnsetComment,
+}
+
+impl fmt::Display for AlterSnowflakeSecretOperation {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            AlterSnowflakeSecretOperation::Set(options) => write!(f, "SET {options}"),
+            AlterSnowflakeSecretOperation::UnsetComment => write!(f, "UNSET COMMENT"),
+        }
+    }
+}
+
 /// An operation in an `ALTER TAG` statement.
 #[derive(Debug, Clone, PartialEq, PartialOrd, Eq, Ord, Hash)]
 #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]

src/ast/mod.rs

@@ -68,7 +68,8 @@ pub use self::ddl::{
     AlterOperatorClass,
     AlterOperatorClassOperation, AlterOperatorFamily, AlterOperatorFamilyOperation,
     AlterOperatorOperation, AlterPolicy, AlterPolicyOperation, AlterProcedure,
-    AlterProcedureOperation, AlterSchema, AlterSchemaOperation, AlterTable, AlterTableAlgorithm,
+    AlterProcedureOperation, AlterSchema, AlterSchemaOperation, AlterSnowflakeSecretOperation,
+    AlterTable, AlterTableAlgorithm,
     AlterTableLock, AlterTableOperation, AlterTableType, AlterTagOperation, AlterType,
     AlterTypeAddValue, AlterTypeAddValuePosition, AlterTypeOperation, AlterTypeRename,
     AlterTypeRenameValue, ClusteredBy, ColumnDef, ColumnOption, ColumnOptionDef, ColumnOptions,
@@ -5624,6 +5625,61 @@ pub enum Statement {
         show_options: ShowStatementOptions,
     },
     /// ```sql
+    /// CREATE [OR REPLACE] SECRET [IF NOT EXISTS] <name>
+    ///   TYPE = <t> <type-specific options> [ COMMENT = '<comment>' ]
+    /// ```
+    /// The Snowflake schema-level secret object. Distinct from the DuckDB
+    /// [`Statement::CreateSecret`], whose name is a bare `Ident` and whose
+    /// options are a `Vec<SecretOption>`. All options are captured generically
+    /// as key-value options.
+    /// See <https://docs.snowflake.com/en/sql-reference/sql/create-secret>
+    CreateSnowflakeSecret {
+        /// `OR REPLACE` flag.
+        or_replace: bool,
+        /// `IF NOT EXISTS` flag.
+        if_not_exists: bool,
+        /// Secret name.
+        name: ObjectName,
+        /// All secret options (`TYPE`, credentials, `COMMENT`, …).
+        options: KeyValueOptions,
+    },
+    /// ```sql
+    /// ALTER SECRET [IF EXISTS] <name> { SET <options> | UNSET COMMENT }
+    /// ```
+    /// See <https://docs.snowflake.com/en/sql-reference/sql/alter-secret>
+    AlterSnowflakeSecret {
+        /// `IF EXISTS` flag.
+        if_exists: bool,
+        /// Secret name.
+        name: ObjectName,
+        /// The operation to apply.
+        operation: AlterSnowflakeSecretOperation,
+    },
+    /// ```sql
+    /// DROP SECRET [IF EXISTS] <name>
+    /// ```
+    DropSnowflakeSecret {
+        /// `IF EXISTS` flag.
+        if_exists: bool,
+        /// Secret name.
+        name: ObjectName,
+    },
+    /// ```sql
+    /// DESC[RIBE] SECRET <name>
+    /// ```
+    DescribeSnowflakeSecret {
+        /// Secret name.
+        name: ObjectName,
+    },
+    /// ```sql
+    /// SHOW SECRETS [ LIKE '<pattern>' ] [ IN <scope> ]
+    ///   [ STARTS WITH '<s>' ] [ LIMIT <n> [ FROM '<s>' ] ]
+    /// ```
+    ShowSnowflakeSecrets {
+        /// Options controlling the SHOW output (filter, `IN <scope>`, etc.).
+        show_options: ShowStatementOptions,
+    },
+    /// ```sql
     /// SHOW PROCEDURES [ LIKE '<pattern>' ] [ IN <scope> ]
     /// ```
     ShowProcedures {
@@ -8315,6 +8371,47 @@ impl fmt::Display for Statement {
             Statement::ShowNetworkRules { show_options } => {
                 write!(f, "SHOW NETWORK RULES{show_options}")
             }
+            Statement::CreateSnowflakeSecret {
+                or_replace,
+                if_not_exists,
+                name,
+                options,
+            } => {
+                write!(
+                    f,
+                    "CREATE {or_replace}SECRET {if_not_exists}{name}",
+                    or_replace = if *or_replace { "OR REPLACE " } else { "" },
+                    if_not_exists = if *if_not_exists { "IF NOT EXISTS " } else { "" },
+                )?;
+                if !options.options.is_empty() {
+                    write!(f, " {options}")?;
+                }
+                Ok(())
+            }
+            Statement::AlterSnowflakeSecret {
+                if_exists,
+                name,
+                operation,
+            } => {
+                write!(
+                    f,
+                    "ALTER SECRET {if_exists}{name} {operation}",
+                    if_exists = if *if_exists { "IF EXISTS " } else { "" },
+                )
+            }
+            Statement::DropSnowflakeSecret { if_exists, name } => {
+                write!(
+                    f,
+                    "DROP SECRET {if_exists}{name}",
+                    if_exists = if *if_exists { "IF EXISTS " } else { "" },
+                )
+            }
+            Statement::DescribeSnowflakeSecret { name } => {
+                write!(f, "DESCRIBE SECRET {name}")
+            }
+            Statement::ShowSnowflakeSecrets { show_options } => {
+                write!(f, "SHOW SECRETS{show_options}")
+            }
             Statement::ShowProcedures { show_options } => {
                 write!(f, "SHOW PROCEDURES{show_options}")?;
                 Ok(())

src/ast/spans.rs

@@ -590,6 +590,11 @@ impl Spanned for Statement {
             Statement::DropNetworkRule { .. } => Span::empty(),
             Statement::DescribeNetworkRule { .. } => Span::empty(),
             Statement::ShowNetworkRules { .. } => Span::empty(),
+            Statement::CreateSnowflakeSecret { .. } => Span::empty(),
+            Statement::AlterSnowflakeSecret { .. } => Span::empty(),
+            Statement::DropSnowflakeSecret { .. } => Span::empty(),
+            Statement::DescribeSnowflakeSecret { .. } => Span::empty(),
+            Statement::ShowSnowflakeSecrets { .. } => Span::empty(),
             Statement::ShowProcedures { .. } => Span::empty(),
             Statement::ShowConnections { .. } => Span::empty(),
             Statement::ShowShares { .. } => Span::empty(),

src/dialect/snowflake.rs

@@ -28,7 +28,7 @@ use crate::ast::helpers::stmt_data_loading::{
 };
 use crate::ast::{
     AlterExternalVolumeOperation, AlterFileFormatOperation, AlterMaskingPolicyOperation,
-    AlterNetworkRuleOperation,
+    AlterNetworkRuleOperation, AlterSnowflakeSecretOperation,
     AlterProcedure, AlterProcedureOperation, AlterStageOperation, AlterTable, AlterTableOperation,
     AlterTableType, AlterTagOperation, CatalogRestAuthentication, CatalogRestConfig, CatalogSource,
     CatalogSyncNamespaceMode, CatalogTableFormat, ColumnOption, ColumnPolicy, ColumnPolicyProperty,
@@ -437,6 +437,11 @@ impl Dialect for SnowflakeDialect {
             return Some(parse_alter_network_rule(parser));
         }
 
+        if parser.parse_keywords(&[Keyword::ALTER, Keyword::SECRET]) {
+            // ALTER SECRET
+            return Some(parse_alter_secret(parser));
+        }
+
         if parser.parse_keywords(&[Keyword::ALTER, Keyword::SESSION]) {
             // ALTER SESSION
             let set = match parser.parse_one_of_keywords(&[Keyword::SET, Keyword::UNSET]) {
@@ -497,6 +502,11 @@ impl Dialect for SnowflakeDialect {
             return Some(parse_drop_network_rule(parser));
         }
 
+        if parser.parse_keywords(&[Keyword::DROP, Keyword::SECRET]) {
+            // DROP SECRET
+            return Some(parse_drop_secret(parser));
+        }
+
         if parser
             .parse_one_of_keywords(&[Keyword::DESC, Keyword::DESCRIBE])
             .is_some()
@@ -529,6 +539,10 @@ impl Dialect for SnowflakeDialect {
                 // DESC[RIBE] NETWORK RULE
                 return Some(parse_describe_network_rule(parser));
             }
+            if parser.parse_keyword(Keyword::SECRET) {
+                // DESC[RIBE] SECRET
+                return Some(parse_describe_secret(parser));
+            }
             // not handled — put back DESC/DESCRIBE
             parser.prev_token();
         }
@@ -573,6 +587,11 @@ impl Dialect for SnowflakeDialect {
                 return Some(parse_create_network_rule(or_replace, parser));
             }
 
+            // CREATE [OR REPLACE] SECRET
+            if parser.parse_keyword(Keyword::SECRET) {
+                return Some(parse_create_secret(or_replace, parser));
+            }
+
             // LOCAL | GLOBAL
             let global = match parser.parse_one_of_keywords(&[Keyword::LOCAL, Keyword::GLOBAL]) {
                 Some(Keyword::LOCAL) => Some(false),
@@ -741,6 +760,9 @@ impl Dialect for SnowflakeDialect {
             if parser.parse_keywords(&[Keyword::NETWORK, Keyword::RULES]) {
                 return Some(parse_show_network_rules(parser));
             }
+            if parser.parse_keyword(Keyword::SECRETS) {
+                return Some(parse_show_secrets(parser));
+            }
             if parser.parse_keyword(Keyword::PROCEDURES) {
                 return Some(parse_show_procedures(parser));
             }
@@ -4049,6 +4071,65 @@ fn parse_show_network_rules(parser: &mut Parser) -> Result<Statement, ParserErro
     Ok(Statement::ShowNetworkRules { show_options })
 }
 
+/// Parse `CREATE [OR REPLACE] SECRET [IF NOT EXISTS] <name> <options>`.
+///
+/// Options (`TYPE`, `USERNAME`, `SECRET_STRING`, `PASSWORD`,
+/// `API_AUTHENTICATION`, `OAUTH_SCOPES`, `OAUTH_REFRESH_TOKEN`,
+/// `ALGORITHM`, `COMMENT`, …) are captured generically as key-value options,
+/// so the parser stays agnostic to the per-type property set.
+fn parse_create_secret(or_replace: bool, parser: &mut Parser) -> Result<Statement, ParserError> {
+    let if_not_exists = parser.parse_keywords(&[Keyword::IF, Keyword::NOT, Keyword::EXISTS]);
+    let name = parser.parse_object_name(false)?;
+    let options = parser.parse_key_value_options(false, &[], false)?;
+    Ok(Statement::CreateSnowflakeSecret {
+        or_replace,
+        if_not_exists,
+        name,
+        options,
+    })
+}
+
+/// Parse `ALTER SECRET [IF EXISTS] <name> { SET <options> | UNSET COMMENT }`.
+fn parse_alter_secret(parser: &mut Parser) -> Result<Statement, ParserError> {
+    let if_exists = parser.parse_keywords(&[Keyword::IF, Keyword::EXISTS]);
+    let name = parser.parse_object_name(false)?;
+    let operation = if parser.parse_keyword(Keyword::SET) {
+        let options = parser.parse_key_value_options(false, &[], false)?;
+        if options.options.is_empty() {
+            return parser.expected_ref("at least one option to SET", parser.peek_token_ref());
+        }
+        AlterSnowflakeSecretOperation::Set(options)
+    } else if parser.parse_keywords(&[Keyword::UNSET, Keyword::COMMENT]) {
+        AlterSnowflakeSecretOperation::UnsetComment
+    } else {
+        return parser.expected_ref("SET <options> or UNSET COMMENT", parser.peek_token_ref());
+    };
+    Ok(Statement::AlterSnowflakeSecret {
+        if_exists,
+        name,
+        operation,
+    })
+}
+
+/// Parse `DROP SECRET [IF EXISTS] <name>`.
+fn parse_drop_secret(parser: &mut Parser) -> Result<Statement, ParserError> {
+    let if_exists = parser.parse_keywords(&[Keyword::IF, Keyword::EXISTS]);
+    let name = parser.parse_object_name(false)?;
+    Ok(Statement::DropSnowflakeSecret { if_exists, name })
+}
+
+/// Parse `DESC[RIBE] SECRET <name>`.
+fn parse_describe_secret(parser: &mut Parser) -> Result<Statement, ParserError> {
+    let name = parser.parse_object_name(false)?;
+    Ok(Statement::DescribeSnowflakeSecret { name })
+}
+
+/// Parse `SHOW SECRETS [LIKE '<pattern>'] [IN <scope>] [STARTS WITH ...] [LIMIT ...]`.
+fn parse_show_secrets(parser: &mut Parser) -> Result<Statement, ParserError> {
+    let show_options = parser.parse_show_stmt_options()?;
+    Ok(Statement::ShowSnowflakeSecrets { show_options })
+}
+
 /// Parse `SHOW PROCEDURES [LIKE '<pattern>'] [IN <scope>]`
 fn parse_show_procedures(parser: &mut Parser) -> Result<Statement, ParserError> {
     let show_options = parser.parse_show_stmt_options()?;

src/keywords.rs

@@ -992,6 +992,7 @@ define_keywords!(
     SECONDARY_ENGINE_ATTRIBUTE,
     SECONDS,
     SECRET,
+    SECRETS,
     SECURE,
     SECURITY,
     SEED,