Task LAV-1720: EXTERNAL_ACCESS_INTEGRATIONS / SECRETS on CREATE FUNCTION and CREATE PROCEDURE, incl. the SHOW and INFORMATION_SCHEMA columns (apache#2254)

* task LAV-1720: WIP — commit stranded agent work

* Task LAV-1720: create-time EAI/SECRETS validation + read-surface wiring (WIP)

Implements the EXTERNAL_ACCESS_INTEGRATIONS / SECRETS create-time validator
(__snowflake$validate_udf_external_access), XSFD5-8 error mappings, GET_DDL
separator fix, and wires validation into the function + Python-procedure create
paths. Blocked on the SHOW USER FUNCTIONS is_ai_function shared-shape decision
(see Linear).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Task LAV-1720: EXTERNAL_ACCESS_INTEGRATIONS / SECRETS on CREATE FUNCTION/PROCEDURE

Parse both clauses on CREATE FUNCTION and (via the PROCEDURE->FUNCTION rewrite)
CREATE PROCEDURE, store them structured, validate at create time against live
integrations/secrets with real-Snowflake errors, and project them on SHOW,
INFORMATION_SCHEMA and GET_DDL.

Real-Snowflake finding: a SECRETS clause with no EXTERNAL_ACCESS_INTEGRATIONS is
accepted (there is no integration to gate it against), so the allow check only
fires when integrations are referenced.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Task LAV-1720: validate EAI/SECRETS on LANGUAGE JAVA create path

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hovaesco

src/parser/mod.rs

@@ -6449,14 +6449,20 @@ impl<'a> Parser<'a> {
     }
 
     /// True when the next token is a Snowflake Python-UDF property name
-    /// (`RUNTIME_VERSION`, `HANDLER`, `IMPORTS`, `PACKAGES`). None of these are
-    /// reserved keywords, so they are recognised by their bare-word spelling.
+    /// (`RUNTIME_VERSION`, `HANDLER`, `IMPORTS`, `PACKAGES`,
+    /// `EXTERNAL_ACCESS_INTEGRATIONS`, `SECRETS`). None of these are reserved
+    /// keywords, so they are recognised by their bare-word spelling.
     fn peek_snowflake_function_property(&self) -> bool {
         matches!(&self.peek_token_ref().token, Token::Word(w)
         if w.quote_style.is_none()
             && matches!(
                 w.value.to_ascii_uppercase().as_str(),
-                "RUNTIME_VERSION" | "HANDLER" | "IMPORTS" | "PACKAGES"
+                "RUNTIME_VERSION"
+                    | "HANDLER"
+                    | "IMPORTS"
+                    | "PACKAGES"
+                    | "EXTERNAL_ACCESS_INTEGRATIONS"
+                    | "SECRETS"
             ))
     }
 

tests/sqlparser_snowflake.rs

@@ -6157,6 +6157,55 @@ fn test_select_from_stage_comma_join_lateral() {
     snowflake().verified_stmt("SELECT * FROM @stage/test.jsonl, other_table");
 }
 
+/// `CREATE FUNCTION … EXTERNAL_ACCESS_INTEGRATIONS = (…) SECRETS = ('a' = s)`
+/// parses both Snowflake property clauses into `options` as key-value pairs:
+/// the integrations list as a tuple of identifiers, the secrets list as a tuple
+/// of `'alias' = <secret>` bindings.
+#[test]
+fn test_snowflake_create_function_external_access_and_secrets() {
+    let sql = "CREATE FUNCTION f(x NUMBER) RETURNS NUMBER LANGUAGE PYTHON \
+               RUNTIME_VERSION = '3.10' HANDLER = 'run' \
+               EXTERNAL_ACCESS_INTEGRATIONS = (eai_a, eai_b) \
+               SECRETS = ('cred' = my_secret) AS 'def run(x): return x'";
+    let options = match snowflake().parse_sql_statements(sql).unwrap().remove(0) {
+        Statement::CreateFunction(cf) => cf.options.expect("options should be present"),
+        other => panic!("expected CreateFunction, got {other:?}"),
+    };
+
+    let eai = options
+        .iter()
+        .find_map(|o| match o {
+            SqlOption::KeyValue { key, value }
+                if key.value.eq_ignore_ascii_case("EXTERNAL_ACCESS_INTEGRATIONS") =>
+            {
+                Some(value)
+            }
+            _ => None,
+        })
+        .expect("EXTERNAL_ACCESS_INTEGRATIONS option");
+    match eai {
+        Expr::Tuple(items) => assert_eq!(items.len(), 2),
+        other => panic!("expected a tuple of integrations, got {other:?}"),
+    }
+
+    let secrets = options
+        .iter()
+        .find_map(|o| match o {
+            SqlOption::KeyValue { key, value } if key.value.eq_ignore_ascii_case("SECRETS") => {
+                Some(value)
+            }
+            _ => None,
+        })
+        .expect("SECRETS option");
+    match secrets {
+        Expr::Tuple(items) => match &items[0] {
+            Expr::BinaryOp { op, .. } => assert_eq!(*op, BinaryOperator::Eq),
+            other => panic!("expected 'alias' = secret binding, got {other:?}"),
+        },
+        other => panic!("expected a tuple of secret bindings, got {other:?}"),
+    }
+}
+
 /// Bare assignment `var := expr` inside `BEGIN...END` scripting blocks.
 #[test]
 fn test_scripting_bare_assignment() {