Fix: Mask MotherDuck connection token in the logs

[themisvaltinos]

Mask the MotherDuck connection token in logs, displaying it as asterisks (md:db?motherduck_token=************) instead of revealing the actual value.

[izeigerman]

I believe there's another place where we leak tokens into logs:

sqlmesh/sqlmesh/core/config/connection.py

Lines 265 to 273 in 170df72

	if isinstance(path_options, DuckDBAttachOptions):
	query = path_options.to_sql(alias)
	else:
	query = f"ATTACH '{path_options}'"
	if not path_options.startswith("md:"):
	query += f" AS {alias}"
	elif self.token:
	query += f"?motherduck_token={self.token}"
	cursor.execute(query)

The ATTACH statement contains a token and this is statement is happily logged by the engine adapter.

[themisvaltinos]

I believe there's another place where we leak tokens into logs:

sqlmesh/sqlmesh/core/config/connection.py

Lines 271 to 273 in 170df72

	elif self.token:
	query += f"?motherduck_token={self.token}"
	cursor.execute(query)

The ATTACH statement contains a token and this is statement is happily logged by the engine adapter.

If I'm not mistaken we do not log this since this is the DuckDBPyConnection's execute method. Or is this being logged somewhere internally?

[izeigerman]

@themisvaltinos ah, great point. I think you're right

[georgesittas]

Update: I realized this is inconsistent with the other config classes, where password etc are not masked in __str__ and __repr__. Apologies for the back and forth, that probably wasn't a great suggestion.

I think we can just revert the last commit and simply factor out the regex at the top of the file so it's compiled once. Then it should be good to go.