rust/lancedb
1
0
Fork 0
mirror of https://github.com/lancedb/lancedb.git synced 2026-11-13 14:16:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: align Secret APIs with native SQL syntax (#4784)

Browse Source 
Secret APIs now submit the native SQL statements with the credential
bound as an Arrow string parameter:

```sql
CREATE SECRET "api-key" TYPE = GENERIC_STRING SECRET_STRING = $1;
ALTER SECRET "api-key" SET SECRET_STRING = $1;
DESCRIBE SECRET "api-key";
```

`create_secret` and `alter_secret` execute SQL through the existing
query-backed job adapter and wait for that query to complete. The job's
`id` is the query ID and its type is `query`; credentials stay out of
SQL text. `describe_secret` reads the native `name`,
`created_at_millis`, and `updated_at_millis` columns. This replaces the
unreleased `AS $1` syntax and JSON-envelope response without a
compatibility fallback.

Python methods and namespace handling remain the same:

```python
db.create_secret("api-key", "credential", namespace_path=["team"])
db.alter_secret("api-key", "rotated", namespace_path=["team"])
info = db.describe_secret("api-key", namespace_path=["team"])
```
This commit is contained in:
Jack Ye
2026-11-02 01:15:32 +08:00
committed by GitHub
parent a9146d536a
commit 42e8e7dfca
3 changed files with 97 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/web/basics/jobs.mdx
+3 -2
View File
@@ -127,8 +127,9 @@ physical cleanup continues separately.
Remote Secret create, alter, list, describe, and drop use the SQL query backend.
The synchronous APIs wait on query completion internally. Create and alter bind
the credential as a parameter to `CREATE SECRET name AS $1` or
`ALTER SECRET name AS $1`, keeping it out of SQL text. Results contain only
the credential as a parameter to
`CREATE SECRET name TYPE = GENERIC_STRING SECRET_STRING = $1` or
`ALTER SECRET name SET SECRET_STRING = $1`, keeping it out of SQL text. Results contain only
completion status or Secret names and timestamps; they never return credential
values. SQL `DESCRIBE SECRET` additionally exposes rotation history.