Jonathan M HsiehandClaude Opus 5 2041c1a240 refactor(secrets): address Secrets the way every other object is addressed ...

Secret CRUD used plural collection routes with the identity in the body, which
is the one shape in the HTTP surface that does not match Table and Function
CRUD. #4166 moved Functions onto `<object>/{id}/<action>`; this does the same
for Secrets, so there is one route grammar rather than one per object type.

    POST /v1/secrets/create      ->  POST /v1/secret/{id}/create
    POST /v1/secrets/alter       ->  POST /v1/secret/{id}/alter
    POST /v1/secrets/describe    ->  POST /v1/secret/{id}/describe
    POST /v1/secrets/drop        ->  POST /v1/secret/{id}/drop
    POST /v1/secrets/list        ->  GET  /v1/namespace/{id}/secret/list

`{id}` is the namespace path and the name joined with the client's configured
delimiter, built by the same helper a table identifier is. The name and the
namespace therefore leave every request body: create and alter carry the value
alone, drop and describe carry nothing, and listing moves its `page_token` to a
query parameter. `add_namespace_path` goes with them -- a root Secret is
addressed by its bare name, so there is no longer an empty field to omit.

Identifiers are written into the path as-is rather than percent-encoded. The
charset a Secret name and a namespace segment admit already excludes everything
that would need escaping, and a route that reads like the ones beside it is
worth more than encoding against a charset that does not exist yet. If that
charset widens, this is the place that has to widen with it.

Listing takes a real namespace rather than rejecting a non-root one the way the
Function route does: Secrets are addressable inside nested namespaces, so the
namespace identifier is the whole point of the route.

`build_secret_identifier` is a wrapper over `build_table_identifier` rather than
a second implementation. The grammar belongs to the namespace spec rather than
to tables, and a call site should read as the thing it addresses.

Also removes `_DECLARED_SECRET`, which has been unreferenced since client-side
binding validation was dropped, and whose pattern was the environment variable
grammar rather than a Secret name's.

Tests: lancedb secret unit tests 7, `first_class_function_slice1` 9,
`first_class_function_slice2` 3, 93 Python tests across both slices.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UfmeJ533rQDnPBkMtjerV6

2026-09-14 19:35:27 +00:00

..

lancedb

refactor(secrets): address Secrets the way every other object is addressed

2026-09-14 19:35:27 +00:00

tests

refactor(secrets): address Secrets the way every other object is addressed

2026-09-14 19:35:27 +00:00

type_tests

fix(python): expose inline types to downstream checkers (#3817)

2026-08-07 17:31:42 +08:00