Secrets & settings

On this page

Credentials and session settings a worker declares and reads.

struct SecretLookup

source

pub struct SecretLookup {
  pub secret_type: String,
  pub scope: Option<String>,
  pub name: Option<String>,
}

Description

A request for a secret to be resolved at bind time.

struct Secrets

source

pub struct Secrets {
  pub by_name: HashMap<String, HashMap<String, String>>,
}

Description

Parsed resolved secrets: secret name → field map (string-rendered values).

Methods

method field

source

pub fn field(&self, field: &str) -> Option<String>

Get a secret field value (first matching secret of any name).

method field_for

source

pub fn field_for(&self, path: &str, field: &str) -> Option<String>

A field of the best scope-matching secret for path (see for_scope).

method for_scope

source

pub fn for_scope(&self, path: &str) -> Option<&HashMap<String, String>>

The fields of the resolved secret whose scope is the longest prefix of path. Use this when a worker requested secrets for several scopes (e.g. one per cloud path / bucket) and must pick the right one per path. The connector serializes each secret’s scope as a newline-joined list of prefixes; a secret with no (or empty) scope matches as a last-resort fallback (covers unscoped secrets and older connectors that don’t send a scope). Returns None only when there are no candidate secrets.

method for_scope_of_type

source

pub fn for_scope_of_type(
  &self,
  path: &str,
  secret_type: &str,
) -> Option<&HashMap<String, String>>

Like for_scope but only over secrets of secret_type — the precise selector for cloud paths (e.g. the s3 secret matching a given s3://… URL when several buckets are in play).

method iter

source

pub fn iter(&self) -> impl Iterator<Item = (&str, &HashMap<String, String>)>

Iterate every resolved secret as (name, fields). Resolved secrets are keyed by their unique DuckDB secret name, so several secrets of the same type (e.g. one per S3 bucket) all appear here.

method named_field

source

pub fn named_field(&self, name: &str, field: &str) -> Option<String>

Get a named secret’s field.

method of_type

source

pub fn of_type<'a>(
  &'a self,
  secret_type: &'a str,
) -> impl Iterator<Item = &'a HashMap<String, String>> + 'a

Every resolved secret of secret_type, matched on each secret’s serialized type field (since secrets are keyed by name, not type).

method parse

source

pub fn parse(bytes: &[u8]) -> Result<Secrets>

Parse the IPC secrets blob. The shape mirrors Python: one column per secret name, each a struct of the secret’s fields.

method secret_type

source

pub fn secret_type(&self, name: &str) -> Option<String>

The DuckDB secret type of the named secret (its serialized type field).

struct Settings

source

pub struct Settings {
  pub values: HashMap<String, ArrayRef>,
}

Description

Parsed settings: name → 1-row Arrow array (preserves type for struct/typed access).

Methods

method parse

source

pub fn parse(bytes: &[u8]) -> Result<Settings>

Parse the IPC settings blob (empty → no settings).

function arc

source

pub fn arc(schema: arrow_schema::Schema) -> Arc<arrow_schema::Schema>

Description

Wrap a Schema in an Arc (re-export convenience).