TestPinSecretDirectory is the regression guard for the worker-side fix: with Config.PinSecretDirectory set (as duckdbservice.OpenDuckDBPair does for every worker), ConfigureMainDB redirects DuckDB's persistent-secret storage to /secrets. That means: (a) a CREATE PERSISTENT SECRET lands un
(t *testing.T)
| 23 | // ATTACH, which needs the local_file secret storage registered), so persistent |
| 24 | // secrets still work — they're just relocated and wiped on recycle. |
| 25 | func TestPinSecretDirectory(t *testing.T) { |
| 26 | dir := t.TempDir() |
| 27 | secretDir := SecretDirectory(Config{DataDir: dir}) |
| 28 | |
| 29 | db, err := sql.Open("duckdb", ":memory:?allow_unsigned_extensions=true") |
| 30 | if err != nil { |
| 31 | t.Fatalf("open duckdb: %v", err) |
| 32 | } |
| 33 | defer func() { _ = db.Close() }() |
| 34 | |
| 35 | cfg := Config{DataDir: dir, PinSecretDirectory: true} |
| 36 | if err := ConfigureMainDB(db, cfg, "worker"); err != nil { |
| 37 | t.Fatalf("ConfigureMainDB: %v", err) |
| 38 | } |
| 39 | |
| 40 | // (a) a persistent secret must still be creatable and must land under the |
| 41 | // pinned directory. |
| 42 | if _, err := db.Exec("CREATE PERSISTENT SECRET pinned (TYPE s3, KEY_ID 'a', SECRET 'b')"); err != nil { |
| 43 | t.Fatalf("create persistent secret: %v", err) |
| 44 | } |
| 45 | entries, err := os.ReadDir(secretDir) |
| 46 | if err != nil { |
| 47 | t.Fatalf("read pinned secret_directory %s: %v", secretDir, err) |
| 48 | } |
| 49 | if len(entries) == 0 { |
| 50 | t.Errorf("persistent secret did not land under pinned secret_directory %s", secretDir) |
| 51 | } |
| 52 | } |
| 53 | |
| 54 | // TestPinSecretDirectoryIgnoresLegacyDefault proves point (b): a secret written |
| 55 | // to DuckDB's old $HOME-style default location is not loaded once the directory |
nothing calls this directly
no test coverage detected