risingwave_frontend/handler/
alter_secret.rs

1// Copyright 2025 RisingWave Labs
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15use anyhow::anyhow;
16use pgwire::pg_response::StatementType;
17use prost::Message;
18use risingwave_common::license::Feature;
19use risingwave_common::secret::LocalSecretManager;
20use risingwave_pb::secret::secret;
21use risingwave_sqlparser::ast::{AlterSecretOperation, ObjectName, SqlOption};
22
23use super::create_secret::{get_secret_payload, secret_to_str};
24use super::drop_secret::fetch_secret_catalog_with_db_schema_id;
25use crate::WithOptions;
26use crate::error::Result;
27use crate::handler::{HandlerArgs, RwPgResponse};
28
29pub async fn handle_alter_secret(
30    handler_args: HandlerArgs,
31    secret_name: ObjectName,
32    sql_options: Vec<SqlOption>,
33    operation: AlterSecretOperation,
34) -> Result<RwPgResponse> {
35    Feature::SecretManagement.check_available()?;
36
37    let session = handler_args.session;
38
39    if let Some((secret_catalog, _, _)) =
40        fetch_secret_catalog_with_db_schema_id(&session, &secret_name, false)?
41    {
42        let AlterSecretOperation::ChangeCredential { new_credential } = operation;
43
44        let secret_id = secret_catalog.id.secret_id();
45        let secret_payload = if sql_options.is_empty() {
46            let original_pb_secret_bytes = LocalSecretManager::global()
47                .get_secret(secret_id)
48                .ok_or(anyhow!(
49                    "Failed to get secret in secret manager, secret_id: {}",
50                    secret_id
51                ))?;
52            let original_secret_backend =
53                LocalSecretManager::get_pb_secret_backend(&original_pb_secret_bytes)?;
54            match original_secret_backend {
55                secret::SecretBackend::Meta(_) => {
56                    let new_secret_value_bytes =
57                        secret_to_str(&new_credential)?.as_bytes().to_vec();
58                    let secret_payload = risingwave_pb::secret::Secret {
59                        secret_backend: Some(risingwave_pb::secret::secret::SecretBackend::Meta(
60                            risingwave_pb::secret::SecretMetaBackend {
61                                value: new_secret_value_bytes,
62                            },
63                        )),
64                    };
65                    secret_payload.encode_to_vec()
66                }
67                secret::SecretBackend::HashicorpVault(_vault_backend) => {
68                    return Err(crate::error::ErrorCode::InvalidParameterValue(
69                        "alter secret with hashicorp_vault backend is not supported".to_owned(),
70                    )
71                    .into());
72                }
73            }
74        } else {
75            let with_options = WithOptions::try_from(sql_options.as_ref() as &[SqlOption])?;
76            get_secret_payload(new_credential, with_options).await?
77        };
78
79        let catalog_writer = session.catalog_writer()?;
80
81        catalog_writer
82            .alter_secret(
83                secret_id,
84                secret_catalog.name.clone(),
85                secret_catalog.database_id,
86                secret_catalog.schema_id,
87                secret_catalog.owner,
88                secret_payload,
89            )
90            .await?;
91
92        Ok(RwPgResponse::empty_result(StatementType::ALTER_SECRET))
93    } else {
94        Ok(RwPgResponse::builder(StatementType::ALTER_SECRET)
95            .notice(format!(
96                "secret \"{}\" does not exist, skipping",
97                secret_name
98            ))
99            .into())
100    }
101}
risingwave_frontend/handler/alter_secret.rs

risingwave_frontend/handler/
alter_secret.rs
