arrows 0.2.0__tar.gz → 0.2.2__tar.gz

{arrows-0.2.0 → arrows-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arrows
-Version: 0.2.0
+Version: 0.2.2
 Summary: Universal data wrangling tool built around Apache Arrow, DuckDB, Polars, S3 for efficiently transferring and transforming data between different data sources with pluggable, independently loadable components
 Keywords: arrow,duckdb,polars,etl,s3,redshift,data-engineering
 Author: George Jiang
@@ -28,6 +28,7 @@ Requires-Dist: google-auth>=2.58.0
 Requires-Dist: pandas>=2.2
 Requires-Dist: polars>=1.44.2
 Requires-Dist: keyring>=25.0
+Requires-Dist: redshift-connector>=2.1.16
 Requires-Python: >=3.11
 Project-URL: Homepage, https://github.com/George-Jiang/arrows
 Project-URL: Repository, https://github.com/George-Jiang/arrows
@@ -614,10 +615,14 @@ sql = render_template('path/to/template.sql', table_name='my_table', date='2024-
 ```bash
 uv sync                      # install with every component
 uv run pytest                # unit tests, no credentials needed
-uv run ruff check src tests  # lint
+uv run ruff check .          # lint
+uv run ruff format .         # format; CI checks this
 uv run arrows doctor         # check real connectivity for what is configured
 ```
 
+Publishing a new version is
+[docs/RELEASING.md](https://github.com/George-Jiang/arrows/blob/main/docs/RELEASING.md).
+
 ## Notes
 
 1. **Load what you need**: `arrows.load(...)` fails fast on a missing credential; `arrows doctor` checks a real round-trip

{arrows-0.2.0 → arrows-0.2.2}/README.md

@@ -577,10 +577,14 @@ sql = render_template('path/to/template.sql', table_name='my_table', date='2024-
 ```bash
 uv sync                      # install with every component
 uv run pytest                # unit tests, no credentials needed
-uv run ruff check src tests  # lint
+uv run ruff check .          # lint
+uv run ruff format .         # format; CI checks this
 uv run arrows doctor         # check real connectivity for what is configured
 ```
 
+Publishing a new version is
+[docs/RELEASING.md](https://github.com/George-Jiang/arrows/blob/main/docs/RELEASING.md).
+
 ## Notes
 
 1. **Load what you need**: `arrows.load(...)` fails fast on a missing credential; `arrows doctor` checks a real round-trip

{arrows-0.2.0 → arrows-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arrows"
-version = "0.2.0"
+version = "0.2.2"
 description = "Universal data wrangling tool built around Apache Arrow, DuckDB, Polars, S3 for efficiently transferring and transforming data between different data sources with pluggable, independently loadable components"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -39,6 +39,7 @@ dependencies = [
     "pandas>=2.2",
     "polars>=1.44.2",
     "keyring>=25.0",
+    "redshift-connector>=2.1.16",
 ]
 
 [[project.authors]]

{arrows-0.2.0 → arrows-0.2.2}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "arrows"
-version = "0.2.0"
+version = "0.2.2"
 description = "Universal data wrangling tool built around Apache Arrow, DuckDB, Polars, S3 for efficiently transferring and transforming data between different data sources with pluggable, independently loadable components"
 readme = "README.md"
 authors = [
@@ -47,6 +47,7 @@ dependencies = [
     "polars>=1.44.2",
     # secret storage for login(save=True)
     "keyring>=25.0",
+    "redshift-connector>=2.1.16",
 ]
 
 [project.urls]

{arrows-0.2.0 → arrows-0.2.2}/src/arrows/components/aws.py

@@ -73,6 +73,7 @@ class AwsComponent(Component):
         self.boto3_session: Any = None
         self.region: str | None = None
         self._explicit_credentials = False
+        self._duckdb_credentials: tuple[str, str, str | None] | None = None
 
     def setup(self, secrets: SecretStore) -> None:
         boto3 = self.import_module('boto3')
@@ -104,6 +105,60 @@ class AwsComponent(Component):
         self.boto3_session = boto3.Session(**kwargs)
         self._register_duckdb_secret()
 
+    # -- credentials -------------------------------------------------------
+    def frozen_credentials(self) -> Any:
+        """The credentials to use *right now*, or ``None`` if there are none.
+
+        Every consumer has to ask for these at the moment of use rather than
+        keeping a copy. botocore hands back a refreshable credential object for
+        SSO, assumed roles and instance profiles, and ``get_frozen_credentials``
+        is what triggers the renewal when the current ones are near expiry. A
+        caller that froze them once is holding keys that stop working an hour
+        later, with no way to notice.
+        """
+        credentials = self.boto3_session.get_credentials() if self.boto3_session else None
+        return credentials.get_frozen_credentials() if credentials else None
+
+    def credential_provider(self):
+        """A Polars credential provider bound to this component's identity.
+
+        Without one, Polars builds a *fresh* ``boto3.Session()`` of its own and
+        resolves credentials from scratch. That session cannot see the arrows
+        SecretStore, so a profile or key supplied through ``login()``, ``.env``
+        or the keychain is invisible to it and it silently falls back to the
+        default profile — which is how a working DuckDB read sits next to a
+        Polars read failing on an expired SSO token.
+        """
+
+        def provider():
+            credentials = self.boto3_session.get_credentials() if self.boto3_session else None
+            if credentials is None:
+                raise RuntimeError('No AWS credentials resolved; cannot read from S3.')
+            # Freeze first: on a deferred credential object the expiry does not
+            # exist until the keys have actually been resolved.
+            frozen = credentials.get_frozen_credentials()
+            values = {'aws_access_key_id': frozen.access_key, 'aws_secret_access_key': frozen.secret_key}
+            if frozen.token is not None:
+                values['aws_session_token'] = frozen.token
+            expiry = getattr(credentials, '_expiry_time', None)
+            return values, int(expiry.timestamp()) if expiry is not None else None
+
+        return provider
+
+    def storage_options(self) -> dict[str, str]:
+        """Non-credential object-store settings for Polars."""
+        return {'aws_region': self.region} if self.region else {}
+
+    # -- duckdb ------------------------------------------------------------
+    def prepare_duckdb(self) -> None:
+        """Make sure DuckDB holds usable credentials before a query runs.
+
+        Cheap and idempotent while nothing has rotated, so callers can put it in
+        front of every S3 read and write.
+        """
+        if self._explicit_credentials:
+            self._register_duckdb_secret()
+
     def _register_duckdb_secret(self) -> None:
         """Give DuckDB the same identity boto3 resolved.
 
@@ -111,36 +166,43 @@ class AwsComponent(Component):
 
         * When boto3 resolved credentials from its own chain (profile, SSO,
           instance role), DuckDB is pointed at that same chain — no key material
-          is written into SQL, and DuckDB refreshes on its own.
+          is written into SQL, and DuckDB refreshes on its own. Registered once.
         * When the credentials came from the arrows SecretStore, DuckDB cannot
           see that store, so the keys have to be handed over as a literal
-          secret. They are then visible in ``duckdb_secrets()``, which is the
-          cost of that setup and a reason to prefer a real AWS profile.
+          secret. Those are a snapshot, so the secret is re-registered whenever
+          the underlying credentials change. They are visible in
+          ``duckdb_secrets()``, which is the cost of that setup and a reason to
+          prefer a real AWS profile.
 
         A failure here is not fatal: boto3 and pyarrow still work.
         """
         import warnings
 
-        credentials = self.boto3_session.get_credentials()
-        if credentials is None:
+        frozen = self.frozen_credentials()
+        if frozen is None:
             warnings.warn('No AWS credentials resolved; DuckDB S3 access is unconfigured.', stacklevel=2)
             return
 
         region = f', REGION {quote_literal(self.region)}' if self.region else ''
         if self._explicit_credentials:
-            frozen = credentials.get_frozen_credentials()
+            current = (frozen.access_key, frozen.secret_key, frozen.token)
+            if current == self._duckdb_credentials:
+                return
             token = f', SESSION_TOKEN {quote_literal(frozen.token)}' if frozen.token else ''
             body = (
                 f'TYPE s3, KEY_ID {quote_literal(frozen.access_key)}, '
                 f'SECRET {quote_literal(frozen.secret_key)}{token}{region}'
             )
         else:
+            current = None
             body = f'TYPE s3, PROVIDER credential_chain{region}'
 
         try:
             get_duckdb().execute(f'CREATE OR REPLACE SECRET arrows_s3 ({body});')
         except Exception as exc:
             warnings.warn(f'Could not register the DuckDB S3 secret: {exc}', stacklevel=2)
+            return
+        self._duckdb_credentials = current
 
     def client(self, service: str, **kwargs) -> Any:
         return self.boto3_session.client(service, **kwargs)
@@ -159,6 +221,7 @@ class AwsComponent(Component):
         with contextlib.suppress(Exception):
             get_duckdb().execute('DROP SECRET IF EXISTS arrows_s3;')
         self.boto3_session = None
+        self._duckdb_credentials = None
 
 
 COMPONENT = AwsComponent

{arrows-0.2.0 → arrows-0.2.2}/src/arrows/components/s3.py

@@ -17,6 +17,7 @@ class S3Component(Component):
     def __init__(self) -> None:
         super().__init__()
         self._filesystem: Any = None
+        self._filesystem_credentials: tuple[str, str, str | None] | None = None
         self.default_bucket: str | None = None
 
     def setup(self, secrets: SecretStore) -> None:
@@ -26,23 +27,32 @@ class S3Component(Component):
 
     @property
     def filesystem(self) -> Any:
-        """Lazily built :class:`pyarrow.fs.S3FileSystem` bound to the AWS session."""
-        if self._filesystem is None:
-            from pyarrow.fs import S3FileSystem
-
-            aws = self.session.get('aws')
-            credentials = aws.boto3_session.get_credentials()
-            frozen = credentials.get_frozen_credentials() if credentials else None
-            kwargs: dict[str, Any] = {}
-            if frozen is not None:
-                kwargs = {
-                    'access_key': frozen.access_key,
-                    'secret_key': frozen.secret_key,
-                    'session_token': frozen.token,
-                }
-            if aws.region:
-                kwargs['region'] = aws.region
-            self._filesystem = S3FileSystem(**kwargs)
+        """A :class:`pyarrow.fs.S3FileSystem` holding the current credentials.
+
+        pyarrow copies the keys at construction and never refreshes them, so a
+        filesystem cached for the life of the session stops working an hour into
+        an SSO or instance-role session. Rebuilding it when the credentials
+        change is the fix; constructing one is cheap and opens no connection.
+        """
+        from pyarrow.fs import S3FileSystem
+
+        aws = self.session.get('aws')
+        frozen = aws.frozen_credentials()
+        current = (frozen.access_key, frozen.secret_key, frozen.token) if frozen else None
+        if self._filesystem is not None and current == self._filesystem_credentials:
+            return self._filesystem
+
+        kwargs: dict[str, Any] = {}
+        if frozen is not None:
+            kwargs = {
+                'access_key': frozen.access_key,
+                'secret_key': frozen.secret_key,
+                'session_token': frozen.token,
+            }
+        if aws.region:
+            kwargs['region'] = aws.region
+        self._filesystem = S3FileSystem(**kwargs)
+        self._filesystem_credentials = current
         return self._filesystem
 
     def health_check(self) -> HealthStatus:
@@ -56,6 +66,7 @@ class S3Component(Component):
 
     def close(self) -> None:
         self._filesystem = None
+        self._filesystem_credentials = None
 
 
 COMPONENT = S3Component

{arrows-0.2.0 → arrows-0.2.2}/src/arrows/s3.py

@@ -30,6 +30,20 @@ def _component() -> Any:
     return _get_component('s3')
 
 
+def _aws() -> Any:
+    return _get_component('aws')
+
+
+def _duckdb() -> Any:
+    """The DuckDB connection, with its S3 credentials known to be current.
+
+    Mirrors ``arrows.google_sheets._duckdb``: credentials are refreshed at the
+    moment of use, never handed over once at load time.
+    """
+    _aws().prepare_duckdb()
+    return get_duckdb()
+
+
 def set_default_bucket_name(default_bucket_name: str) -> None:
     """Set the bucket used when a dataset is created without an explicit path."""
     from .core.session import default_session
@@ -89,6 +103,27 @@ class S3Dataset:
         """The pyarrow S3 filesystem owned by the ``s3`` component."""
         return _component().filesystem
 
+    @property
+    def _key(self) -> str:
+        """The path without its scheme.
+
+        pyarrow does not strip ``s3://`` when a filesystem is passed explicitly,
+        so handing it the URI would address a literal key named ``s3:``.
+        """
+        return self.s3_path[5:]
+
+    def _polars_options(self) -> dict[str, Any]:
+        """Credentials for Polars, taken from the ``aws`` component.
+
+        Polars otherwise builds its own ``boto3.Session()``, which cannot see
+        anything supplied through ``login()``, ``.env`` or the keychain.
+        """
+        aws = _aws()
+        return {
+            'credential_provider': aws.credential_provider(),
+            'storage_options': aws.storage_options() or None,
+        }
+
     def __repr__(self) -> str:
         return f'S3Dataset: {self.s3_path}'
 
@@ -97,16 +132,17 @@ class S3Dataset:
         if engine == 'pyarrow':
             import pyarrow.parquet as pq
 
-            return pq.read_table(self.s3_path)
+            return pq.read_table(self._key, filesystem=self.s3)
         return self.to_duckdb().to_arrow_table()
 
     def to_duckdb(self):
-        return get_duckdb().from_parquet(f'{self.s3_path}*.parquet')
+        return _duckdb().from_parquet(f'{self.s3_path}*.parquet')
 
     def to_polars(self, lazy: bool = False):
         import polars as pl
 
-        return pl.scan_parquet(self.s3_path) if lazy else pl.read_parquet(self.s3_path)
+        options = self._polars_options()
+        return pl.scan_parquet(self.s3_path, **options) if lazy else pl.read_parquet(self.s3_path, **options)
 
     # -- write -------------------------------------------------------------
     def from_arrow(self, arrow, engine: str = 'pyarrow') -> None:
@@ -114,19 +150,23 @@ class S3Dataset:
         if engine == 'pyarrow':
             import pyarrow.parquet as pq
 
-            pq.write_to_dataset(arrow, self.s3_path)
+            pq.write_to_dataset(arrow, self._key, filesystem=self.s3)
         else:
-            get_duckdb().execute(f"COPY arrow TO '{self.s3_path[:-1]}' (FORMAT parquet, FILE_SIZE_BYTES '1G')")
+            _duckdb().execute(f"COPY arrow TO '{self.s3_path[:-1]}' (FORMAT parquet, FILE_SIZE_BYTES '1G')")
 
     def from_polars(self, df) -> None:
         import polars as pl
 
         self.clear_contents()
-        partition_info = pl.PartitionMaxSize(base_path=self.s3_path, max_size=512_000)
+        # `PartitionMaxSize` was removed in the Polars version this package
+        # requires; `PartitionBy` without a key is the same thing — one file per
+        # 512k rows — and is what remains.
+        partition_info = pl.PartitionBy(self.s3_path, max_rows_per_file=512_000)
+        options = self._polars_options()
         if isinstance(df, pl.LazyFrame):
-            df.sink_parquet(partition_info)
+            df.sink_parquet(partition_info, **options)
         else:
-            df.write_parquet(partition_info)
+            df.write_parquet(partition_info, **options)
 
     def from_redshift(self, sql: str, **kwargs) -> None:
         from . import redshift
@@ -148,7 +188,7 @@ class S3Dataset:
         source = quote_literal(f'{self.s3_path}*.parquet')
         body = _parse_self_sql(rendered, 'self', 'temp_s3_dataset_table')
         # `source` is a quoted literal; `body` is the caller's own SQL.
-        return get_duckdb().sql(f'WITH temp_s3_dataset_table AS (SELECT * FROM {source})\n{body}')  # noqa: S608
+        return _duckdb().sql(f'WITH temp_s3_dataset_table AS (SELECT * FROM {source})\n{body}')  # noqa: S608
 
     def sql(self, sql: str, **kwargs):
         """Run SQL against a lazily scanned Polars frame of this dataset."""
@@ -156,13 +196,13 @@ class S3Dataset:
 
         df = self.to_polars(lazy=True)  # noqa: F841 - referenced by DuckDB replacement scan
         rendered = _parse_self_sql(Template(sql).render(**kwargs), 'self', 'df')
-        return get_duckdb().sql(rendered)
+        return _duckdb().sql(rendered)
 
     # -- lifecycle ---------------------------------------------------------
     def delete(self) -> None:
         from pyarrow.fs import FileType
 
-        path = self.s3_path[5:]
+        path = self._key
         file_type = self.s3.get_file_info(path).type
         if file_type == FileType.Directory:
             self.s3.delete_dir(path)
@@ -174,7 +214,7 @@ class S3Dataset:
     def clear_contents(self) -> None:
         from pyarrow.fs import FileType
 
-        path = self.s3_path[5:]
+        path = self._key
         if self.s3.get_file_info(path).type == FileType.Directory:
             self.s3.delete_dir_contents(path)
 

arrows-0.2.2/tests/test_s3_credentials.py

@@ -0,0 +1,229 @@
+"""Every S3 path must use the credentials the ``aws`` component resolved.
+
+The failure these guard against is quiet and asymmetric: a library left to find
+its own credentials (Polars builds its own ``boto3.Session``, pyarrow its own
+filesystem) cannot see the arrows SecretStore, so a DuckDB read succeeds while a
+Polars read fails on a stale profile. The second half of the problem is time —
+credentials handed over once stop working when they expire, so they have to be
+fetched at the moment of use.
+"""
+
+from __future__ import annotations
+
+import pyarrow as pa
+import pytest
+
+from arrows import s3
+from arrows.core.engine import reset_duckdb, set_duckdb
+from arrows.core.secrets import MappingProvider, SecretStore
+from arrows.core.session import Session
+
+
+class FakeFrozenCredentials:
+    def __init__(self, access_key: str, secret_key: str, token: str | None):
+        self.access_key = access_key
+        self.secret_key = secret_key
+        self.token = token
+
+
+class FakeCredentials:
+    """Stands in for botocore's refreshable credentials.
+
+    Like the real thing, the current keys are only visible through
+    ``get_frozen_credentials()``, and they can change between calls.
+    """
+
+    def __init__(self) -> None:
+        self.frozen = FakeFrozenCredentials('AKIA-first', 'secret-first', 'token-first')
+        self._expiry_time = None
+        self.calls = 0
+
+    def get_frozen_credentials(self) -> FakeFrozenCredentials:
+        self.calls += 1
+        return self.frozen
+
+    def rotate(self) -> None:
+        self.frozen = FakeFrozenCredentials('AKIA-second', 'secret-second', 'token-second')
+
+
+class FakeBoto3Session:
+    def __init__(self, credentials: FakeCredentials):
+        self._credentials = credentials
+
+    def get_credentials(self) -> FakeCredentials:
+        return self._credentials
+
+
+class FakeConnection:
+    """A DuckDB stand-in that only records what was executed."""
+
+    def __init__(self) -> None:
+        self.statements: list[str] = []
+
+    def execute(self, sql: str):
+        self.statements.append(sql)
+        return self
+
+    def from_parquet(self, glob: str):
+        self.statements.append(f'read_parquet({glob})')
+        return self
+
+    def secrets(self) -> list[str]:
+        return [s for s in self.statements if 'SECRET arrows_s3' in s]
+
+
+@pytest.fixture
+def loaded(monkeypatch):
+    """An s3 component whose AWS identity is a controllable fake."""
+    connection = FakeConnection()
+    set_duckdb(connection)
+    secrets = SecretStore(
+        [
+            MappingProvider(
+                {
+                    'AWS_ACCESS_KEY_ID': 'AKIA-first',
+                    'AWS_SECRET_ACCESS_KEY': 'secret-first',
+                    'AWS_SESSION_TOKEN': 'token-first',
+                    'AWS_REGION': 'us-east-1',
+                    'ARROWS_DEFAULT_BUCKET': 'demo-bucket',
+                },
+                name='m',
+            )
+        ]
+    )
+    session = Session(secrets=secrets)
+    credentials = FakeCredentials()
+    with session.activate():
+        session.load('s3')
+        session.get('aws').boto3_session = FakeBoto3Session(credentials)
+        yield session, credentials, connection
+    session.close()
+    reset_duckdb()
+
+
+# -- Polars ----------------------------------------------------------------
+def test_to_polars_passes_the_component_credentials(loaded, monkeypatch):
+    """Without this, Polars resolves credentials from a session of its own."""
+    import polars as pl
+
+    captured: dict = {}
+
+    def fake_read_parquet(source, **kwargs):
+        captured.update(source=source, **kwargs)
+        return 'frame'
+
+    monkeypatch.setattr(pl, 'read_parquet', fake_read_parquet)
+
+    assert s3.get_dataset('s3://demo-bucket/data/').to_polars() == 'frame'
+
+    provider = captured['credential_provider']
+    assert provider is not None, 'Polars was left to find its own credentials'
+    values, _expiry = provider()
+    assert values == {
+        'aws_access_key_id': 'AKIA-first',
+        'aws_secret_access_key': 'secret-first',
+        'aws_session_token': 'token-first',
+    }
+    assert captured['storage_options'] == {'aws_region': 'us-east-1'}
+
+
+def test_the_polars_provider_re_reads_credentials_on_every_call(loaded, monkeypatch):
+    """A provider that captured its keys once would break when they rotate."""
+    import polars as pl
+
+    captured: dict = {}
+    monkeypatch.setattr(pl, 'scan_parquet', lambda source, **kwargs: captured.update(kwargs) or 'lazy')
+
+    _session, credentials, _connection = loaded
+    s3.get_dataset('s3://demo-bucket/data/').to_polars(lazy=True)
+    provider = captured['credential_provider']
+
+    assert provider()[0]['aws_access_key_id'] == 'AKIA-first'
+    credentials.rotate()
+    assert provider()[0]['aws_access_key_id'] == 'AKIA-second'
+
+
+def test_from_polars_passes_credentials_too(loaded, monkeypatch):
+    """Also guards the partitioning API: it is built for real here.
+
+    `PartitionMaxSize` was removed in the Polars release this package requires,
+    which broke this method outright — an AttributeError before any credential
+    was ever consulted.
+    """
+    import polars as pl
+
+    captured: dict = {}
+    monkeypatch.setattr(
+        pl.DataFrame, 'write_parquet', lambda self, target, **kwargs: captured.update(target=target, **kwargs)
+    )
+    monkeypatch.setattr(s3.S3Dataset, 'clear_contents', lambda self: None)
+
+    s3.get_dataset('s3://demo-bucket/data/').from_polars(pl.DataFrame({'a': [1]}))
+
+    assert isinstance(captured['target'], pl.PartitionBy)
+    assert captured['credential_provider'] is not None
+    assert captured['storage_options'] == {'aws_region': 'us-east-1'}
+
+
+# -- pyarrow ---------------------------------------------------------------
+def test_to_arrow_reads_through_the_component_filesystem(loaded, monkeypatch):
+    """pyarrow would otherwise build a filesystem from its own credential chain."""
+    import pyarrow.parquet as pq
+
+    captured: dict = {}
+
+    def fake_read_table(source, **kwargs):
+        captured.update(source=source, **kwargs)
+        return pa.table({'a': [1]})
+
+    monkeypatch.setattr(pq, 'read_table', fake_read_table)
+
+    session, _credentials, _connection = loaded
+    s3.get_dataset('s3://demo-bucket/data/').to_arrow()
+
+    assert captured['filesystem'] is session.get('s3').filesystem
+    # pyarrow does not strip the scheme when given a filesystem: passing the URI
+    # would address a key literally named "s3:".
+    assert captured['source'] == 'demo-bucket/data/'
+
+
+def test_from_arrow_writes_through_the_component_filesystem(loaded, monkeypatch):
+    import pyarrow.parquet as pq
+
+    captured: dict = {}
+    monkeypatch.setattr(
+        pq, 'write_to_dataset', lambda table, root_path, **kwargs: captured.update(root_path=root_path, **kwargs)
+    )
+    monkeypatch.setattr(s3.S3Dataset, 'clear_contents', lambda self: None)
+
+    session, _credentials, _connection = loaded
+    s3.get_dataset('s3://demo-bucket/data/').from_arrow(pa.table({'a': [1]}))
+
+    assert captured['filesystem'] is session.get('s3').filesystem
+    assert captured['root_path'] == 'demo-bucket/data/'
+
+
+def test_the_filesystem_is_rebuilt_when_credentials_rotate(loaded):
+    """pyarrow copies the keys at construction and never refreshes them."""
+    session, credentials, _connection = loaded
+    component = session.get('s3')
+
+    first = component.filesystem
+    assert component.filesystem is first, 'unchanged credentials should not rebuild'
+
+    credentials.rotate()
+    assert component.filesystem is not first
+
+
+# -- DuckDB ----------------------------------------------------------------
+def test_the_duckdb_secret_follows_rotated_credentials(loaded):
+    """Explicit keys are a snapshot inside DuckDB; they have to be refreshed."""
+    _session, credentials, connection = loaded
+    before = len(connection.secrets())
+
+    s3.get_dataset('s3://demo-bucket/data/').to_duckdb()
+    assert len(connection.secrets()) == before, 'unchanged credentials should not re-register'
+
+    credentials.rotate()
+    s3.get_dataset('s3://demo-bucket/data/').to_duckdb()
+    assert connection.secrets()[-1].count('AKIA-second') == 1