From dc9e54ed7c6d4dd53543a23cce8e6963550f16d4 Mon Sep 17 00:00:00 2001
From: Michael Harris <mharris@definite.app>
Date: Fri, 20 Feb 2026 14:29:55 -0700
Subject: [PATCH 1/2] fix(secrets): use static cast

---
 src/utils/secret.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/utils/secret.cpp b/src/utils/secret.cpp
index 7f7fd57..ca38bbb 100644
--- a/src/utils/secret.cpp
+++ b/src/utils/secret.cpp
@@ -19,7 +19,7 @@ const KeyValueSecret *GetGSheetSecret(ClientContext &ctx) {
 		return nullptr;
 	}
 	auto &secret = match.GetSecret();
-	return dynamic_cast<const KeyValueSecret *>(&secret);
+	return static_cast<const KeyValueSecret *>(&secret);
 }
 
 } // namespace sheets

From 1a966167f23779c9a253a96c4a12f24ffa77f0f2 Mon Sep 17 00:00:00 2001
From: Michael Harris <mharris@definite.app>
Date: Fri, 20 Feb 2026 14:38:38 -0700
Subject: [PATCH 2/2] fix(secrets): inline secret access

---
 src/include/utils/secret.hpp |  2 --
 src/sheets/auth_factory.cpp  | 41 ++++++++++++++++++------------------
 src/utils/secret.cpp         | 10 ---------
 3 files changed, 21 insertions(+), 32 deletions(-)

diff --git a/src/include/utils/secret.hpp b/src/include/utils/secret.hpp
index d8c7a1b..f374de1 100644
--- a/src/include/utils/secret.hpp
+++ b/src/include/utils/secret.hpp
@@ -1,14 +1,12 @@
 #pragma once
 
 #include "duckdb/main/client_context.hpp"
-#include "duckdb/main/secret/secret.hpp"
 #include "duckdb/main/secret/secret_manager.hpp"
 
 namespace duckdb {
 namespace sheets {
 
 const SecretMatch GetSecretMatch(ClientContext &ctx, const std::string &path, const std::string &type);
-const KeyValueSecret *GetGSheetSecret(ClientContext &ctx);
 
 } // namespace sheets
 } // namespace duckdb
diff --git a/src/sheets/auth_factory.cpp b/src/sheets/auth_factory.cpp
index 1d97094..c765d18 100644
--- a/src/sheets/auth_factory.cpp
+++ b/src/sheets/auth_factory.cpp
@@ -8,28 +8,29 @@ namespace duckdb {
 namespace sheets {
 
 std::unique_ptr<IAuthProvider> CreateAuthFromSecret(ClientContext &ctx, IHttpClient &http) {
-	auto *secret = GetGSheetSecret(ctx);
-	if (!secret) {
-		return nullptr;
-	}
-
-	auto provider = secret->GetProvider();
-	if (provider == "key_file") {
-		Value emailValue, keyValue;
-		if (!secret->TryGetValue("email", emailValue)) {
-			throw InvalidInputException("'email' not found in gsheet secret");
-		}
-		if (!secret->TryGetValue("secret", keyValue)) {
-			throw InvalidInputException("'secret' not found in gsheet secret");
-		}
-		return make_uniq<ServiceAccountAuth>(http, emailValue.ToString(), keyValue.ToString());
-	} else {
-		Value tokenValue;
-		if (!secret->TryGetValue("token", tokenValue)) {
-			throw InvalidInputException("'token' not found in gsheet secret");
+	auto match = GetSecretMatch(ctx, "gsheet", "gsheet");
+	if (match.HasMatch()) {
+		auto &secret = match.GetSecret();
+		auto gsheet_secret = dynamic_cast<const KeyValueSecret *>(&secret);
+		auto provider = gsheet_secret->GetProvider();
+		if (provider == "key_file") {
+			Value emailValue, keyValue;
+			if (!gsheet_secret->TryGetValue("email", emailValue)) {
+				throw InvalidInputException("'email' not found in gsheet secret");
+			}
+			if (!gsheet_secret->TryGetValue("secret", keyValue)) {
+				throw InvalidInputException("'secret' not found in gsheet secret");
+			}
+			return make_uniq<ServiceAccountAuth>(http, emailValue.ToString(), keyValue.ToString());
+		} else {
+			Value tokenValue;
+			if (!gsheet_secret->TryGetValue("token", tokenValue)) {
+				throw InvalidInputException("'token' not found in gsheet secret");
+			}
+			return make_uniq<BearerTokenAuth>(tokenValue.ToString());
 		}
-		return make_uniq<BearerTokenAuth>(tokenValue.ToString());
 	}
+	return nullptr;
 }
 
 } // namespace sheets
diff --git a/src/utils/secret.cpp b/src/utils/secret.cpp
index ca38bbb..f833b61 100644
--- a/src/utils/secret.cpp
+++ b/src/utils/secret.cpp
@@ -1,6 +1,5 @@
 #include "utils/secret.hpp"
 
-#include "duckdb/main/secret/secret.hpp"
 #include "duckdb/main/secret/secret_manager.hpp"
 #include "duckdb/catalog/catalog_transaction.hpp"
 
@@ -13,14 +12,5 @@ const SecretMatch GetSecretMatch(ClientContext &ctx, const std::string &path, co
 	return manager.LookupSecret(transaction, path, type);
 }
 
-const KeyValueSecret *GetGSheetSecret(ClientContext &ctx) {
-	auto match = GetSecretMatch(ctx, "gsheet", "gsheet");
-	if (!match.HasMatch()) {
-		return nullptr;
-	}
-	auto &secret = match.GetSecret();
-	return static_cast<const KeyValueSecret *>(&secret);
-}
-
 } // namespace sheets
 } // namespace duckdb