From 2fc088d06d956da0de9634e2adab3c76749435e9 Mon Sep 17 00:00:00 2001
From: Graham Hukill <ghukill@gmail.com>
Date: Thu, 14 Aug 2025 11:27:35 -0400
Subject: [PATCH 1/2] Install HTTPFS extension in DuckDB context

---
 timdex_dataset_api/metadata.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/timdex_dataset_api/metadata.py b/timdex_dataset_api/metadata.py
index bfe3697..670ff7e 100644
--- a/timdex_dataset_api/metadata.py
+++ b/timdex_dataset_api/metadata.py
@@ -161,6 +161,14 @@ def _configure_duckdb_s3_secret(
         If a scope is provided, e.g. an S3 URI prefix like 's3://timdex', set a scope
         parameter in the config.  Else, leave it blank.
         """
+        # install httpfs extension
+        conn.execute(
+            """
+            install httpfs;
+            load httpfs;
+            """
+        )
+
         # establish scope string
         scope_str = f", scope '{scope}'" if scope else ""
 

From 5b56965c68d2fc8fbb4037e0705cf0c4089365ce Mon Sep 17 00:00:00 2001
From: Graham Hukill <ghukill@gmail.com>
Date: Thu, 14 Aug 2025 13:03:44 -0400
Subject: [PATCH 2/2] Omit chain from DuckDB S3 secret

Why these changes are being introduced:

It sounds like the best option for ECS tasks is using 'instance'
as the provider chain type, where for local dev and/or lambdas
it might be 'sso' or 'env'.  Not having 'instance' appears to cause
failures in the ECS task.

How this addresses that need:

By omitting the 'chain' option entirely from DuckDB secret creation
we allow the default provider chain to take effect.  Given our fairly
normal usage of DuckDB and S3, this is probably the best approach.

Side effects of this change:
* DuckDB to S3 connections work in ECS

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/TIMX-540
---
 timdex_dataset_api/metadata.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/timdex_dataset_api/metadata.py b/timdex_dataset_api/metadata.py
index 670ff7e..1b9506d 100644
--- a/timdex_dataset_api/metadata.py
+++ b/timdex_dataset_api/metadata.py
@@ -194,7 +194,6 @@ def _configure_duckdb_s3_secret(
                 create or replace secret aws_s3_secret (
                     type s3,
                     provider credential_chain,
-                    chain 'sso;env;config',
                     refresh true
                     {scope_str}
                 );