should be it

external/duckdb/test/sql/secrets/create_secret_expression.test

@@ -0,0 +1,31 @@
+# name: test/sql/secrets/create_secret_expression.test
+# description: Test secrets with expressions as params
+# group: [secrets]
+
+require noforcestorage
+
+statement ok
+PRAGMA enable_verification;
+
+statement ok
+CREATE TABLE bearer_tokens AS SELECT 'blablab'
+
+statement ok
+SET VARIABLE my_bearer_token='hocus pocus this token is bogus';
+
+statement ok
+CREATE SECRET http (TYPE HTTP, BEARER_TOKEN getvariable('my_bearer_token'));
+
+query I
+SELECT secret_string.split(';')[-1] FROM duckdb_secrets() where name='http';
+----
+bearer_token=hocus pocus this token is bogus
+
+# Test "old" syntax from before expressions were allowed
+statement ok
+CREATE SECRET scope_as_struct (TYPE HTTP, BEARER_TOKEN some_field, scope ('hi', 'hello'));
+
+query I
+select scope from duckdb_secrets() where name='scope_as_struct'
+----
+[hi, hello]

external/duckdb/test/sql/secrets/create_secret_hffs_autoload.test

@@ -0,0 +1,37 @@
+# name: test/sql/secrets/create_secret_hffs_autoload.test
+# description: Test huggingface secrets autoload
+# group: [secrets]
+
+require no_extension_autoloading "EXPECTED: Test relies on autoloading being disabled"
+
+statement ok
+PRAGMA enable_verification;
+
+statement ok
+set allow_persistent_secrets=false;
+
+statement error
+CREATE SECRET hf1 (
+	TYPE HUGGINGFACE,
+    TOKEN 'bla'
+)
+----
+Secret type 'huggingface' does not exist, but it exists in the httpfs extension.
+
+statement error
+CREATE SECRET hf1 (
+	TYPE HUGGINGFACE,
+	PROVIDER config,
+    TOKEN 'bla'
+)
+----
+Secret provider 'config' for type 'huggingface' does not exist, but it exists in the httfps extension.
+
+# Cache provider will automatically try to fetch the token from the cache
+statement error
+CREATE SECRET hf2 (
+	TYPE HUGGINGFACE,
+    PROVIDER 'credential_chain'
+)
+----
+Secret provider 'credential_chain' for type 'huggingface' does not exist, but it exists in the httpfs extension.

external/duckdb/test/sql/secrets/create_secret_persistence_no_client_context.test

@@ -0,0 +1,28 @@
+# name: test/sql/secrets/create_secret_persistence_no_client_context.test
+# description: Test using secret manager in a codepath where no ClientContext is available
+# group: [secrets]
+
+load __TEST_DIR__/create_secret_persistence_no_client_context.db
+
+statement ok
+PRAGMA enable_verification;
+
+statement ok
+set secret_directory='__TEST_DIR__/create_secret_persistence_no_client_context'
+
+# Create an empty HTTP type secret
+statement ok
+CREATE PERSISTENT SECRET s1 ( TYPE HTTP )
+
+restart
+
+statement ok
+set secret_directory='__TEST_DIR__/create_secret_persistence_no_client_context'
+
+# Try to install a fake extensions from some bogus url.
+# This will trigger Secret manager initialization in a way where there is no ClientContext available
+# if secret manager is correctly initialized the request will happen and return the correct error. 
+statement error
+INSTALL bogus FROM 'http://not.existent';
+----
+Failed to download extension

external/duckdb/test/sql/secrets/secret_autoloading_errors.test

@@ -0,0 +1,35 @@
+# name: test/sql/secrets/secret_autoloading_errors.test
+# description: Test that error messages for secret manager makes sense
+# group: [secrets]
+
+require no_extension_autoloading "EXPECTED: Tests failures on loading extensions
+
+statement error
+CREATE SECRET (TYPE S3)
+----
+Secret type 's3' does not exist, but it exists in the httpfs extension.
+
+statement error
+CREATE SECRET (TYPE S3, PROVIDER CONFIG)
+----
+Secret provider 'config' for type 's3' does not exist, but it exists in the httpfs extension.
+
+statement error
+CREATE SECRET (TYPE S3, PROVIDER CREDENTIAL_CHAIN)
+----
+Secret provider 'credential_chain' for type 's3' does not exist, but it exists in the aws extension.
+
+statement error
+CREATE SECRET (TYPE AZURE)
+----
+Secret type 'azure' does not exist, but it exists in the azure extension.
+
+statement error
+CREATE SECRET (TYPE AZURE, PROVIDER CONFIG)
+----
+Secret provider 'config' for type 'azure' does not exist, but it exists in the azure extension.
+
+statement error
+CREATE SECRET (TYPE AZURE, PROVIDER CREDENTIAL_CHAIN)
+----
+Secret provider 'credential_chain' for type 'azure' does not exist, but it exists in the azure extension.

external/duckdb/test/sql/secrets/secret_compatibility_http.test

@@ -0,0 +1,16 @@
+# name: test/sql/secrets/secret_compatibility_http.test
+# description: Test secret compatibility across versions
+# group: [secrets]
+
+require-env TEST_PERSISTENT_SECRETS_AVAILABLE
+
+# Ensure any currently stored secrets don't interfere with the test
+statement ok
+set secret_directory='./data/secrets/http'
+
+query IIIIIII
+from duckdb_secrets();
+----
+http_v_1_1_0	http	config	true	local_file	[]	name=http_v_1_1_0;type=http;provider=config;serializable=true;scope;extra_http_headers={Authorization=Bearer sk_test_VePHdqKTYQjKNInc7u56JBrQ}
+http_v_1_1_2	http	config	true	local_file	[]	name=http_v_1_1_2;type=http;provider=config;serializable=true;scope;extra_http_headers={Authorization=Bearer sk_test_VePHdqKTYQjKNInc7u56JBrQ}
+http_v_1_1_3	http	config	true	local_file	[]	name=http_v_1_1_3;type=http;provider=config;serializable=true;scope;extra_http_headers={Authorization=Bearer sk_test_VePHdqKTYQjKNInc7u56JBrQ}