code: func (s *Server) UpdateSecret(ctx context.Context, request *api.UpdateSecretRequest) (*api.UpdateSecretResponse, error) {
  	if request.SecretID == "" || request.SecretVersion == nil {
  		return nil, status.Errorf(codes.InvalidArgument, errInvalidArgument.Error())
  	}
  	var secret *api.Secret
  	err := s.store.Update(func(tx store.Tx) error {
  		secret = store.GetSecret(tx, request.SecretID)
  		if secret == nil {
  			return status.Errorf(codes.NotFound, "secret %s not found", request.SecretID)
  		}
  
  		// Check if the Name is different than the current name, or the secret is non-nil and different
  		// than the current secret
  		if secret.Spec.Annotations.Name != request.Spec.Annotations.Name ||
  			(request.Spec.Data != nil && subtle.ConstantTimeCompare(request.Spec.Data, secret.Spec.Data) == 0) {
  			return status.Errorf(codes.InvalidArgument, "only updates to Labels are allowed")
  		}
  
  		// We only allow updating Labels
  		secret.Meta.Version = *request.SecretVersion
  		secret.Spec.Annotations.Labels = request.Spec.Annotations.Labels
  
  		return store.UpdateSecret(tx, secret)
  	})
  	if err != nil {
  		return nil, err
  	}
  
  	log.G(ctx).WithFields(logrus.Fields{
  		"secret.ID":   request.SecretID,
  		"secret.Name": request.Spec.Annotations.Name,
  		"method":      "UpdateSecret",
  	}).Debugf("secret updated")
  
  	// WARN: we should never return the actual secret data here. We need to redact the private fields first.
  	secret.Spec.Data = nil
  	return &api.UpdateSecretResponse{
  		Secret: secret,
  	}, nil
  }
docs: // UpdateSecret updates a Secret referenced by SecretID with the given SecretSpec.
  // - Returns `NotFound` if the Secret is not found.
  // - Returns `InvalidArgument` if the SecretSpec is malformed or anything other than Labels is changed
  // - Returns an error if the update fails.