[Decision] URL-embedded credentials (`user:password@host` in driver `config.url`) remain a live cleartext door after #7990 — refuse at publish, or accept as residual risk?

[huangyiirene]

Escalated from PR #8078's dev report (#7990 comment 5268367568, open question 1) by the domain:spec PM seat (session session_0123k4cam2jEAkPmbJeoaY3r). On the manual floor: refusing URL userinfo is an accept-set change to a published authoring surface, and the legitimate-DSN-workflow carve-out is a product call.

Background

#7990's ruled Option A (PR #8078) refuses inline config.password / config.authToken on all four SQL/NoSQL driver config schemas, diverting authors to the secret binder / external.credentialsRef. Measured during that implementation and pinned as a FACT (in driver-credential-refusal.test.ts, deliberately asserting today's acceptance): config.url admits postgresql://user:password@host/db on all four drivers, and that URL lands in sys_metadata cleartext exactly as config.password did. The refused key has a one-syntax-over workaround, and the schema prose even documents the URL's password segment.

Premise re-check commands

• git grep -n "user\[:password\]" origin/main -- packages/spec/src/data/driver/postgres.zod.ts (the documented URL format)
• The pinned acceptance test: git grep -n "url" origin/main -- packages/spec/src/data/driver/driver-credential-refusal.test.ts (post-feat(spec)!: refuse inline credentials at publish — driver config + connector authoring door (#7990, spec half) #8078 merge)

Question

Should publish-time validation refuse a driver config.url carrying userinfo credentials?

Options

• A — refuse URL userinfo at publish (value-level parse on config.url; guidance: move the password to the binder / credentialsRef, keep the URL credential-free). Closes the workaround loudly. ⚠️ Cost: DSN-style workflows (OS_DATABASE_URL-shaped single-string configs) are a common ops pattern; authored-metadata refusal must not break URLs that arrive via runtime environment rather than authored metadata — the carve-out line needs your word. Note (measured, feat(spec)!: refuse inline credentials at publish — driver config + connector authoring door (#7990, spec half) #8078): ${…} placeholders in authored metadata resolve to nothing — they reach the client verbatim — so "put a placeholder in the URL" is not a working escape today.
• B — accept as documented residual risk: keep the pin, document the door in the security posture docs, revisit if measured in the wild.
• C — fold into the services half (The 400 that four comments cite as the $searchFields half of the __search contract is asserted by no test #8080-scope): scrub userinfo at the write door instead of the contract (value rewriting or refusal at datasource-admin), leaving the spec accept-set unchanged.

Four-lens

1. 实际业务需求 — the door is live and measured on all four drivers; it is the exact sink the maintainer just ruled worth closing, one syntax over. But no in-repo or reported author writes credentials in authored URLs today (census found none), so the pull is preventive, not remedial.
2. 项目长远合理性 — leaving the workaround open makes the [security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 closure structurally incomplete: the next refused author (or AI) gets steered to the URL form by the refusal itself. A publish-time value check is one rule at the same contract; a write-door scrub (C) is a second, drifting copy of the policy.
3. 防 AI 写错 — strongest is A: an AI author refused on config.password will otherwise "fix" the error by moving the secret into the URL — silently succeeding, which is the masked-failure shape this programme exists to kill. The refusal message can teach the correct split (URL without userinfo + ref for the secret).
4. 创业阶段收缩 — A is bounded (one value-level check shared by four schemas, guidance text reused). Its only real cost is the DSN carve-out decision, which is precisely the part that cannot be a dev default.

Recommendation

A, premised on your ruling of the carve-out: authored metadata refuses URL userinfo; runtime-environment-provided URLs (not authored, never stored in sys_metadata) stay out of the contract's reach. If you would rather not spend the carve-out decision now, B with the pin kept is honest and cheap — ⛔ not C (a second policy copy at a different layer).

Refs: #7990 (ruling + report), PR #8078 (the pinned fact), #8075 (further census).

[hotlong]

Maintainer ruling — 2026-08-12 (live PM chat, session_01GxKQfv3k8b6a2d2QrZU411; maintainer sam, verbatim: 「接受你的全部建议。」 accepting the decision-box analysis in full). Moved out of the decision box → pm:queue.

Ruling: option A — refuse URL userinfo at publish, via a value-level parse shared by the four driver schemas. Carve-out line: runtime-environment DSNs do not pass through the publish door, so they are unaffected by construction — state that explicitly in the refusal's docs rather than leaving it implied. ⛔ Option C (scrub at the services write door) stays rejected — a second, drifting copy of the policy. Option B (document as residual risk) was honest but loses口径 consistency with #7990's per-artefact contract closure.

Ruled together with #8103 under one template — close the forward door, then remediate existing material by explicit action. Here the forward door is the publish refusal; #8126 (37b82ed) already narrowed the read exposure today, so no separate remediation sweep is called for on this card.

⚠️ Binding detail: fix or same-batch the placeholder escape. #8078 measured that ${…} placeholders reach the client verbatim, so "use a placeholder instead" does not work today — a refusal message that steers authors (or an AI) toward a broken escape recreates the masked-failure shape this programme exists to kill. The acceptance pin at driver-credential-refusal.test.ts:166-171 (recording today's acceptance as a FACT) must be inverted to a rejection pin asserting code + status — not deleted. Spec semantic lane ⇒ claude-fable-5. Unblocks progress on #7990's parked boundary-guard trigger; #8075's census feeds it.

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 1 (expanded batch — maintainer 2026-08-13: 「任务很多,加速处理」)
Session: session_01Euoy6wyfzgiWtgCg4s6JK2
Branch: claude/issue-8082-url-userinfo-publish-refusal
Worktree: objectstack-issue-8082
Domain: domain:spec
File surface: packages/spec/src/data/driver/** (the four driver config schemas + a shared value-level URL parse), packages/spec/src/data/driver/driver-credential-refusal.test.ts (acceptance pin at :166-171 inverted to a rejection pin, ⛔ not deleted), packages/spec/src/data/datasource.zod.ts only if the shared parse hooks there; changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 (mandatory clause — narrows the accept set)
Serial constraints cleared: no in-flight claim touches packages/spec/src/data/driver/** (in-flight this lane: #8010 → ui/view.zod.ts, #8124 → api/errors.zod.ts + types + rest, #7917 → read-only; surface seat #8201/#8202 → ui/+shared/editability + data/field.zod.ts SelectOption block only). Predecessor PRs on this surface all merged: #8078 (#7990 spec half), #8126 (37b82ed). Premise re-verified on origin/main today: driver-credential-refusal.test.ts exists at the claimed path; maintainer ruling (option A) recorded on-card 2026-08-12.

---

Generated by Claude Code