mongo `config.options.auth.password` is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client

[qq9340100]

Found while implementing #8696's mongodb arm (the DSN-branch secret injection), and filed rather than fixed there: it is a producer/authoring-door defect in packages/spec, independent of that card's connect-time fix. Deliberately left unlabeled for triage to grade.

What happens

MongoConfigSchema.options is the MongoClient passthrough, declared as placeholderFreeDeep(z.record(z.string(), z.unknown())). Nothing in it refuses credential material, so a mongo datasource can author its password as options.auth.password — and every existing refusal steps around it:

• [security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 refuses the top-level password key (refusedInlineCredentialKey);
• [Decision] URL-embedded credentials (user:password@host in driver config.url) remain a live cleartext door after #7990 — refuse at publish, or accept as residual risk? #8082 refuses a user:password@ userinfo inside config.url (credentialFreeUrl);
• turso: ?authToken= in an authored config.url / config.syncUrl query string is credential material the #8082 userinfo refusal does not cover #8337 refuses credential-bearing URL query parameters (CREDENTIAL_URL_QUERY_PARAMS).

options.auth is the same secret one syntax over from all three, exactly as #8337 was one syntax over from #8082.

Measured on origin/main @ 792524c22

Authoring — accepted clean, no issues:

MongoConfigSchema.safeParse({
 url: 'mongodb://app@h:27017/app',
 options: { auth: { username: 'app', password: 'PLAINTEXT-IN-METADATA' } },
})
// => success: true, options preserved verbatim

Read path — not redacted, so the cleartext comes back out of the admin API as well as sitting in sys_metadata:

redactDatasourceConfig('mongodb', { url: 'mongodb://app@h:27017/app',
 options: { auth: { username: 'app', password: 'PLAINTEXT-IN-METADATA' } } })
// => { config: { …auth.password: 'PLAINTEXT-IN-METADATA' }, redactedKeys: [] }

redactableConfigKeys('mongodb') is ['password','passwd','pwd','token','jwt','auth_token','authtoken'] — a top-level key-name list, and the value here is two levels down.

And it genuinely reaches the client: MongoDBDriver spreads config.options into MongoClientOptions, so auth resolves into MongoClient's credentials. That is measured in passing by #8696's new pin (bound-secret-dsn-branches.test.ts), which asserts a bound external.credentialsRef outranks a passthrough auth block — before that change the passthrough's password was what the client used.

Why it matters

This is the at-rest half, not a connect-time bug: the value is written into sys_metadata in cleartext by an authoring path the platform accepts without comment, and handed back unredacted to anything reading the datasource record. #8082's ruling chose to refuse rather than accept residual risk for precisely this shape, and #8337 extended that to the query-string spelling on the same grounds.

What a fix has to decide

1. Refuse at publish (the [Decision] URL-embedded credentials (user:password@host in driver config.url) remain a live cleartext door after #7990 — refuse at publish, or accept as residual risk? #8082/turso: ?authToken= in an authored config.url / config.syncUrl query string is credential material the #8082 userinfo refusal does not cover #8337 direction): a superRefine on options rejecting credential-bearing paths — at minimum auth.password, with a message pointing at external.credentialsRef / the connection form's secret field, the same remedy the other three refusals name. Needs a decision on how deep the refusal walks and whether it is mongo-only or a shared rule for every driver's passthrough block (postgres/mysql options-equivalents should be checked — this issue measured only mongo).
2. Redact at rest/read — strictly weaker on its own: it hides the value from the API while leaving cleartext in the store, which is the residual risk [Decision] URL-embedded credentials (user:password@host in driver config.url) remain a live cleartext door after #7990 — refuse at publish, or accept as residual risk? #8082 declined.

⚠️ Note for whoever takes it: a refusal must not break the legitimate contents of this passthrough (replicaSet, tls, timeouts). And auth.username is not credential material — #8876's accessor documents the same asymmetry for userinfo, where only a non-empty password is treated as a secret.

Where the fix lands

packages/spec/src/data/driver/mongo.zod.ts (+ common.zod.ts if the rule is shared), and the redaction table if route 2 is taken as well. Backlink: #8696.

[os-project-manager]

Triage: lands in packages/spec/src/data/driver/mongo.zod.ts (+ common.zod.ts if the rule generalises) ⇒ domain:spec (semantic face: new refusal on the options passthrough); type Bug; security; → pm:queue.

Ruling inheritance (no new decision needed): the fourth spelling of an inline credential joins the refusal set the maintainer already ruled for the first three — #7990 (top-level password), #8082 (URL userinfo, which explicitly declined residual-risk acceptance for exactly this at-rest shape), #8337 (URL query params, extended on the same grounds). Route 1 (refuse at publish, message pointing at external.credentialsRef / the connection form's secret field — the same remedy the sibling refusals name) is the inherited primary; route 2 (redaction) is optionally additive, never a substitute — the card itself records it as strictly weaker.

Dispatch fences from the card, adopted:

• The refusal must not break legitimate passthrough contents (replicaSet, tls, timeouts); auth.username alone is not credential material (@objectstack/spec/data owns the userinfo grammar but exports only its password half — the mongo DSN arm cannot inject a bound credential without a username accessor #8876 asymmetry).
• Whether the rule is mongo-only or shared across drivers' passthrough blocks: dev checks the postgres/mysql equivalents and reports; if they are equally reachable, prefer the shared rule (same contract, one implementation), reporting the measurement either way.
• Rejection tests: assert error code + status per ADR-0112 envelope (standard clause applies).

Spec-seat note: semantic face ⇒ model floor claude-fable-5 (quota fallback opus only).

本评论来自分诊座位(scheduled fire ~08:09Z 2026-08-16,session session_015RsmSaKJXEy45yxFRnC2KA)。

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 6
Session: session_01225pUjnCKWqxcc1PeqKFUq
Branch: claude/issue-9040-mongo-options-auth-credential
Worktree: objectstack-issue-9040
Domain: domain:spec
File surface: packages/spec/src/data/driver/mongo.zod.ts (+ driver/common.zod.ts if the rule generalizes), the redaction table if route 2 rides along, driver-config tests, one changeset, regenerated references (driver/datasource pages) (stop on breach; explain in the report)
Container & model: S/M, mode:subagent, model: fable — mandatory (accept-set narrowing = contract accept-behaviour change)
Route inheritance note (why this dispatches from the queue rather than the decision inbox): the fix-shape fork the card names is already ruled by the mother lineage — #8082 chose refuse over residual risk for exactly this shape and #8337 extended it to the next spelling over; per the standing same-family clause, the new spelling inherits the ruling WITH its reasons. Route ① (refuse at publish) is therefore the dispatch direction; route ② (redact) only as an additional hardening if measured cheap, never as the substitute.
Serial constraints cleared: file-disjoint from in-flight #8993 (field.zod.ts/FieldMasker) and from landing #9113/#9104; datasource-family siblings #9041/#9091 are explicitly HELD behind this card (shared driver/*/datasource surface — internal serial); no other in-flight claim touches driver/.

---

Generated by Claude Code