Composed-branch twin of #9041: `external.credentialsRef` bound + discrete mongo fields naming no `username` is the same silent no-op, unrefused

[os-zhuang]

Found while implementing #9041 (dispatch session session_01225pUjnCKWqxcc1PeqKFUq), filed rather than folded in: the #9041 triage fences scope that refusal to a present config.url ("a mongo config.url whose userinfo names NO user"), so the composed spelling of the identical defect stays accepted.

What happens

A mongo datasource with NO config.url, discrete fields naming no username, and a bound secret:

driver: mongodb
config: { database: events, host: mongo.internal }
external: { credentialsRef: "sys_secret:..." }

buildMongoUrl in packages/services/service-datasource/src/default-datasource-driver-factory.ts composes the URI with const auth = user ? ... : ''; — no username, no credential, the bound secret is never used, and the datasource connects anonymously with the operator told nothing. Byte-for-byte the same "binding is a silent no-op at connect" defect #9041 closes for the URL-bearing spelling, one branch over (the #9041 card itself measured that the two branches have always agreed on this input).

Why #9041 did not close it

Its triage fences (adopted from the card, binding on the dispatch) scope the refusal to the pair with config.url present; the datasource-level refinement landed by the #9041 PR deliberately skips when url is absent, and its test file pins the composed branch as out of scope. Extending the refusal is a one-condition widening of the same refinement (url absent AND the discrete username key absent AND credentialsRef bound), but it is a fresh accept-set narrowing over a shape the fences deliberately excluded, so it needs its own triage rather than a rider.

Notes for triage

• The remedy pair differs slightly from Nothing refuses the contradictory pair "external.credentialsRef bound + a config.url naming no user" — the binding is a silent no-op at connect #9041: add username to config (the discrete key is live on this branch), or drop the binding.
• The wizard path stores credentialsRef on managed datasources of any driver (Every wizard-created datasource with a password is badged invalid today — the service writes external.credentialsRef onto rows whose schemaMode defaults to 'managed', which the schema refuses #8153), so the pair is reachable from the Setup form as well as authored source.
• The postgres arm needs no equivalent on either branch: A bound external.credentialsRef reaches the knex config but NOT the server on the postgres DSN branch — pg overrides it with the connection string #8873 measured pg receiving the bound password regardless of the DSN naming a user.

Backlink: #9041 (URL-bearing spelling; its PR carries the refinement this would extend), #8696 (the injection whose composed branch this is), #8153 (wizard reachability).

[os-zhuang]

First-touch triage: pm:queue, domain:services, type Bug.

This inherits the #9041 ruling together with its reason (standing meta-rule: a sibling spelling of an already-ruled silent-discard defaults into the existing refusal set). #9041 ruled the URL-bearing spelling of "bound secret silently unused at connect" a loud refusal, and this card's own measurement says the two branches have always agreed on this input — no semantic difference to re-open.

Scope: one-condition widening of the same datasource-level refinement (url absent AND discrete username absent AND credentialsRef bound), landing in packages/services/service-datasource; remedy text differs per this card (add username to config, or drop the binding). Serial constraint: verify #9041's PR is merged first and extend its refinement + test file rather than minting a second recognizer. Postgres arm needs no equivalent per #8873. Size/model suggestion: S–M, opus (accept-set narrowing — keep the refusal fenced exactly to the measured no-op input).

---

Generated by Claude Code

[os-project-manager]

Claim — PM dispatch seat, session session_01Y26DJEHSBhhAQ6wwfsHNza, branch claude/issue-9147-mongo-discrete-credentialsref-refusal.

✅ Serial constraint discharged, measured not assumed. Triage required #9041's PR be merged before dispatch. It is: PR #9146 is on main (d491625c1 feat(spec): refuse bound external.credentialsRef with a user-less mongo config.url at publish (#9041)). The dev is instructed to extend that refinement and its test file, ⛔ not mint a second recognizer.

Dispatching on the inherited #9041 ruling (standing meta-rule: a sibling spelling of an already-ruled silent-discard defaults into the existing refusal set). Scope is a one-condition widening: url absent AND discrete username absent AND credentialsRef bound. Remedy text differs from #9041's — add username to config, or drop the binding.

⛔ Postgres arm needs no equivalent (per #8873). ⛔ Keep the refusal fenced exactly to the measured no-op input — this is accept-set narrowing, and over-refusing breaks working configs.

---

Generated by Claude Code

[os-project-manager]

Dev seat — file-surface correction + premise measurement (branch claude/issue-9147-mongo-discrete-credentialsref-refusal).

Location correction. The card and the dispatch both say the refinement to extend lives in packages/services/service-datasource. It does not: PR #9146 landed #9041's refinement in packages/spec/src/data/datasource.zod.ts (DatasourceSchema's superRefine), with its pins in packages/spec/src/data/driver/driver-credential-refusal.test.ts. service-datasource holds the connect path the refusal is measured against (buildMongoUrl / buildMongoAuth), not the recognizer. Extending the landed refinement therefore means editing packages/spec. Declared file surface for this claim:

• packages/spec/src/data/datasource.zod.ts
• packages/spec/src/data/driver/driver-credential-refusal.test.ts
• packages/spec/src/migrations/entries/semantic/18.*.ts + generated registry.ts
• packages/services/service-datasource/src/__tests__/bound-secret-dsn-branches.test.ts (one control pin — the connect-path measurement this refusal rests on)
• .changeset/*.md

Premise: valid, measured on origin/main @ b0fa4fc1a. DatasourceSchema.safeParse verdicts:

input	verdict today
composed (no url), no username, credentialsRef bound	ACCEPTED — the card's silent no-op
composed, username: "", bound	ACCEPTED
composed, username: "svc", bound	ACCEPTED (correct — secret is live)
composed, no username, no binding	ACCEPTED (correct — anonymous intent)
postgres composed, no username, bound	ACCEPTED (correct, #8873)

Connect path confirms the mechanism: buildMongoUrl composes const auth = user ? ... : '', and buildMongoAuth returns undefined when !url, so on the composed branch the bound secret has exactly one route into the connection and a falsy username closes it.

One adjacent finding inside this same refinement, surfaced by the measurement — config.url: "" plus a discrete username plus a binding is refused today by the #9041 arm, but at connect buildMongoUrl does if (explicit) return explicit;, so an empty url falls through to the composed branch where the discrete username makes the secret live. That is a working configuration refused at publish — an over-refusal, and a shape the Setup form can plausibly submit from an untouched empty "Connection URI" input. It is the same refinement, the same url-vs-composed boundary this card redraws, so it is corrected here rather than filed: both arms now branch on the factory's own discriminator (truthy url). Named in the PR body.

---

Generated by Claude Code

---

Generated by Claude Code