Uh oh!
There was an error while loading. Please reload this page.
feat(spec): allow external.credentialsRef (and only it) on schemaMode 'managed' - #8588
Merged
qq9340100 merged 2 commits intoAug 14, 2026
Merged
Conversation
… 'managed' Maintainer ruling on #8153: the Studio wizard's createDatasource writes external.credentialsRef onto rows whose schemaMode defaults to 'managed', so the refinement now exempts the credentials reference while still refusing every federation key. The check judges effective federation content against the parsed-empty baseline (values, not key presence) so re-parses of served output — which materialize every default key — stay valid. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012MNV7ZSCjNfA38eDCjsXQL
…naged credentialsRef allowance Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012MNV7ZSCjNfA38eDCjsXQL
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 106 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 7 release-owned page(s) also reference the affected code. These are read-only:
|
qq9340100
marked this pull request as ready for review
August 14, 2026 00:35
Uh oh!
There was an error while loading. Please reload this page.
qq9340100
deleted the
claude/issue-8153-managed-credentialsref-allowance
branch
August 14, 2026 00:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#8153
Implements the maintainer ruling (issue comment 5278874735, 2026-08-13): allow
external.credentialsRef— and only it — on aschemaMode: 'managed'datasource; keep refusing every federation key on managed. Blanket-allowingexternaland re-homing the ref were both rejected by the ruling and are not done here.What changed
packages/spec/src/data/datasource.zod.ts— theschemaMode === 'managed' && externalrefinement now refuses only when the block carries effective federation content: anyexternalkey other thancredentialsRefwhose parsed value differs from the parsed-empty defaults. The refusal keeps the existing guidance sentence and now names the offending keys.PUT /metaround-trip of served output) legitimately carries every default key (allowWrites: false,validation,queryTimeoutMs: 30000). Refusing on key presence would 422 the exact round-trip this allowance exists to keep valid. An explicitly-written default is byte-equal to an applied one and semantically inert either way; any non-default federation value still refuses. The enforcement point stays parse-time (schema/diagnostics/meta write path) — nothing assumes the connect path re-parses.createDatasourcewrites ({name, config: {host, database, username}, origin: 'runtime', external: {credentialsRef: 'sys_secret:…'}}, noschemaMode) parses valid, and its parsed output re-parses valid (round-trip);allowWrites,allowedSchemas, non-defaultvalidation,queryTimeoutMs) andcredentialsRef+ federation key together still refuses, naming the federation key;schemaMode: 'external'keeps today's fullexternalacceptance (pinned at DatasourceSchema level);computeMetadataDiagnostics('datasource', wizardRow)— the card's measurement — now returns{valid: true}(new test inpackages/metadata-protocol), and the federation shape still badges invalid at pathexternal.content/docs/references/data/datasource.mdx(describe-string changes);api-surfaceregenerated and proved byte-identical (no export changes).@objectstack/specminor (accept-set widening, one key).Verification
@objectstack/specsuite: 397 files / 10527 tests passed.@objectstack/metadata-protocol: 86 files / 1263 passed (includes the new diagnostics pin — which can only pass against the rebuilt spec dist, proving the consumer read the new schema).@objectstack/service-datasource(the writer of the shape): 16 files / 376 passed. Typecheck green on all three.datasource.test.ts.check:generatedfully green (13/13 artifacts current); all 17 path/convention-derived gate families pass locally.Sequencing
Unblocks: #8155 (#8081 item 3's credential migration — its
Blocked-byclears when this merges). That migration writesexternal.credentialsRefonto existing managed rows; the round-trip pin above proves that output shape now re-parses valid, which is the property the migration was parked on. #8155 remains open and is not addressed here.Generated by Claude Code