Skip to content

fix(spec): correct mongo options describe string to state the real refusal boundary#9277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-steve merged 1 commit into from
Aug 17, 2026
+22 −2
Merged

fix(spec): correct mongo options describe string to state the real refusal boundary #9277

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .changeset/mongo-options-describe-boundary.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
"@objectstack/spec": patch
---

fix(spec): correct `MongoConfigSchema.options`'s field description to state the actual refusal boundary — only `auth.password` is refused inline; `proxyPassword`, `tlsCertificateKeyFilePassword`, `key`, and `passphrase` are accepted, stored at rest in cleartext, and redacted only on read (#9254)

The old string claimed "credential material is refused" for the whole `options`
passthrough. That was true for exactly one nested path
(`options.auth.password`, `MONGO_OPTIONS_CREDENTIAL_PATHS` / #9040) — four
other honoured, credential-shaped keys were never refused, only redacted when
a datasource is read back (`PASSTHROUGH_SECRET_PATHS` in
`datasource-credential-redaction.ts`). This string renders verbatim into
`content/docs/references/data/driver-mongo.mdx` and the Studio "Add
Datasource" connection form's field help text, so an author configuring a
proxy password or a TLS key passphrase was told it would be refused when it
would actually be accepted and stored in cleartext.

Describe-only: no schema shape or refusal-path change — every previously-valid
`options` input still parses byte-identically. The corrected text agrees with
the accurate statement #9124 landed in `content/docs/data-modeling/drivers.mdx`.
2 changes: 1 addition & 1 deletion content/docs/references/data/driver-mongo.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -48,7 +48,7 @@ MongoDB Connection Configuration
| **username** | `string` | optional | Authentication user |
| **password** | `never` | optional | Set through the connection form's secret field or `external.credentialsRef` — encrypted into `sys_secret`, never stored in `config` (#7990) |
| **authSource** | `string` | optional | Authentication database |
| **options** | `Record<string, any>` | optional | Extra MongoClient options (replicaSet, tls, timeouts, …; credential material is refused — bind secrets via the connection form / external.credentialsRef) |
| **options** | `Record<string, any>` | optional | Extra MongoClient options (replicaSet, tls, timeouts, …). Only `auth.password` is refused inline — bind it via the connection form / external.credentialsRef. `proxyPassword`, `tlsCertificateKeyFilePassword`, `key`, and `passphrase` are accepted and stored at rest in cleartext; they're redacted only when the datasource is read back, not refused at write. |


---
Expand Down
2 changes: 1 addition & 1 deletion packages/spec/src/data/driver/mongo.zod.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -136,7 +136,7 @@ export const MongoConfigSchema = lazySchema(() => strictObject(
placeholderFreeDeep(z.record(z.string(), z.unknown()), 'options'),
'options',
).optional()
.describe('Extra MongoClient options (replicaSet, tls, timeouts, …; credential material is refused — bind secrets via the connection form / external.credentialsRef)'),
.describe('Extra MongoClient options (replicaSet, tls, timeouts, …). Only `auth.password` is refused inline — bind it via the connection form / external.credentialsRef. `proxyPassword`, `tlsCertificateKeyFilePassword`, `key`, and `passphrase` are accepted and stored at rest in cleartext; they\'re redacted only when the datasource is read back, not refused at write.'),
})
.describe('MongoDB Connection Configuration')
.superRefine((cfg, ctx) => {
Expand Down
Loading