Uh oh!
There was an error while loading. Please reload this page.
docs(drivers): add AWS_SESSION_TOKEN to the no-binder-slot table - #9288
Merged
Conversation
PASSTHROUGH_SECRET_PATHS (packages/spec/src/data/datasource-credential- redaction.ts) redacts five mongo options.* keys on read, but the drivers.mdx "Secret-shaped keys with no binder slot" table only listed four. Add the fifth row (authMechanismProperties.AWS_SESSION_TOKEN) and update the key-count prose (five -> six total across mongo + turso). Its write-door story differs from the other four: it isn't refused because the MongoDB client itself throws on it under authMechanism: 'MONGODB-AWS' (driver/common.zod.ts), not because the binder lacks a slot for it. The doc now calls that out explicitly rather than folding it into the SOCKS5/TLS-key rationale. Docs-only, no packages/spec/src/** changes. Fixes#9279
os-steve
marked this pull request as ready for review
August 17, 2026 11:49
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#9279
What
content/docs/data-modeling/drivers.mdx's "Secret-shaped keys with no binder slot" table listed four mongo/turso keys, butPASSTHROUGH_SECRET_PATHS(packages/spec/src/data/datasource-credential-redaction.ts) redacts five mongooptions.*keys on read — the table was missingoptions.authMechanismProperties.AWS_SESSION_TOKEN.options.authMechanismProperties.AWS_SESSION_TOKEN(mongo/mongodb).encryptionKey, now plus this row = six total).AWS_SESSION_TOKENis writable for a different reason than the other five: it isn't refused at the write door because the MongoDB client itself throws on it underauthMechanism: 'MONGODB-AWS'(perdriver/common.zod.ts), not because the binder lacks a slot for it. Under any other mechanism nothing reads it. Either way it's accepted, stored cleartext, and redacted on read — same posture as the rest of the table.Calloutto name the SOCKS5/TLS-key/turso group explicitly (its "no working refusal remedy" rationale) and note thatAWS_SESSION_TOKENisn't part of that trade-off.Docs-only. No
packages/spec/src/**changes — the redaction source of truth already covered this key; the doc just undercounted it.Out of scope (per triage)
Per the issue's coordination note, #9254's
mongo.zod.tsdescribe string (PR #9277) is a separate, discretionary follow-through and is not touched here.Verification
Built at
fc0cd0a93. Local gates run against the actual diff (node scripts/pm/dispatch-gates.mjs content/docs/data-modeling/drivers.mdx):pnpm check:nul-bytes— OK (6066 files scanned, no raw control bytes)pnpm check:role-word— OK (43 baselined files, no new occurrences)pnpm check:docs-redirects— OK (92 entries, no dead pages)pnpm check:quick-reference-counts— OKpnpm check:docs-audit-scope— OK (178 hand-written docs in scope)pnpm --filter @objectstack/spec run check:empty-state— OKpnpm --filter @objectstack/spec run check:liveness— OK (pre-existing warnings unrelated to this diff)pnpm --filter @objectstack/spec run check:strictness-ledger— OKpnpm --filter @objectstack/spec run check:variant-docs— OKThis repo uses the
skip-changesetlabel for docs-only PRs (applied by the PM) — no changeset fabricated here.Generated by Claude Code
Generated by Claude Code