From 809a8641e27622d8cad7784ca967dc36e8e346f9 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 05:26:16 +0000 Subject: [PATCH] docs(drivers): say what the read path withholds from a plugin driver's config The plugin-contributed-driver paragraph said `config` is "stored and served to administrators as written". The write half holds: a driver with no shipped contract gets no config verdict, so the row is stored as written. The read half did not: `redactDatasourceConfig` hides the canonical credential keys (`password`, `authToken`) and their former aliases at every object depth, plus URL userinfo passwords and credential query parameters, for every driver, contracted or not. The paragraph now names that fixed, name-based set, says everything else is served as written, and keeps the plugin author's responsibility and the `external.credentialsRef` route. Docs only; no code change. Claude-Session: https://claude.ai/code/session_01VF48aw8RPG6wzDnMgp6rtw Co-authored-by: Claude --- content/docs/data-modeling/drivers.mdx | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/content/docs/data-modeling/drivers.mdx b/content/docs/data-modeling/drivers.mdx index b525e580afe..2cc6444fe4b 100644 --- a/content/docs/data-modeling/drivers.mdx +++ b/content/docs/data-modeling/drivers.mdx @@ -154,10 +154,18 @@ Two things live **outside** `config`, because they are not driver-specific: A plugin-contributed driver (`com.vendor.snowflake`) has no contract in this repo, so its `config` is left unvalidated rather than judged against a shape the -platform does not have. The platform also does not guess which of its keys hold -credentials: `config` is stored and served to administrators as written. Keeping -secrets out of it is the plugin author's responsibility; put the credential in -the bound secret (`external.credentialsRef`) instead. +platform does not have, and is stored as written. The platform also does not +guess which of its keys hold credentials. On read it withholds only what it +withholds for every driver: a key named exactly `password` or `authToken`, or +one of their former aliases (`FORMER_CREDENTIAL_ALIASES`), and, in a URL-shaped +string value, the password in its userinfo and its credential query parameters +(`CREDENTIAL_URL_QUERY_PARAM_NAMES`, such as `?password=`). Both apply at every +depth of nested objects, but not inside arrays. Everything else in `config` is +served to administrators as written (`redactDatasourceConfig` in +`datasource-credential-redaction.ts`), and a withheld value still sits in the +stored row. Keeping secrets out of `config` is the plugin author's +responsibility; put the credential in the bound secret +(`external.credentialsRef`) instead. The same schemas are projected to JSON Schema for