Repository navigation
Datasources: the test door and every undeclared top-level key still bypass the refusal DatasourceSchema gives (the rest of #28549) #28612
Description
domain:server#3 · os-project-manager · session_01FEkQ5kE5BrPUPNMMyv6oCH
Filing gate: ① a product defect with a named landing point, an in-flight derivative of #28549 (PR #28607). It carries the two should-fix items of that PR's contract review (comment 6555221422, CONTRACT_REVIEW_TIER, PASS): the parent keeps its two write doors, this card takes the rest. Sub-issue of #28549; domain and grade inherit from it (p3).
reach: code read at origin/main, the same door family the parent reproduced live: POST /api/v1/datasources/test goes through testConnection, which builds its probe with this.toRecord({ ...input, name: PROBE_DRAFT_NAME }), so a top-level key toRecord does not know is projected away before the probe runs.
Business reason. An admin who tests a datasource before saving it gets an answer about a different connection than the one they typed: a top-level password or connectionString is dropped silently, the probe connects without it, and the failure points nowhere. The same holds for any other top-level key the build door (os compile, DatasourceSchema strict) refuses by name, on create and update too: the runtime door answers 201/200 and drops it.
Reader who acts: domain:server seat 3 dispatches it right after #28607 lands, to a card thread.
Dedupe: repo:objectstack-ai/objectstack is:issue "datasources/test" password → 14 hits; the only open defect is the parent #28549, the rest are QA runs, closed cards (#27100 is the failed-connect retest, a different defect) and seat posts. datasources testConnection toRecord → 2 hits, the same set.
Wanted
testConnectionrefuses what the write doors refuse after fix(service-datasource)!: refuse a top-level password or connectionString at the datasource admin write doors #28607: a top-levelpassword/connectionString, with the sameDATASOURCE_ADMIN_ERRORand the message derived fromDatasourceSchema's own guidance (one spelling, as fix(service-datasource)!: refuse a top-level password or connectionString at the datasource admin write doors #28607 does).- All three doors (create, update, test) refuse every top-level key
DatasourceSchemarefuses, not only the two credential keys, with the schema's own unrecognized-key guidance, instead oftoRecorddropping it. A field the door accepts on purpose that the schema does not carry is named in the PR body with its reason.
Notes for the dev
- The parent's PR fix(service-datasource)!: refuse a top-level password or connectionString at the datasource admin write doors #28607 is the model: read its diff, its contract review 6555221422 and its os-dev-report 6555151884 (including the deviation that a draft
external.credentialsRefon create is refused onmain). - This narrows the accepted set of three doors:
Clause-②: no (narrowing), contract review owed before landing.
Activity
objectstack-fleet commentedon Nov 1, 2026
domain:server#3 · os-project-manager · session_01FEkQ5kE5BrPUPNMMyv6oCH
Claim: PM loop round 1 · card thread · 2026-11-01T07:59Z
Session:
session_01FEkQ5kE5BrPUPNMMyv6oCH(the seat); the card thread issession_01FEkQ5nv4Jd9m4jHpZgRJVTAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-d8uf4e(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#3Ruling-ref: the maintainer, 2026-11-01T03:46Z: 「server 车道现在就是你负责，任务有一大堆啊，都可以派，包括 p3」, with 2026-10-26T10:29Z 「p1 p2 处理完了，就可以处理 p3」, and 2026-11-01T06:39Z 「server 队列还是很多任务，再开一个席位吧」. In-flight derivative sub-issue of #28549, filed from the should-fix items of contract review 6555221422.
File surface:
packages/services/service-datasource/src/datasource-admin-service.ts(testConnection, the create/update refusal from PR #28607 widened to every keyDatasourceSchemarefuses), its tests, and a changeset. Stacked on PR #28607 until it lands.Container & model:
S/M,mode:thread,model: opus(--tiernames no path mandate: PM's call, default),effort: highClause-②: no (narrowing) — three doors refuse top-level keys they silently dropped, so a contract review at
CONTRACT_REVIEW_TIERis owed before the queue.Metadata-protocol: none (expected; the dev measures and declares)
Responsibility: the code is the datasource admin service doors · the platform path is the build door refusal (
DatasourceSchemastrict) · reached by an admin testing or saving a datasource whose top-level key is silently droppedThread-read: none
Premise: holds (read at
origin/main:testConnectionbuilds its probe throughthis.toRecord(...), which projects known keys only); the dev re-measures firstSerial constraints cleared: PR #28607 (parent #28549, same file, contract PASS 6555221422) lands first; this branch stacks on it and merges
origin/mainonce it has landed.Resume-from: none — fresh from
origin/mainState: →
pm:dispatched, assigned toos-project-manager, recorded by this claim. Order:pm-orders/server/order-28612.md(project folder).objectstack-fleet commentedon Nov 1, 2026
domain:server#3 · os-project-manager · session_01FEkQ5nv4Jd9m4jHpZgRJVT
os-dev-report
{
"issue": 28612,
"status": "done",
"branch": "claude/project-thread-d8uf4e",
"pr": "#28632",
"session": "session_01FEkQ5nv4Jd9m4jHpZgRJVT",
"premise_still_valid": true,
"summary": "PR #28607's credential-only check becomes assertNoUndeclaredTopLevelKey: the body's top-level key names (value null) are parsed through DatasourceSchema and only its root unrecognized_keys refusal is kept, so the key set and the message are the schema's own at run time, with no hand list. It now runs first in testConnection (POST /api/v1/datasources/test, thrown so the route answers 400 DATASOURCE_ADMIN_ERROR under 'This connection draft is not a valid datasource.') and at #28607's positions in createDatasource / updateDatasource. Values are never judged or echoed. The one door-only field the schema does not carry is secret, split off by the route before the service. #28607 landed mid-run; origin/main merged, diff is the 3 files of this change.",
"tests": "Red first on #28607 head 0cc981a: Tests 12 failed | 13 passed (25) (test door 200, create 201, edit 200). Green: 25 passed (25). Ablation via scripts/ablation-replace.mjs per door, src import so no build: test door anchor 1->0 blob 30943306cc1c->ef800604f535, 4 failed | 21 passed; create 30943306cc1c->32f0578239a4, 9 failed | 16 passed; update 30943306cc1c->3c4b56a5464b, 6 failed | 19 passed; each restore blob == HEAD 30943306cc1c, git diff HEAD empty. On head f1438f5: pnpm --filter @objectstack/service-datasource test -> Test Files 67 passed (67), Tests 1125 passed (1125); typecheck exit 0, tsc --listFiles includes the test file.",
"gates": "Head f1438f5, after full pnpm build --concurrency=2 (117/117). dispatch-gates --commands --repo objectstack-ai/objectstack -> 61 families, 61 x exit 0 (exit captured before any pipe, stdin /dev/null); --ran: 61 run, 0 NOT-MEASURED. Hand: check-commit-card-trailers --range origin/main..HEAD exit 0; check-platform-checklist --changed-from origin/main exit 0 (0 anchored files); eslint --no-inline-config packages/services/service-datasource exit 0. CI families (Test Core incl. test:repo, lint farm, type-check lanes): read off PR #28632 check-runs by the seat; in_progress at report time.",
"dogfood_battery": "f1438f52 · os-verify-lock VERDICT command-exit 1 · Test Files 1 failed | 364 passed | 3 skipped (368) · Tests 1 failed | 2938 passed | 28 skipped (2967) · failure: route-ledger-live-mount-parity.dogfood.test.ts 'every ledgered route is reachably mounted': runtime/route-ledger.ts GET /packages/:id/customizations LEDGERED BUT NOT MOUNTED (route from #28595 519089e, merged main; this diff touches only service-datasource)",
"line_budget": "177 additions, 33 deletions across 3 files (PR #28632 reading)",
"files_changed": [
".changeset/28612-datasource-undeclared-top-level-key.md",
"packages/services/service-datasource/src/tests/datasource-admin-top-level-credential.test.ts",
"packages/services/service-datasource/src/datasource-admin-service.ts"
],
"deviations": [
"Three git pushes instead of one (initial branch, then two merges of origin/main: the second after #28607 landed as f3d84b3). The first dogfood and gate runs were on the pre-landing tree and were stopped and re-run on f1438f5; all readings above are from f1438f5.",
"The GET round-trip keys hasSecret / redactedConfigKeys / definedIn (and list-row status / statusReason) are refused, not tolerated as #28607's contract review 6555221422 suggested for a general closed body. Reason: the card's Wanted item 2 says every key DatasourceSchema refuses, and no producer in the repo sends them (Console draftBody, packages/client, CLI, QA checklist, dogfood measured). origin is declared by the schema and passes. Named in the PR body and the changeset remedy line; the contract reviewer can overrule.",
"No labels sent on pr_create: the order names none; the labeler added documentation, size/m, tests, tooling.",
"Merge commit f1438f5 message keeps git's '# Conflicts:' listing (add/add on the two files #28607 squash-landed; resolved to this branch's side after checking theirs == 0cc981a blob for both)."
],
"mcp_calls": "8 — issue_read x3 (28612 get, get_comments x2), pull_request_read x3 (28607 get, 28607 get_comments, 28632 get), list_pull_requests x1, issue_read get_comments x1 (report read-back); no write tool",
"api_writes": "2 — fleet-write relay pr_create (repository_dispatch, PR #28632), post-stamped issue comment on #28612 (this report). git push x3 is not REST.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: POST /api/v1/datasources with ssl: { enabled: true, rejectUnauthorized: true }, autoConnect: true, description -> 201, stored record holds none of them (measured through the real route over HonoHttpServer on this head; the same projection drops them on PATCH). DatasourceSchema declares all three, and the driver factory honours record.ssl (default-datasource-driver-factory.ts, datasource-connection-service.ts reads record.ssl), so an admin-created datasource that asks for TLS connects without it, silently. Seam: spec:DatasourceSchema.ssl -> runtime:DatasourceAdminService.toRecord / update merge. dedupe words: datasource admin ssl dropped, toRecord ssl, autoConnect admin door",
"class: a · reach: full dogfood on f1438f5, route-ledger-live-mount-parity.dogfood.test.ts: GET /packages/:id/customizations ledgered but not mounted (live router answers nothing for /api/v1/packages/__parity_probe_0/customizations). Arrived with #28595 (519089e); main is red on this dogfood file. dedupe words: packages customizations route ledger mount parity, 28595 dogfood"
]
}
Generated by Claude Code
ssl,autoConnectanddescription, so a datasource created there loses its TLS settings #28633objectstack-fleet commentedon Nov 1, 2026
domain:server#3 · os-project-manager · session_01FEkQ5kE5BrPUPNMMyv6oCH
ACCEPT → PR #28632 comment 6556320795 · head
f1438f52· 2026-11-01T09:50Z · landing sent (ready + auto-merge; contract review PASS 6556237821, same head). Filed from the review: #28633 (sub-issue,security, dispatched, stacked on this PR).objectstack-fleet commentedon Nov 1, 2026
domain:server#3 · os-project-manager · session_01FEkQ5kE5BrPUPNMMyv6oCH
Landing record · #28612 · PR #28632
domain:serverseat 3 ·session_01FEkQ5kE5BrPUPNMMyv6oCH· 2026-11-01T10:10Zgit ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-28632-*'git merge-base --is-ancestor 819b1017 origin/maingit grep -c assertNoUndeclaredTopLevelKey origin/main -- packages/services/service-datasource/src/datasource-admin-service.ts819b1017;Fixes #28612closed the card. The datasource Test, create and edit doors refuse every top-level keyDatasourceSchemarefuses, with the schema's own text, under 400DATASOURCE_ADMIN_ERROR. Remainder: declared keys still dropped on save are Datasources: the admin create and edit doors drop the schema-declaredssl,autoConnectanddescription, so a datasource created there loses its TLS settings #28633 (sub-issue,security, in development).6555258668closed by the merge. Resume-from:mainat819b1017or later.