Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (password, authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stays passthroughSecretPaths in packages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreads config.options into, never inferred from documentation.
The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
options.autoEncryption.kmsProviders.aws.secretAccessKey (and sessionToken)options.autoEncryption.kmsProviders.azure.clientSecretoptions.autoEncryption.kmsProviders.gcp.privateKeyoptions.autoEncryption.kmsProviders.local.key
Mechanically true today (measured on the #13405 branch): redactDatasourceConfig('mongodb', ...) serves these positions back verbatim with no redactedKeys entry, because the leaf names are not credential-spelled and no table row names them.
What this card needs before any table edit: the #9040-style measurement against mongodb@7.5.0 (the pinned client) — does the client actually read these positions when spread from config.options (CSFLE requires the optional mongodb-client-encryption dependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land on passthroughSecretPaths only with that measurement quoted, per the module docblock.
Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.
Found while implementing #13405 (nested credential positions off the passthrough table). That fix closes the class of nested positions that MIRROR a top-level credential spelling (
password,authToken, and former aliases, judged at every object depth on both doors). It deliberately does NOT invent new secret NAMES: the client-measured residue stayspassthroughSecretPathsinpackages/spec/src/data/datasource-credential-redaction.ts, whose #9040 discipline is that every entry is measured against the client the driver spreadsconfig.optionsinto, never inferred from documentation.The residue class has at least one more likely member family. The mongodb client's CSFLE surface reads secret material from the options passthrough at nested positions whose leaf names mirror no top-level credential spelling, so neither the name judgment nor the table covers them today:
options.autoEncryption.kmsProviders.aws.secretAccessKey(andsessionToken)options.autoEncryption.kmsProviders.azure.clientSecretoptions.autoEncryption.kmsProviders.gcp.privateKeyoptions.autoEncryption.kmsProviders.local.keyMechanically true today (measured on the #13405 branch):
redactDatasourceConfig('mongodb', ...)serves these positions back verbatim with noredactedKeysentry, because the leaf names are not credential-spelled and no table row names them.What this card needs before any table edit: the #9040-style measurement against
mongodb@7.5.0(the pinned client) — does the client actually read these positions when spread fromconfig.options(CSFLE requires the optionalmongodb-client-encryptiondependency, which may itself change the answer), and what does a redacted round-trip do to a working CSFLE config? Entries land onpassthroughSecretPathsonly with that measurement quoted, per the module docblock.Not #13405's class (that card is the mirrored-spelling class, fixed by derivation); this is the client-measured-name residue the table exists for.