fix(adapters): prevent Oracle/ClickHouse credential cache reuse

[cursor]

Bug and impact

Oracle and ClickHouse connection strings omit username/password (and ClickHouse database). Cached pools/clients keyed only on those URLs reused an already-authenticated handle for a later request with a different password, user, or database.

Impact: On a shared API process this is an auth bypass (wrong password still gets the prior pool) and can run schema/query work against the wrong ClickHouse database.

Root cause

• Oracle Easy Connect is host:port/service; username/password are separate createPool options. The pool key included username but not a password fingerprint.
• ClickHouse HTTP URL is only http(s)://host:port; username/password/database are separate createClient options, but the client map keyed solely on the URL.

Fix

• Add credentialedCacheKey / nonSecretFingerprint and use them for Oracle pool keys and ClickHouse client keys.
• Dedupe concurrent BoundedPoolCache.getOrCreate so parallel first acquires cannot leak undisposed pools.

Validation

• npx vitest run packages/core/src/cores/pool-cache.test.ts (7 tests, including credential partitioning + concurrent dedupe)

  

---

Note

High Risk
Touches connection pooling and authentication caching in a shared process; incorrect keys could still leak sessions, but the change closes a concrete auth-bypass and wrong-database reuse bug.

Overview
Fixes credential cache reuse on Oracle and ClickHouse when the URL/connect string does not carry username, password, or database. A later request with different credentials could reuse an already-authenticated pool or HTTP client (wrong-password acceptance and wrong ClickHouse database).

Adds credentialedCacheKey and nonSecretFingerprint (djb2 hex, no plaintext passwords in keys) and switches Oracle pool keys and ClickHouse client map keys to include user, database, and password fingerprint. BoundedPoolCache.getOrCreate now dedupes concurrent creates for the same key via a pending map so parallel first acquires do not spawn extra pools.

Tests cover key partitioning and concurrent dedupe; the helpers are re-exported from @foxschema/core.

^{Reviewed by Cursor Bugbot for commit 4d261f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_df7b8190-8dc0-4326-a7bb-c67e676787d5)