feat(plugin): bind credentials to opaque secret references

[seonghobae]

Buyer/security outcome

Advance #130 beyond durable installation authority with the first production credential trust-boundary slice: plaintext credential material reaches only a host-owned secret-store port, while LifeOS PostgreSQL persists only an opaque secret reference scoped to exact credential binding, installation, workspace, installing user, credential slot and lifecycle.

Test-first implementation

The application contract was established first: active exact installation authority is required before secret storage; exact binding replay never rematerializes secret material; public results exclude secret references; conflicting durable winners clean up newly stored provider material; and revocation commits durable authority before idempotent external cleanup.

Durable persistence now includes plugin_integration.plugin_credential_binding_record with composite installation/workspace/installer authority, lifecycle and bounded secret-reference constraints. PostgresPluginCredentialBindingStore uses fixed parameterized SQL, rejects malformed caller data before SQL, validates untrusted rows before they become authority, scopes lookup/revocation to binding+workspace+installer, and supports atomic create/revoke replay semantics. Destructive PostgreSQL migration fixtures are serialized because installation and credential migration tests intentionally share the same service-owned schema.

Scope

This slice intentionally does not claim a concrete cloud KMS backend, outbound webhook delivery, retry/dead-letter transport, or public operator API. It provides the typed secret-store boundary plus restart-safe opaque-reference metadata needed by those subsequent #130 slices. Plaintext credential material is absent from the database schema, retained public views and SQL parameters owned by the metadata store.

Exact-head evidence

Exact head f5f7124072bb087c9b763fa4938e467e537f180a passes CI, AppGuardrail, SAST Semgrep, Security Scan and Commercial Readiness. Current formal reviews and unresolved review threads are empty. No predecessor evidence is transferred; any later head change requires fresh exact-head evidence.

Refs #130 and protected #169.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 19fa147e-7044-46f5-b032-fa3a6f4dcf8a

📥 Commits

Reviewing files that changed from the base of the PR and between c9c5502 and f5f7124.

📒 Files selected for processing (7)

• apps/integration-service/migrations/0002_plugin_credential_binding_record.sql
• apps/integration-service/package.json
• apps/integration-service/src/plugin-credential-migration.test.ts
• apps/integration-service/src/plugin-credential-repository.test.ts
• apps/integration-service/src/plugin-credential-repository.ts
• apps/integration-service/src/plugin-credential.test.ts
• apps/integration-service/src/plugin-credential.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}