# Shared database confidentiality dependency

Private-file input was insufficient by itself: an actual previous-revision CLI
add with `database.LOG_SQL=true` exposed the synthetic client secret in XORM
output. `evidence/sql-leak-before.log` retains the failed leak assertion without
printing the captured value. This is an implementation finding, not an accepted
runtime trial. Disabling raw SQL output alone also leaves the existing slow,
error and runtime trace hooks, which include query arguments/driver errors.

The common dependency is exactly the separately prepared Apps operation-backend
implementation, not a competing helper. Its API is `db.WithSensitiveSQL(ctx)`.
The actual SQL/slow/error/trace hooks redact statement/arguments/driver errors
when that context marker is present. The dependency's actual hook tests retain
positive unredacted controls, including a real runtime trace buffer. Custom
DB/server audit outside this process remains an owner custody concern.

Apply `shared-db-confidentiality.patch` exactly once when composing both source
candidates. Its three postimages must match the operation-backend source:

| Path | SHA-256 |
| --- | --- |
| `models/db/engine.go` | `43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96` |
| `models/db/sensitive_sql.go` | `8d4e6b3f08e9fdd919e97e47bd857cbd8935fdcbf367d20b5b8c545f279e796e` |
| `models/db/sensitive_sql_test.go` | `f0f74c09a9e96a6529db7b9ce459a2ea37e204de38c5ad01855b80c9a992a769` |

Both actual OAuth CLI handlers preserve the marked context through database
queries. They refuse configured raw SQL logging **and** actual XORM logger
ShowSQL before source reads/writes; a configuration boolean alone is insufficient.
Private-file persistence failures return fixed errors. This deliberately refuses
debug SQL logging for these handlers instead of pretending it is a private path.
The legacy secret flag and update omission semantics otherwise remain intact.
Final controls include actual `LOG_SQL=true` refusal, low-threshold slow-query
hooks, and a real SQLite-triggered write failure with unchanged stored source.