@sandersyao/dsh-credentials-mysql

Install & usage

import { MysqlCredentialProvider } from '@sandersyao/dsh-credentials-mysql'

await ctx.plugin(MysqlCredentialProvider, {
  connection: { tablePrefix: process.env.CREDENTIALS_TABLE_PREFIX },
})
// ctx.credentials is now backed by the MySQL vault.

Configuration

Credentials, table prefix and the encryption key come from environment variables / a .env file (see .env.example). Independent CREDENTIALS_* win; they fall back to the shared MYSQL_* — reuse the same connection when co-existing with dsh-session-persistence-mysql, or configure independently. The plugin Config is fully optional — environment is the source of truth for credentials (never hard-code a password).

Env	Fallback	Default	Purpose
CREDENTIALS_HOST	MYSQL_HOST	127.0.0.1	MySQL host.
CREDENTIALS_PORT	MYSQL_PORT	3306	Port.
CREDENTIALS_USER	MYSQL_USER	— (required)	Least-privilege DB user.
CREDENTIALS_PASSWORD	MYSQL_PASSWORD	— (required)	Password.
CREDENTIALS_DATABASE	MYSQL_DATABASE	— (required)	Target database.
CREDENTIALS_TABLE_PREFIX	MYSQL_TABLE_PREFIX	— (required)	Table prefix; validated against ^[A-Za-z0-9_]+$; base names distinct from session tables to avoid collision.
CREDENTIALS_ENCRYPTION_KEY	ENCRYPTION_KEY	(empty)	Field-encryption key; empty = plaintext (startup warning).
CREDENTIALS_SSL_REQUIRED	MYSQL_SSL_REQUIRED	false	Reserved for TLS enforcement (deferred).
CREDENTIALS_POOL_SIZE	MYSQL_POOL_SIZE	10	Pool sizing.
CREDENTIALS_SCHEMA_AUTO_MIGRATE	MYSQL_SCHEMA_AUTO_MIGRATE	true	Auto-migrate schema on startup; false only validates.

Test isolation. Automated tests (vitest) run against a separate database to avoid touching the production one: CREDENTIALS_TEST_DATABASE (default test) overrides CREDENTIALS_DATABASE during tests, and MYSQL_ROOT_PASSWORD is used only by the test harness to create/grant the test DB. See docs/MANUAL_TEST_PLAN.md.