feat(pam): add Oracle credential rotation over the gateway

[carlosmonastyrski]

Description 📣

The Gateway can now change an Oracle user's password on Infisical's behalf, which is what makes Oracle credential rotation and health checks work end to end.

It also handles the awkward parts of Oracle specifically: databases that enforce a password policy, which reject a password change unless the old one is supplied, and accounts reached over an encrypted connection, which Infisical could not check on its own. Connecting to an Oracle account through the CLI now tells you to type password in your client's password field, Oracle is the one database that refuses to log in without something in that box, and the Gateway swaps in the real credential for you.

Error messages from failed Oracle connections no longer echo the connection string back, so a password can't end up in a status message.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-391-feat-pam-add-oracle-credential-rotation-over-the-gateway

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
37071517	Triggered	Username Password	007d52e	packages/gateway-v2/test_connection_oracle_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​sijms/​go-ora/​v2@​v2.9.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang github.com/sijms/go-ora/v2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/github.com/sijms/go-ora/v2@v2.9.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/sijms/go-ora/v2@v2.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[greptile-apps]

Greptile Summary

Adds Oracle support to the gateway’s SQL connection testing and credential-rotation flow.

• Introduces a platform-only SQL RPC transport for Oracle password rotation.
• Adds Oracle driver configuration, TLS support, verification queries, and secret redaction.
• Handles Oracle self-rotation with the existing password while preserving case-sensitive account identity.
• Updates CLI connection instructions to provide Oracle’s required proxy-password placeholder.
• Fixes the previously reported timeout conversion overflow and case-sensitive username comparison.

Confidence Score: 5/5

The PR appears safe to merge, with both previously reported findings fixed and no new actionable issue identified in the latest changes.

The timeout is now clamped before duration conversion, Oracle self-rotation uses an exact case-sensitive username comparison, and the manually resolved previous threads no longer represent outstanding findings. SQL forwarding remains limited to platform actors and does not accept a request-controlled destination.

Important Files Changed

Filename	Overview
packages/gateway-v2/sql_handler.go	Implements bounded SQL rotation requests, Oracle-safe password-change statements, and corrected timeout and account-identity handling.
packages/gateway-v2/test_connection_handler.go	Adds Oracle connection testing with TLS integration, Oracle verification SQL, and credential redaction.
packages/gateway-v2/gateway.go	Registers the SQL ALPN protocol and restricts SQL forwarding to platform actors.
packages/gateway-v2/test_connection_oracle_test.go	Covers Oracle driver routing, TLS failures, secret redaction, dialect rejection, and password-rotation statement behavior.
packages/pam/handlers/oracle/proxy_auth.go	Exports the existing Oracle TLS configuration helper for reuse by gateway connection tests.
packages/pam/local/access.go	Displays Oracle’s required proxy-password placeholder in connection details and examples.
packages/pam/agent/instructions.go	Documents Oracle as the exception to the usual passwordless proxy instructions.

_{Reviews (2): Last reviewed commit: "Fix go.mod" | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[carlosmonastyrski]

@greptile re-review this PR and update the top Greptile Summary