Repository: Infisical/infisical
File: backend/src/services/app-connection/shared/sql/sql-connection-fns.ts (TypeScript)

Code before:
      throw new Error(`Unhandled SQL Connection Config: ${app as AppConnection}`);
  }
};

const ORACLE_WALLET_REGEX = /^[a-z0-9]+_[a-z]+$/i;

const isOracleWalletConnection = (app: AppConnection, database: string): boolean => {
  return app === AppConnection.OracleDB && ORACLE_WALLET_REGEX.test(database);
};

const getOracleWalletKnexClient = (
  credentials: Pick<TSqlConnection["credentials"], "username" | "password" | "database">
): Knex => {
  if (!process.env.TNS_ADMIN || !fs.existsSync(process.env.TNS_ADMIN)) {
    throw new BadRequestError({
      message:
        "Oracle wallet is not configured correctly. See documentation for instructions: https://infisical.com/docs/integrations/app-connections/oracledb#mtls-wallet"
    });
  }
  if (oracledb.thin) {
    try {
      oracledb.initOracleClient();
    } catch (err) {
      const errorMessage = err instanceof Error ? err.message : String(err);
      throw new BadRequestError({
        message: `Failed to initialize Oracle client: ${errorMessage}. See documentation for instructions: https://infisical.com/docs/integrations/app-connections/oracledb#mtls-wallet`
      });
    }
  }
  return knex({
    client: "oracledb",
    connection: {
      user: credentials.username,
      password: credentials.password,
      connectString: credentials.database
    }
  });
};

export const getSqlConnectionClient = async (appConnection: Pick<TSqlConnection, "credentials" | "app">) => {
  const {
    app,
    credentials: { host: baseHost, database, port, password, username }
  } = appConnection;

  if (isOracleWalletConnection(app, database)) {
    return getOracleWalletKnexClient({ username, password, database });
  }

  const [host] = await verifyHostInputValidity(baseHost);


Review comment (security):
Do we know if the error message may ever contain sensitive information? If we're uncertain it would be better to log it out (`logger.error()`) and just reference the log with the request ID that's always returned

Code after:
    default:
      throw new Error(`Unhandled SQL Connection Config: ${app as AppConnection}`);
  }
};

// if TNS_ADMIN is set and the directory exists, we assume it's a wallet connection for OracleDB
const isOracleWalletConnection = (app: AppConnection): boolean => {
  const { TNS_ADMIN } = getConfig();

  return app === AppConnection.OracleDB && !!TNS_ADMIN && fs.existsSync(TNS_ADMIN);
};

const getOracleWalletKnexClient = (
  credentials: Pick<TSqlConnection["credentials"], "username" | "password" | "database">
): Knex => {
  if (oracledb.thin) {
    try {
      oracledb.initOracleClient();
    } catch (err) {
      const errorMessage = err instanceof Error ? err.message : String(err);
      throw new BadRequestError({
        message: `Failed to initialize Oracle client: ${errorMessage}. See documentation for instructions: https://infisical.com/docs/integrations/app-connections/oracledb#mutual-tls-wallet`
      });
    }
  }
  return knex({
    client: SQL_CONNECTION_CLIENT_MAP[AppConnection.OracleDB],
    connection: {
      user: credentials.username,
      password: credentials.password,
      connectString: credentials.database
    }
  });
};

export const getSqlConnectionClient = async (appConnection: Pick<TSqlConnection, "credentials" | "app">) => {
  const {
    app,
    credentials: { host: baseHost, database, port, password, username }
  } = appConnection;

  if (isOracleWalletConnection(app)) {
    return getOracleWalletKnexClient({ username, password, database });
  }

  const [host] = await verifyHostInputValidity(baseHost);

  const client = knex({
    client: SQL_CONNECTION_CLIENT_MAP[app],
    connection: {
      database,