Databases
Onprest supports PostgreSQL, MySQL, SQL Server, and Oracle through the agent.
The gateway remains database-agnostic. Driver behavior, placeholder conversion, EXPLAIN validation, and DB-specific errors stay on the agent side. Each database is exercised by Testcontainers-backed integration tests. The agent uses DB-specific connection handling, placeholder conversion, EXPLAIN verification, schema/seed setup, result scanning, timeout handling, and error redaction.
Least Privilege
Use a DB user with the narrowest permissions needed for the defined capabilities.
For read capabilities:
- Prefer read-only users.
- Grant access only to required schemas, tables, views, or stored objects.
- Keep DB credentials only in
capability.yamlon the agent side. - Do not encode DB credentials in gateway env or API clients.
YAML policy.readonly is a guardrail, not a replacement for DB permissions.
Startup Verification
The agent verifies capabilities before connecting to the gateway.
| Check | Purpose |
|---|---|
| DB ping | Fail fast when the database is unreachable |
| EXPLAIN | Catch invalid SQL before exposing the capability |
| YAML lint | Reject invalid driver, policy, params, result, or logging settings |
If startup verification fails, details are written to onprest-agent.log.
Connection Generation and TLS
The agent generates DSNs from the database section of capability.yaml.
| Driver | Connection behavior |
|---|---|
postgres | URL DSN with configurable disable, require, verify-ca, or verify-full TLS; optional client certificate authentication |
mysql | Driver-native mysql.Config.FormatDSN() TCP DSN, including correct handling of credential special characters; TLS is currently disable only |
sqlserver | URL DSN with configurable disable, encrypted-but-unverified require, or CA/hostname-verified verify-full TLS |
oracle | URL DSN with oracle://user:password@host:port/name |
TLS defaults to disable. Select a verified mode where supported instead of relying only on network placement. MySQL and Oracle reject non-disabled TLS configuration until those driver paths provide an explicit verified implementation; they never silently downgrade a requested TLS mode.