Remove password from stringified outputs

[charmander]

No description provided.

[charmander]

I just realized that 410b89b fixes the problem for Pool when used from pg-pool, but not when used from pg (because its BoundPool extends the pool’s options with an Object.assign). Should the same fix go in there to support new pg.Pool(otherPool.options), or does that seem like too much of a hack to avoid swapping out Object.assign with something that doesn’t care about whether properties are inherited or enumerable? @brianc

[brianc]

I'm not following what you're saying exactly? If you do

const newPool = new pg.Pool(otherPool.options)
console.log(JSON.stringify(newPool))

the password shows up again? Dang...yeah I mean ideally there's no way to accidentally log out a password...regardless of how objects are constructed.

[charmander]

@brianc The password doesn’t show up, but that pattern will stop working, because the Object.assign that copies otherPool.options doesn’t include the password property.

[brianc]

oh i see what you're saying - so we could special case it to be copied in if you do that?  ugg....hmmm I mean we could special case copying password over, mutate the options argument and append the Client directly to it, make the pg.Pool constructor take a second (undocumented) argument for the Client constructor to use (gross).  We could also do something like...

class BoundPool {
 constructor (options) { 
    super(options)
    this.options.Client = Client
  }
}

That's actually pretty clean IMO and isn't even more code or anything. Should fix the problem too, right?

[charmander]

@brianc Ah, nice solution! That would be perfect, except there’s this in pg-pool:

node-postgres/packages/pg-pool/index.js

Line 65 in ee8d32f

this.Client = this.options.Client || Client || require('pg').Client

which makes it do require('pg'), which is probably fine because of the peer dependency but still a little weird. However, I think || Client might achieve exactly what’s needed:

super(options, Client)

which also defaults to the Client being passed into BoundPool if one exists, instead of overwriting it. \o/