dbeaver/cloudbeaver#4564 change db user password

[TobyTheHutt]

Summary

Relates to #4564

Adds a Security > Change database password context-menu action on connections. The action opens a modal dialog and calls a new GraphQL mutation that invokes the DBeaver core DBAUserPasswordManager adapter of the connected driver.

Design

• Server flag dbUserPasswordChangeEnabled gates the mutation server-wide. Default is false. Persistence goes through CBAppConfig, AdminServerConfig, CBServerConfigurationController, CBServerConfigurationMapper, and WebServerConfig. Admin toggle lives in Configuration Wizard > Security.
• Mutation changeConnectionUserPassword(projectId: ID, connectionId: ID!, oldPassword: String!, newPassword: String!): Boolean!. Guard: @WebProjectAction(requireProjectPermissions = {PERMISSION_PROJECT_DATASOURCES_EDIT}). Both password parameters carry @WebParameterSecure to keep them out of logs.
• On DB rejection the mutation raises DBWebException wrapping the driver's exception. Callers receive the original SQL state, message, and cause chain.
• Frontend menu appears when the server flag is on and connection.canEdit is true. Backend re-checks the project permission on every call.
• Audit events fire on the cb_security_audit topic with kinds ATTEMPTED, SUCCEEDED, FAILED, and GATE_REJECTED. Payload carries sessionId, userId, projectId, connectionId, driverId, kind, reasonCode, errorClass. No plaintext passwords.

Screenshots:

Details

PW-Reset Flag:

PW-Change navigation:

PW-Change dialog:

PW-Change confirmation:

Engine coverage

Dispatch runs through the DBeaver core DBAUserPasswordManager adapter. Verified against Oracle 21c XE, PostgreSQL 16, and SQL Server 2022. Engines whose driver ships an adapter (Greenplum, CockroachDB, Exasol, Vertica) inherit support without further code changes. Drivers without an adapter (H2, MySQL) return GATE_REJECTED reasonCode=DIALECT_UNSUPPORTED in the audit trail and This driver does not support password change from CloudBeaver. in the notification.

Out of scope

• Expired-password login variant (Oracle ORA-28001, MySQL 1820, SQL Server 18488).
• MySQL adapter (upstream DBeaver contribution).
• Locale translations beyond English.

Test plan

• Admin toggles Enable database user password change in Configuration Wizard or Server Administration > Security.
• With flag on: right-click a configured and logged-on PostgreSQL/Oracle/MSSQL connection > Security > Change database password. Submit oldpw, newpw, newpw. Reconnect with newpw succeeds. Reconnect with oldpw returns SQLSTATE 28P01 or technology equivalent.
• With flag off: the Security submenu is absent.
• Non-admin user without datasources-edit on the project sees no menu. Direct GraphQL mutation returns a permission-denied response.
• Wrong-old-password on Oracle: notification body contains ORA-28008: invalid old password. On SQL Server: Msg 15116.
• H2 connection: notification This driver does not support password change from CloudBeaver.. Audit line kind=GATE_REJECTED reasonCode=DIALECT_UNSUPPORTED.
• docker logs cloudbeaver-dev | grep cb_security_audit shows one ATTEMPTED + one SUCCEEDED per successful change, ATTEMPTED + FAILED with errorClass on driver rejection, and no plaintext passwords.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 7 complexity

Metric	Results
Complexity	7

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[LonwoLonwo]

Hello @TobyTheHutt

Thanks for the contribution.
We will take a look and get back to you with the answer and comments soon.

[Copilot]

Pull request overview

Adds database-user password changes for editable connections, gated by server configuration.

Changes:

• Adds the connection security menu and password dialog.
• Adds the GraphQL mutation, driver-adapter dispatch, persistence, and audit events.
• Adds an administrator-controlled feature flag.

Reviewed changes

Copilot reviewed 26 out of 28 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
webapp/yarn.lock	Updates a local package checksum.
webapp/packages/plugin-connections/src/locales/en.ts	Adds password-dialog strings.
webapp/packages/plugin-connections/src/ContextMenu/MENU_CONNECTION_SECURITY.ts	Defines the Security submenu.
webapp/packages/plugin-connections/src/ContextMenu/ConnectionMenuBootstrap.ts	Registers the menu action and dialog.
webapp/packages/plugin-connections/src/ContextMenu/ChangeDatabasePasswordDialog/ChangeDatabasePasswordDialog.tsx	Implements the password form and mutation call.
webapp/packages/plugin-connections/src/ContextMenu/Actions/ACTION_CONNECTION_CHANGE_DB_PASSWORD.ts	Defines the password-change action.
webapp/packages/plugin-administration/src/locales/en.ts	Adds administration labels.
webapp/packages/plugin-administration/src/ConfigurationWizard/ServerConfiguration/ServerConfigurationFormPart.ts	Loads the feature flag state.
webapp/packages/plugin-administration/src/ConfigurationWizard/ServerConfiguration/IServerConfigurationFormPartState.ts	Extends configuration validation.
webapp/packages/plugin-administration/src/ConfigurationWizard/ServerConfiguration/Form/ServerConfigurationSecurityForm.tsx	Adds the security toggle.
webapp/packages/core-sdk/src/queries/fragments/ServerConfig/ServerConfig.gql	Queries the feature flag.
webapp/packages/core-sdk/src/queries/connections/changeConnectionUserPassword.gql	Defines the client mutation.
webapp/packages/core-root/src/ServerConfigResource.ts	Exposes the feature flag.
server/bundles/io.cloudbeaver.service.admin/schema/service.admin.graphqls	Extends admin configuration input.
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/WebServiceBindingCore.java	Binds the mutation resolver.
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java	Implements password changes and auditing.
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java	Declares the secured service method.
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/events/WSSecurityAuditEventHandler.java	Logs audit events.
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/events/WSSecurityAuditEvent.java	Defines audit payloads.
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/WebServerConfig.java	Publishes the feature flag.
server/bundles/io.cloudbeaver.server/schema/service.core.graphqls	Adds the flag and mutation schema.
server/bundles/io.cloudbeaver.server/plugin.xml	Registers the audit handler.
server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/server/CBServerConfigurationMapper.java	Maps the flag into application configuration.
server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/server/CBServerConfigurationController.java	Persists the flag.
server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/model/config/AdminServerConfig.java	Models the admin flag.
server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java	Removes trailing whitespace.
server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/config/CBAppConfig.java	Stores the feature flag.
server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/app/WebAppConfiguration.java	Adds the configuration interface default.

Suppressed comments (1)

server/bundles/io.cloudbeaver.server/schema/service.core.graphqls:918

• This new public mutation is missing the required @since directive.

    ): Boolean!

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[TobyTheHutt]

I looked at the Copilot feedback and commented or reacted to it based on my personal judgement. I'll provide a follow-up commit after the human maintainer review and further instructions.

This PR should not directly close the linked issue. It only covers the DB user password change. It does not yet cover the password-change prompt upon an expired DB user password, which was the original intent of the linked issue.

If any rephrasing or re-specification of the issue is desired, let me know and I'll be on it.

[TobyTheHutt]

@yagudin10, @devnaumov I closed some conversations and added some comments to others, in which I need clarifications or a confirmation. Please check my actions and review my comments. I'll wait for your feedback and prepare the other code changes in the meantime.

[TobyTheHutt]

@yagudin10 committed the feedback where I was confident about what change is required. Update me on the open comments and I'll do the rest.

[TobyTheHutt]

@yagudin10 @devnaumov
Sorry for the late response. I've addressed the open threads and hope the implementation matches what you've expected. Let me know if you want any further changes.