[Security/Privacy] Bound CDC status inventory to purpose-safe operator fields

[seonghobae]

Buyer / acquisition risk

Fresh protected-source inspection at develop@622e5e6c3d534f230c390f10e3832efadfc01825 found that GET /api/cdc/status still assembles a broad operational inventory rather than a finite purpose-bound status contract.

CdcService.getStatus() currently exposes deployment-specific connector/topic/schema/table/slot/publication identifiers, while CdcController.status() additionally exposes the replica topic regex, replica table list, the raw ReplicationSlotProbe.probeConfiguredSlot() map, configured source descriptions, and registered source/target inventory. These values are not passwords, but they can reveal internal database object names, customer/tenant naming, Kafka topology, Debezium identifiers, connector capability inventory, and deployment structure. Issue #187 separately records that the CDC HTTP control plane currently lacks an accepted service-local authentication boundary, so ambient network reachability can turn this status payload into an information-disclosure surface.

PR #243 narrows Actuator health replication-slot details only; it does not change /api/cdc/status. PR #172 currently owns CdcController.java, PR #139 owns CdcService.java, and #243 owns the health-indicator path. Do not race those branches.

RCA

• Immediate cause: the status endpoint builds its response by forwarding configuration/catalog/probe structures that were convenient for debugging.
• Technical root cause: operator liveness/readiness/status semantics are coupled to deployment inventory discovery.
• Control failure: controller/service tests prove the fields are returned, but no confidentiality contract limits the public status schema to finite low-cardinality, non-identifying fields.
• Systemic interaction: [Security/MSA] Authenticate CDC control-plane endpoints independently of gateway routing #187 owns caller authentication/authorization; [Data governance/Reliability] Govern CDC dead-letter payload retention and replay authority #181 owns DLT data governance; [Security/Privacy] Remove raw CDC engine diagnostics from service logs #190 owns raw CDC service log diagnostics; [CDC privacy] Bound replication-slot details in Actuator health output #242/fix(cdc): bound replication-slot Actuator health details #243 owns Actuator health projection. None currently bounds this separate HTTP status payload.

Distinct remedies / feasibility

1. Preferred after current writers clear — purpose-bound status projection. Keep finite operational state such as running, autoStart, supported source type/category, replica enabled/DDL enabled booleans, canonical-map enabled, and bounded success/failure counters. Replace raw probe/config/catalog structures with stable classifications/counts where they are necessary for operations.
2. Privileged inventory endpoint. If detailed topology discovery is a real product requirement, move it behind the eventual [Security/MSA] Authenticate CDC control-plane endpoints independently of gateway routing #187 authenticated least-privilege operator authority, with explicit field allowlisting and audit/retention. Do not treat route renaming as authorization.
3. Reject regex masking/truncation. Schema/table/topic/slot identifiers are semantically sensitive and can encode arbitrary customer naming; masking is incomplete and unstable.
4. Reject relying on gateway/network placement. [Security/MSA] Authenticate CDC control-plane endpoints independently of gateway routing #187 correctly treats direct CDC service authority as independent from gateway routing and loopback/private-network controls.

No new secret, credential, dependency, external service, or cross-repository mutation is required for the narrow projection repair.

TDD acceptance

When the overlapping writer lanes are clear, add fail-first tests at the real service/controller response boundary using deliberately sensitive identifiers (for example tenant-like topic/schema/table/slot/publication names) and require that ordinary status output:

1. contains only a documented finite allowlist of purpose-bound fields;
2. does not emit connector name, topic prefix/pattern, schema/table include lists, slot/publication names, raw replication-slot maps, provider/plugin/LSN/error text, source/target IDs or arbitrary future probe/config fields;
3. keeps liveness/running state and finite counters required for operations;
4. cannot regress when ReplicationSlotProbe or connector capability maps gain new fields;
5. remains compatible with fix(cdc): bound replication-slot Actuator health details #243's bounded Actuator health projection without duplicating raw diagnostics;
6. does not claim that data minimization substitutes for [Security/MSA] Authenticate CDC control-plane endpoints independently of gateway routing #187 authentication;
7. preserves standalone/MSA behavior and does not change CDC start/stop semantics;
8. regenerates exact-source CI/security/SBOM/SAST, non-vacuous owned-production coverage, current reviews and canonical traceability before protected integration.

Current classification / sequencing

known_gap / defer_until_trigger for source mutation because live PR #172 owns CdcController.java and live PR #139 owns CdcService.java; PR #243 separately owns the health boundary. Re-read all three exact heads/diffs after any integration/closure before choosing the smallest successor path. Waiting on this overlap never blocks other path-disjoint mightyETL work.

[seonghobae]

Fresh sequencing refresh after protected integration: develop is now exactly c2511f6b9d716ef9ab8de60a91fffd826714a4c5, which contains merged #243 (fix(cdc): bound replication-slot Actuator health details). The Actuator-health writer lane is therefore no longer an active source blocker for this issue. The /api/cdc/status defect itself remains present on protected source and remains known_gap / defer_until_trigger because Draft PR #172 still owns CdcController.java at exact head 69dcccfe0a608e79ec1fea4098747943ab5aa86c and Draft PR #139 still owns CdcService.java at exact head 279a29eb9033c40e021750ee81af520fb76f96e8. Neither head has integrated into the new protected base, so no old synthetic/check evidence transfers. Re-read both branches against live develop before implementing the purpose-bound status projection.