fix: authenticate PostgreSQL IAM connections on demand by deinspanjer · Pull Request #421 · bytebase/dbhub

deinspanjer · 2026-09-12T17:37:18Z

PostgreSQL IAM authentication currently rotates pools every 14 minutes even though token expiry does not invalidate an established database session. This replaces healthy connections and can trigger credential renewal without an incoming request.

Resolve IAM passwords through pg's async password callback when a physical connection opens. Existing sessions stay available, and a later request can retry failed authentication without restarting DBHub.

Share in-flight token requests per source configuration, including after a socket timeout, without adding background authentication retries or SQL replay.
Preserve upstream's idle-pool error handling, SSH failure cleanup, credential-file refresh, and MySQL/MariaDB timer recovery.
Preserve per-source pool limits, TLS/client-certificate settings, and signing of the original RDS endpoint through SSH.
Correct the PostgreSQL SSL type annotation to use pg.PoolConfig["ssl"].
Document SSO/credential-process login, per-source idle timeouts, and browser/connection-timeout behavior.

Validation after rebasing onto main (8c09c86, v1.4.0):

1,162 unit tests pass across 40 files, including real pg loopback authentication/idle-disconnect recovery and real AWS SDK tests with isolated synthetic credentials and a credential process.
Backend build and all six configured import smoke tests pass.
tsc --noEmit reports 135 diagnostics versus 136 on clean upstream with the same locked dependencies. The existing PostgreSQL SSL type error is fixed, with no new diagnostics.
The original branch was used live from September 12 through September 28 with no reported problems. Earlier read-only MCP probes also verified replacement physical sessions after pool idle eviction. The rebase was validated in an isolated copy; the running local build was not replaced.
The full Docker integration suite was not run locally. SSO, web identity, role assumption, and container/instance providers retain SDK routing, but not every authentication pattern was exercised end to end.

deinspanjer · 2026-09-12T17:37:29Z

I'll spend next week testing this build live in my normal workflow, including credential renewal and recovery after authentication failures. I'll keep this PR in draft and mark it ready for review after that testing is complete.

tianzhou · 2026-09-28T15:24:01Z

@deinspanjer any update

deinspanjer · 2026-09-28T16:31:40Z

Oh shoot, I'm sorry I forgot about this. It works great. I've been using the branch since I posted with no problems.
Let me get the branch resolved with latest and I'll mark the PR ready

Resolve IAM passwords when opening a connection so failed login attempts remain retryable. - Keep pools available after idle disconnects and share concurrent authentication. - Preserve AWS provider selection and reread refreshed credential files. - Cover recovery with real pg and isolated AWS SDK checks.

- Use the pool SSL type instead of the nonexistent pg.ConnectionOptions export.

deinspanjer · 2026-09-28T16:45:34Z

The integration test failure looks to be Docker related, not my code. Please let me know if I need to rebase again after a fix.

Copilot

Copilot review overview

🔵 Needs a closer look

Authentication lifecycle changes are high-impact, and several AWS provider paths were not exercised end to end.

Review effort: Balanced
Findings: None

What changed in this PR

Moves PostgreSQL RDS IAM authentication from timed pool rotation to on-demand password callbacks.

Changes:

Generates and shares in-flight IAM tokens when PostgreSQL opens physical connections.
Preserves MySQL/MariaDB rotation, SSH cleanup, TLS, and pool settings.
Adds authentication recovery tests and operational documentation.

File	Description
`src/utils/aws-rds-signer.ts`	Updates token-refresh documentation.
`src/utils/__tests__/aws-rds-credentials.test.ts`	Tests credential refresh and process recovery.
`src/connectors/postgres/index.ts`	Supports asynchronous passwords and corrects SSL typing.
`src/connectors/manager.ts`	Implements on-demand PostgreSQL IAM authentication.
`src/connectors/interface.ts`	Adds the password callback option.
`src/connectors/__tests__/postgres-auth.test.ts`	Tests physical-session authentication recovery.
`src/connectors/__tests__/manager.test.ts`	Tests token sharing, retries, and SSH behavior.
`docs/config/toml.mdx`	Documents IAM lifecycle and credential-provider behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

tianzhou

LGTM. Thanks for the contribution.

* docs: condense PostgreSQL IAM auth notes in TOML reference Follow-up to #421: keep the user-facing behavior (per-connection tokens for PostgreSQL, pool refresh for MySQL/MariaDB, SSO re-login) and drop implementation detail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WWd28U5E4UgGFeyimwDnFN * test: run AWS credential test in-process with the real SDK Replace the tsx subprocess and embedded script with two in-process tests that cover what the mocked signer tests can't: a rotated shared credentials file is re-read (ignoreCache), and a credential_process that failed succeeds on retry. Env-var and missing-profile cases are already covered by aws-rds-signer.test.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WWd28U5E4UgGFeyimwDnFN --------- Co-authored-by: Claude <noreply@anthropic.com>

LVLNo1One approved these changes Sep 23, 2026

View reviewed changes

Daniel E. added 2 commits September 28, 2026 12:36

fix: correct PostgreSQL SSL configuration type

333a24b

- Use the pool SSL type instead of the nonexistent pg.ConnectionOptions export.

deinspanjer force-pushed the dre/fix/on-demand-postgres-iam branch from d83685b to 333a24b Compare September 28, 2026 16:37

deinspanjer marked this pull request as ready for review September 28, 2026 16:37

deinspanjer requested a review from tianzhou as a code owner September 28, 2026 16:37

tianzhou requested a balanced review from Copilot September 29, 2026 13:06

Copilot started reviewing on behalf of tianzhou September 29, 2026 13:06

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

tianzhou approved these changes Oct 9, 2026

View reviewed changes

tianzhou merged commit 476a717 into bytebase:main Oct 9, 2026
4 of 5 checks passed

tianzhou mentioned this pull request Oct 9, 2026

docs/test: trim PostgreSQL IAM follow-ups from #421 #459

Merged

deinspanjer deleted the dre/fix/on-demand-postgres-iam branch October 9, 2026 16:43

Navigation Menu

Repository navigation

fix: authenticate PostgreSQL IAM connections on demand - #421

fix: authenticate PostgreSQL IAM connections on demand#421
tianzhou merged 2 commits into
bytebase:mainfrom
deinspanjer:dre/fix/on-demand-postgres-iam

deinspanjer commented Sep 12, 2026 •

edited

Loading

Uh oh!

deinspanjer commented Sep 12, 2026

Uh oh!

tianzhou commented Sep 28, 2026

Uh oh!

deinspanjer commented Sep 28, 2026

Uh oh!

deinspanjer commented Sep 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

tianzhou left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

deinspanjer commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deinspanjer commented Sep 12, 2026

Uh oh!

tianzhou commented Sep 28, 2026

Uh oh!

deinspanjer commented Sep 28, 2026

Uh oh!

deinspanjer commented Sep 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

tianzhou left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

deinspanjer commented Sep 12, 2026 •

edited

Loading