fix: prevent migration timeout overrides
pg-connection-string retains arbitrary query keys, so the driver's own configuration key connectionTimeoutMillis reaches ConnectionParameters straight from a URL — and it was not on the rejected list, while spellings that do nothing were. Rejecting it closes that gap. The precedence claims that guard was built on were partly wrong, so every source was measured against the installed [email protected].0, a real blackhole listener, and a real PostgreSQL rather than inferred from the merge: statement_timeout=0 / =900000 server reported 0 and 15min — wins outright query_timeout=0 overrides the field, but the parsed value is the string "0", which is truthy, so every query gets a 0 ms read timer and fails nondeterministically — it breaks the client rather than loosening the bound connectionTimeoutMillis=0/900000 pollutes connectionParameters.connect_timeout (10 -> 0 or 900 s), but that field only feeds getLibpqConnectionString(), which the pure-JS client never calls; the effective timer was unchanged, with an explicit 500 ms still expiring at ~500 ms either way connect_timeout=0 no effect: recomputed from the explicit field options=-c statement_timeout=… no effect, including a backslash-escaped spelling — the named startup parameter wins PGOPTIONS / PGCONNECT_TIMEOUT no effect unrelated parameters no effect, deliberately untouched Only statement_timeout is a genuine downgrade. The rest are rejected as unsupported configuration and defense in depth: no legitimate DATABASE_URL carries a driver option, the polluted connect_timeout would take effect on the native binding, and query_timeout produces intermittent failures an operator could not diagnose. That distinction is now stated where it was previously asserted wrongly — the earlier comment and ADR text claimed connect_timeout overrode the explicit field, which measurement disproved. Rejection still happens at the one shared construction boundary, before any pg.Client exists, with the existing fixed POSTGRES_MIGRATION_CONFIGURATION_INVALID and no URL, host, port, credential, parameter, or value in the message. The 10 s defaults, narrower test overrides, Pass 2 TLS policy and its URL-conflict checks, and every unrelated parameter are unchanged. Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
ekklesia
co-authored by
Claude Opus 5
Claude Opus 5
parent
74e8840f0d
commit
6912680113
@@ -1635,3 +1635,219 @@ describe.sequential("live PostgreSQL migration command hardening", () => {
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
/**
|
||||
* Pass 4 correction: what each timeout-shaped connection-string key and inherited environment
|
||||
* variable *actually* does to the pinned `[email protected]`, measured rather than inferred from its merge.
|
||||
*
|
||||
* The distinction matters: the boundary rejects several keys, but only one of them genuinely
|
||||
* weakens the selected policy. Documenting a key as "overrides the explicit field" when it does not
|
||||
* is the kind of claim this suite exists to prevent.
|
||||
*
|
||||
* Every listener, socket, client, and disposable database is closed in `finally`.
|
||||
*/
|
||||
describe.sequential("live PostgreSQL migration timeout precedence", () => {
|
||||
const productionClientFields = Object.freeze({
|
||||
connectionTimeoutMillis: 10_000,
|
||||
query_timeout: 10_000,
|
||||
statement_timeout: 10_000,
|
||||
});
|
||||
|
||||
it("does not let a URL weaken the effective connect timer, whichever spelling is used", async () => {
|
||||
const sockets: net.Socket[] = [];
|
||||
const listener = net.createServer((socket) => {
|
||||
sockets.push(socket);
|
||||
});
|
||||
try {
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
listener.once("error", reject);
|
||||
listener.listen(0, "127.0.0.1", () => resolve());
|
||||
});
|
||||
const address = listener.address();
|
||||
if (!address || typeof address !== "object") {
|
||||
throw harnessError("The blackhole listener has no bound address.");
|
||||
}
|
||||
const base = `postgresql://ekklesia:[email protected]:${address.port}/ekklesia`;
|
||||
|
||||
// A short explicit deadline stands in for the production 10 s so the measurement is fast.
|
||||
for (const query of [
|
||||
"",
|
||||
"?connectionTimeoutMillis=0",
|
||||
"?connectionTimeoutMillis=900000",
|
||||
"?connect_timeout=0",
|
||||
]) {
|
||||
const client = new Client({
|
||||
connectionString: `${base}${query}`,
|
||||
connectionTimeoutMillis: 500,
|
||||
});
|
||||
client.on("error", () => undefined);
|
||||
const startedAt = Date.now();
|
||||
let settled = false;
|
||||
try {
|
||||
await client.connect();
|
||||
} catch {
|
||||
settled = true;
|
||||
}
|
||||
const elapsed = Date.now() - startedAt;
|
||||
try {
|
||||
await client.end();
|
||||
} catch {
|
||||
// Already unusable.
|
||||
}
|
||||
|
||||
// The pure-JS client reads `connectionTimeoutMillis` from the object handed to its
|
||||
// constructor, before any connection-string merge; the merged value only reaches
|
||||
// `ConnectionParameters.connect_timeout`, which solely feeds `getLibpqConnectionString()`.
|
||||
expect(settled, `expected the connect timer to fire for ${JSON.stringify(query)}`).toBe(
|
||||
true,
|
||||
);
|
||||
expect(elapsed, `unexpected timer for ${JSON.stringify(query)}`).toBeLessThan(3_000);
|
||||
}
|
||||
|
||||
// ...but the driver-visible field really is polluted, which is why the boundary rejects the
|
||||
// key rather than relying on the pure-JS path staying this way. `connectionParameters` is
|
||||
// real on the pinned client but absent from its published types, so it is read through a
|
||||
// narrow structural view rather than asserted away.
|
||||
const connectTimeoutOf = (connectionString: string): string => {
|
||||
const client = new Client({ connectionString, ...productionClientFields }) as unknown as {
|
||||
readonly connectionParameters: { readonly connect_timeout: unknown };
|
||||
};
|
||||
(client as unknown as Client).on("error", () => undefined);
|
||||
return String(client.connectionParameters.connect_timeout);
|
||||
};
|
||||
expect(connectTimeoutOf(`${base}?connectionTimeoutMillis=0`)).toBe("0");
|
||||
expect(connectTimeoutOf(base)).toBe("10");
|
||||
} finally {
|
||||
for (const socket of sockets) {
|
||||
socket.destroy();
|
||||
}
|
||||
await new Promise<void>((resolve) => {
|
||||
listener.close(() => resolve());
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
it("records what each timeout source does to the real server's statement_timeout", async () => {
|
||||
await withIsolatedDatabase("timeout_sources", async (database) => {
|
||||
async function effectiveStatementTimeout(
|
||||
query: string,
|
||||
environment: Readonly<Record<string, string>> = {},
|
||||
): Promise<string> {
|
||||
const saved = new Map<string, string | undefined>();
|
||||
for (const [key, value] of Object.entries(environment)) {
|
||||
saved.set(key, process.env[key]);
|
||||
process.env[key] = value;
|
||||
}
|
||||
const client = new Client({
|
||||
connectionString: `${database.url}${query}`,
|
||||
...productionClientFields,
|
||||
});
|
||||
client.on("error", () => undefined);
|
||||
try {
|
||||
await client.connect();
|
||||
const result = await client.query<{ statement_timeout: string }>(
|
||||
"show statement_timeout",
|
||||
);
|
||||
return result.rows[0]?.statement_timeout ?? "unknown";
|
||||
} catch {
|
||||
return "connection failed";
|
||||
} finally {
|
||||
try {
|
||||
await client.end();
|
||||
} catch {
|
||||
// Already unusable.
|
||||
}
|
||||
for (const [key, value] of saved) {
|
||||
if (value === undefined) {
|
||||
delete process.env[key];
|
||||
} else {
|
||||
process.env[key] = value;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The baseline the policy selects.
|
||||
expect(await effectiveStatementTimeout("")).toBe("10s");
|
||||
|
||||
// The one key that genuinely wins, and the reason it must stay rejected.
|
||||
expect(await effectiveStatementTimeout("?statement_timeout=0")).toBe("0");
|
||||
expect(await effectiveStatementTimeout("?statement_timeout=900000")).toBe("15min");
|
||||
|
||||
// `query_timeout` from the URL *does* override the explicit field, but it does not weaken the
|
||||
// bound — it breaks the client. `client.query` computes its read timer as
|
||||
// `queryConfig.query_timeout || connectionParameters.query_timeout`, and the parsed URL value
|
||||
// is the *string* `"0"`, which is truthy, so every query gets a 0 ms read timer and fails
|
||||
// nondeterministically ("Query read timeout") depending on which wins the race. The
|
||||
// deterministic, assertable fact is the parameter the URL installed.
|
||||
const racyClient = new Client({
|
||||
connectionString: `${database.url}?query_timeout=0`,
|
||||
...productionClientFields,
|
||||
}) as unknown as { readonly connectionParameters: { readonly query_timeout: unknown } };
|
||||
(racyClient as unknown as Client).on("error", () => undefined);
|
||||
expect(racyClient.connectionParameters.query_timeout).toBe("0");
|
||||
|
||||
// `options` does *not* override the named startup parameter — including a backslash-escaped
|
||||
// spelling — so rejecting it is unsupported-configuration hygiene, not a precedence fix.
|
||||
expect(
|
||||
await effectiveStatementTimeout(`?options=${encodeURIComponent("-c statement_timeout=0")}`),
|
||||
).toBe("10s");
|
||||
expect(
|
||||
await effectiveStatementTimeout(
|
||||
`?options=${encodeURIComponent("-c statement_timeout=900s")}`,
|
||||
),
|
||||
).toBe("10s");
|
||||
expect(
|
||||
await effectiveStatementTimeout(
|
||||
`?options=${encodeURIComponent("-c statement_timeout\\=0")}`,
|
||||
),
|
||||
).toBe("10s");
|
||||
|
||||
// Inherited environment cannot reach the selected policy either.
|
||||
expect(await effectiveStatementTimeout("", { PGOPTIONS: "-c statement_timeout=0" })).toBe(
|
||||
"10s",
|
||||
);
|
||||
expect(await effectiveStatementTimeout("", { PGCONNECT_TIMEOUT: "0" })).toBe("10s");
|
||||
|
||||
// An unrelated parameter changes nothing.
|
||||
expect(await effectiveStatementTimeout("?application_name=ekklesia")).toBe("10s");
|
||||
});
|
||||
});
|
||||
|
||||
it("refuses every rejected key at the shared boundary before a client is constructed", async () => {
|
||||
await withIsolatedDatabase("timeout_boundary", async (database) => {
|
||||
for (const query of [
|
||||
"?connectionTimeoutMillis=0",
|
||||
"?connectionTimeoutMillis=900000",
|
||||
"?connect_timeout=0",
|
||||
"?query_timeout=0",
|
||||
"?statement_timeout=0",
|
||||
`?options=${encodeURIComponent("-c statement_timeout=0")}`,
|
||||
]) {
|
||||
let captured: unknown;
|
||||
try {
|
||||
createPostgresMigrationDatabase(`${database.url}${query}`);
|
||||
} catch (error) {
|
||||
captured = error;
|
||||
}
|
||||
expect(captured, `expected ${query} rejected`).toBeInstanceOf(
|
||||
PostgresMigrationDatabaseError,
|
||||
);
|
||||
expect(captured).toMatchObject({ code: "POSTGRES_MIGRATION_CONFIGURATION_INVALID" });
|
||||
const publicText = `${String(captured)}\n${(captured as Error).stack ?? ""}`;
|
||||
expect(publicText).not.toContain(database.name);
|
||||
expect(publicText).not.toContain("127.0.0.1");
|
||||
}
|
||||
|
||||
// The clean URL the commands actually use still works, end to end, with the real defaults.
|
||||
const applied = await applyModuleMigrations({
|
||||
aggregate: aggregate({
|
||||
id: "people",
|
||||
migrations: [migration("people", 0, { sql: "SELECT 1;", tag: "0000_ok" })],
|
||||
}),
|
||||
database: createPostgresMigrationDatabase(database.url),
|
||||
});
|
||||
expect(applied.appliedCount).toBe(1);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user