Skip to content

fix(cli)!: stop db advisors --remote minting a login role (CLI-2829) - #7297

Open
7ttp wants to merge 1 commit into
nextfrom
7ttp/cli-2829-db-query-linked-rotates-the-temp-login-role-password
Open

7ttp wants to merge 1 commit into
nextfrom
7ttp/cli-2829-db-query-linked-rotates-the-temp-login-role-password

Conversation

@7ttp

@7ttp 7ttp commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

TL;DR

parallel db advisors --remote runs no longer break each other with 28P01

whats improved/fixed?

before calling the advisors API it set up a database login it never used

every setup resets the shared cli_login_postgres password, so two runs at once (or one next to another remote db command) knocked each other out, and on a network without IPv6 one failed after about 150 s

how?

the remote path now skips the database and goes straight to the advisors API

this brings it in line with db query --remote since #7188, so both remote read commands work the same way

flowchart LR
    run["db advisors --remote"]
    run -->|before, no DB password| mint["new temp login role<br/>resets the shared password"]
    mint -- IPv6 --> api1["advisors API"]
    mint -- no IPv6 --> wait["pooler retries the login"]
    wait -- another run reset it --> fail["fails with 28P01"]
    wait -- no clash --> api1
    run -- now --> ref["resolve project ref<br/>or branch"]
    ref --> token["check access token"]
    token -- missing --> login["asks to run supabase login"]
    token -- ok --> api2["advisors API<br/>security and/or performance"]
    api2 --> out["filter by --level<br/>print, exit by --fail-on"]
Loading

ref:

BREAKING CHANGE: db advisors --remote no longer connects to the database first (matches db query --remote), so it no longer resolves database settings, creates a temporary login role or removes network bans under --yes

@7ttp 7ttp self-assigned this Oct 23, 2026
@7ttp
7ttp requested a review from a team as a code owner October 23, 2026 11:16

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 AI Review

Both independent reviews completed with no findings. Reading the full diff and surrounding handler, permissions, runtime layers, and tests revealed no concrete issues. Linked advisors bypass database connection resolution while preserving token validation and cache finalization.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0


Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant