Merge branch 'main' into feat/container-network-aliases

.github/workflows/codeql-analysis.yml

@@ -12,11 +12,8 @@
 name: "CodeQL"
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
-    # The branches below must be a subset of the branches above
+  push:
     branches:
       - main
 

.github/workflows/install.yml

@@ -7,6 +7,8 @@ on:
       - 'package.json'
       - 'scripts/**'
   push:
+    branches:
+      - main
     paths:
       - '.github/workflows/install.yml'
       - 'package.json'
@@ -31,6 +33,7 @@ jobs:
   install:
     needs: pack
     strategy:
+      fail-fast: false
       matrix:
         pm: [npm, yarn, pnpm]
         os: [ubuntu-latest, macos-latest, windows-latest]

go.mod

@@ -160,7 +160,7 @@ require (
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/slack-go/slack v0.12.3
-	github.com/spf13/afero v1.9.5
+	github.com/spf13/afero v1.10.0
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5
@@ -174,7 +174,7 @@ require (
 	golang.org/x/sys v0.12.0 // indirect
 	golang.org/x/term v0.12.0
 	golang.org/x/text v0.13.0 // indirect
-	google.golang.org/grpc v1.58.1
+	google.golang.org/grpc v1.58.2
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/h2non/gock.v1 v1.1.2
 	gopkg.in/ini.v1 v1.67.0 // indirect

go.sum

@@ -614,8 +614,8 @@ github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJC
 github.com/skeema/knownhosts v1.2.0/go.mod h1:g4fPeYpque7P0xefxtGzV81ihjC8sX2IqpAoNkjxbMo=
 github.com/slack-go/slack v0.12.3 h1:92/dfFU8Q5XP6Wp5rr5/T5JHLM5c5Smtn53fhToAP88=
 github.com/slack-go/slack v0.12.3/go.mod h1:hlGi5oXA+Gt+yWTPP0plCdRKmjsDxecdHxYQdlMQKOw=
-github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
-github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
+github.com/spf13/afero v1.10.0 h1:EaGW2JJh15aKOejeuJ+wpFSHnbd7GE6Wvp3TsNhb6LY=
+github.com/spf13/afero v1.10.0/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
 github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
 github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
 github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
@@ -1067,8 +1067,8 @@ google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.58.1 h1:OL+Vz23DTtrrldqHK49FUOPHyY75rvFqJfXC84NYW58=
-google.golang.org/grpc v1.58.1/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
+google.golang.org/grpc v1.58.2 h1:SXUpjxeVF3FKrTYQI4f4KvbGD5u2xccdYdurwowix5I=
+google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

internal/db/dump/dump.go

@@ -65,7 +65,25 @@ func DumpSchema(ctx context.Context, config pgconn.Config, schema []string, keep
 
 func dumpData(ctx context.Context, config pgconn.Config, schema []string, useCopy, dryRun bool, stdout io.Writer) error {
 	// We want to dump user data in auth, storage, etc. for migrating to new project
-	excludedSchemas := append([]string{
+	excludedSchemas := []string{
+		"information_schema",
+		"pg_*", // Wildcard pattern follows pg_dump
+		// Owned by extensions
+		// "cron",
+		"graphql",
+		"graphql_public",
+		// "net",
+		// "pgsodium",
+		// "pgsodium_masks",
+		"pgtle",
+		"repack",
+		"tiger",
+		"tiger_data",
+		"timescaledb_*",
+		"_timescaledb_*",
+		"topology",
+		// "vault",
+		// Managed by Supabase
 		// "auth",
 		"extensions",
 		"pgbouncer",
@@ -75,7 +93,7 @@ func dumpData(ctx context.Context, config pgconn.Config, schema []string, useCop
 		"_analytics",
 		// "supabase_functions",
 		"supabase_migrations",
-	}, utils.SystemSchemas...)
+	}
 	env := []string{"EXCLUDED_SCHEMAS=" + strings.Join(excludedSchemas, "|")}
 	if len(schema) > 0 {
 		env[0] = "INCLUDED_SCHEMAS=" + strings.Join(schema, "|")

internal/db/dump/templates/dump_schema.sh

@@ -26,6 +26,7 @@ pg_dump \
 | sed -E 's/^CREATE SEQUENCE "/CREATE SEQUENCE IF NOT EXISTS "/' \
 | sed -E 's/^CREATE VIEW "/CREATE OR REPLACE VIEW "/' \
 | sed -E 's/^CREATE FUNCTION "/CREATE OR REPLACE FUNCTION "/' \
+| sed -E 's/^CREATE TRIGGER "/CREATE OR REPLACE TRIGGER "/' \
 | sed -E 's/^ALTER DEFAULT PRIVILEGES FOR ROLE "supabase_admin"/-- &/' \
 | sed -E "s/^GRANT (.+) ON (.+) \"(${EXCLUDED_SCHEMAS:-})\"/-- &/" \
 | sed -E "s/^REVOKE (.+) ON (.+) \"(${EXCLUDED_SCHEMAS:-})\"/-- &/" \

internal/link/link.go

@@ -2,7 +2,6 @@ package link
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -16,6 +15,7 @@ import (
 	"github.com/jackc/pgx/v4"
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/migration/repair"
+	"github.com/supabase/cli/internal/services"
 	"github.com/supabase/cli/internal/utils"
 	"github.com/supabase/cli/internal/utils/credentials"
 	"github.com/supabase/cli/internal/utils/tenant"
@@ -87,7 +87,13 @@ func PostRun(projectRef string, stdout io.Writer, fsys afero.Fs) error {
 func linkServices(ctx context.Context, projectRef string, fsys afero.Fs) {
 	// Ignore non-fatal errors linking services
 	var wg sync.WaitGroup
-	wg.Add(4)
+	wg.Add(5)
+	go func() {
+		defer wg.Done()
+		if err := linkDatabaseVersion(ctx, projectRef, fsys); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+		}
+	}()
 	go func() {
 		defer wg.Done()
 		if err := linkPostgrest(ctx, projectRef); err != nil {
@@ -121,7 +127,7 @@ func linkPostgrest(ctx context.Context, projectRef string) error {
 		return err
 	}
 	if resp.JSON200 == nil {
-		return errors.New("Authorization failed for the access token and project ref pair: " + string(resp.Body))
+		return fmt.Errorf("%w: %s", tenant.ErrAuthToken, string(resp.Body))
 	}
 	updateApiConfig(*resp.JSON200)
 	return nil
@@ -185,6 +191,17 @@ func linkDatabase(ctx context.Context, config pgconn.Config, options ...func(*pg
 	return repair.CreateMigrationTable(ctx, conn)
 }
 
+func linkDatabaseVersion(ctx context.Context, projectRef string, fsys afero.Fs) error {
+	version, err := services.GetDatabaseVersion(ctx, projectRef)
+	if err != nil {
+		return err
+	}
+	if err := utils.MkdirIfNotExistFS(fsys, filepath.Dir(utils.PostgresVersionPath)); err != nil {
+		return err
+	}
+	return afero.WriteFile(fsys, utils.PostgresVersionPath, []byte(version), 0644)
+}
+
 func updatePostgresConfig(conn *pgx.Conn) {
 	serverVersion := conn.PgConn().ParameterStatus("server_version")
 	// Safe to assume that supported Postgres version is 10.0 <= n < 100.0
@@ -207,7 +224,7 @@ func linkPooler(ctx context.Context, projectRef string) error {
 		return err
 	}
 	if resp.JSON200 == nil {
-		return errors.New("Authorization failed for the access token and project ref pair: " + string(resp.Body))
+		return fmt.Errorf("%w: %s", tenant.ErrAuthToken, string(resp.Body))
 	}
 	updatePoolerConfig(*resp.JSON200)
 	return nil

internal/link/link_test.go

@@ -3,7 +3,6 @@ package link
 import (
 	"context"
 	"errors"
-	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -134,6 +133,11 @@ func TestLinkCommand(t *testing.T) {
 			Reply("ALTER TABLE")
 		// Flush pending mocks after test execution
 		defer gock.OffAll()
+		gock.New(utils.DefaultApiHost).
+			Get("/v1/projects/" + project + "/api-keys").
+			Reply(200).
+			JSON([]api.ApiKeyResponse{{Name: "anon", ApiKey: "anon-key"}})
+		// Link configs
 		gock.New(utils.DefaultApiHost).
 			Get("/v1/projects/" + project + "/postgrest").
 			Reply(200).
@@ -142,20 +146,34 @@ func TestLinkCommand(t *testing.T) {
 			Get("/v1/projects/" + project + "/config/database/pgbouncer").
 			Reply(200).
 			JSON(api.V1PgbouncerConfigResponse{})
-		gock.New(utils.DefaultApiHost).
-			Get("/v1/projects/" + project + "/api-keys").
-			Reply(200).
-			JSON([]api.ApiKeyResponse{{Name: "anon", ApiKey: "anon-key"}})
+		// Link versions
 		rest := tenant.SwaggerResponse{Info: tenant.SwaggerInfo{Version: "11.1.0"}}
-		gock.New(fmt.Sprintf("https://%s.supabase.co", project)).
+		gock.New("https://" + utils.GetSupabaseHost(project)).
 			Get("/rest/v1/").
 			Reply(200).
 			JSON(rest)
 		auth := tenant.HealthResponse{Version: "v2.74.2"}
-		gock.New(fmt.Sprintf("https://%s.supabase.co", project)).
+		gock.New("https://" + utils.GetSupabaseHost(project)).
 			Get("/auth/v1/health").
 			Reply(200).
 			JSON(auth)
+		postgres := api.DatabaseResponse{
+			Host:    utils.GetSupabaseDbHost(project),
+			Version: "15.1.0.117",
+		}
+		gock.New(utils.DefaultApiHost).
+			Get("/v1/projects").
+			Reply(200).
+			JSON([]api.ProjectResponse{
+				{
+					Id:             project,
+					Database:       &postgres,
+					OrganizationId: "combined-fuchsia-lion",
+					Name:           "Test Project",
+					Region:         "us-west-1",
+					CreatedAt:      "2022-04-25T02:14:55.906498Z",
+				},
+			})
 		// Run test
 		err := Run(context.Background(), project, dbConfig.Password, fsys, conn.Intercept)
 		// Check error
@@ -171,6 +189,9 @@ func TestLinkCommand(t *testing.T) {
 		authVersion, err := afero.ReadFile(fsys, utils.GotrueVersionPath)
 		assert.NoError(t, err)
 		assert.Equal(t, []byte(auth.Version), authVersion)
+		postgresVersion, err := afero.ReadFile(fsys, utils.PostgresVersionPath)
+		assert.NoError(t, err)
+		assert.Equal(t, []byte(postgres.Version), postgresVersion)
 	})
 
 	t.Run("throws error on network failure", func(t *testing.T) {
@@ -206,12 +227,15 @@ func TestLinkCommand(t *testing.T) {
 			Get("/v1/projects/" + project + "/config/database/pgbouncer").
 			ReplyError(errors.New("network error"))
 		// Link versions
-		gock.New(fmt.Sprintf("https://%s.supabase.co", project)).
+		gock.New("https://" + utils.GetSupabaseHost(project)).
 			Get("/auth/v1/health").
 			ReplyError(errors.New("network error"))
-		gock.New(fmt.Sprintf("https://%s.supabase.co", project)).
+		gock.New("https://" + utils.GetSupabaseHost(project)).
 			Get("/rest/v1/").
 			ReplyError(errors.New("network error"))
+		gock.New(utils.DefaultApiHost).
+			Get("/v1/projects").
+			ReplyError(errors.New("network error"))
 		// Run test
 		err := Run(context.Background(), project, dbConfig.Password, fsys, func(cc *pgx.ConnConfig) {
 			cc.LookupFunc = func(ctx context.Context, host string) (addrs []string, err error) {
@@ -241,12 +265,15 @@ func TestLinkCommand(t *testing.T) {
 			Get("/v1/projects/" + project + "/config/database/pgbouncer").
 			ReplyError(errors.New("network error"))
 		// Link versions
-		gock.New(fmt.Sprintf("https://%s.supabase.co", project)).
+		gock.New("https://" + utils.GetSupabaseHost(project)).
 			Get("/auth/v1/health").
 			ReplyError(errors.New("network error"))
-		gock.New(fmt.Sprintf("https://%s.supabase.co", project)).
+		gock.New("https://" + utils.GetSupabaseHost(project)).
 			Get("/rest/v1/").
 			ReplyError(errors.New("network error"))
+		gock.New(utils.DefaultApiHost).
+			Get("/v1/projects").
+			ReplyError(errors.New("network error"))
 		// Run test
 		err := Run(context.Background(), project, "", fsys)
 		// Check error
@@ -331,7 +358,7 @@ func TestLinkPostgrest(t *testing.T) {
 		// Run test
 		err := linkPostgrest(context.Background(), project)
 		// Validate api
-		assert.ErrorContains(t, err, `Authorization failed for the access token and project ref pair: {"message":"unavailable"}`)
+		assert.ErrorIs(t, err, tenant.ErrAuthToken)
 		assert.Empty(t, apitest.ListUnmatchedRequests())
 	})
 }

internal/start/start.go

@@ -848,10 +848,12 @@ EOF
 				Image: utils.PgbouncerImage,
 				Env: []string{
 					"POSTGRESQL_HOST=" + dbConfig.Host,
-					"POSTGRESQL_NAME=" + dbConfig.Database,
-					"POSTGRESQL_USER=" + dbConfig.User,
 					fmt.Sprintf("POSTGRESQL_PORT=%d", dbConfig.Port),
+					"POSTGRESQL_USERNAME=pgbouncer",
 					"POSTGRESQL_PASSWORD=" + dbConfig.Password,
+					"POSTGRESQL_DATABASE=" + dbConfig.Database,
+					"PGBOUNCER_AUTH_USER=pgbouncer",
+					"PGBOUNCER_AUTH_QUERY=SELECT * FROM pgbouncer.get_auth($1)",
 					fmt.Sprintf("PGBOUNCER_POOL_MODE=%s", utils.Config.Db.Pooler.PoolMode),
 					fmt.Sprintf("PGBOUNCER_DEFAULT_POOL_SIZE=%d", utils.Config.Db.Pooler.DefaultPoolSize),
 					fmt.Sprintf("PGBOUNCER_MAX_CLIENT_CONN=%d", utils.Config.Db.Pooler.MaxClientConn),

internal/utils/config.go

@@ -419,6 +419,10 @@ func LoadConfigFS(fsys afero.Fs) error {
 			Config.Db.Image = Pg14Image
 			InitialSchemaSql = InitialSchemaPg14Sql
 		case 15:
+			if version, err := afero.ReadFile(fsys, PostgresVersionPath); err == nil && len(version) > 0 {
+				index := strings.IndexByte(Pg15Image, ':')
+				Config.Db.Image = Pg15Image[:index+1] + string(version)
+			}
 		default:
 			return fmt.Errorf("Failed reading config: Invalid %s: %v.", Aqua("db.major_version"), Config.Db.MajorVersion)
 		}

internal/utils/credentials/store.go

@@ -1,22 +1,43 @@
 package credentials
 
 import (
+	"bytes"
+	"errors"
+	"os"
+
 	"github.com/zalando/go-keyring"
 )
 
 const namespace = "Supabase CLI"
 
 // Retrieves the stored password of a project and username
 func Get(project string) (string, error) {
+	if err := assertKeyringSupported(); err != nil {
+		return "", err
+	}
 	return keyring.Get(namespace, project)
 }
 
 // Stores the password of a project and username
 func Set(project, password string) error {
+	if err := assertKeyringSupported(); err != nil {
+		return err
+	}
 	return keyring.Set(namespace, project, password)
 }
 
 // Erases the stored password of a project and username
 func Delete(project string) error {
+	if err := assertKeyringSupported(); err != nil {
+		return err
+	}
 	return keyring.Delete(namespace, project)
 }
+
+func assertKeyringSupported() error {
+	// Suggested check: https://github.com/microsoft/WSL/issues/423
+	if f, err := os.ReadFile("/proc/sys/kernel/osrelease"); err == nil && bytes.Contains(f, []byte("WSL")) {
+		return errors.New("Keyring is not supported on WSL")
+	}
+	return nil
+}

internal/utils/misc.go

@@ -23,19 +23,19 @@ var Version string
 const (
 	Pg13Image = "supabase/postgres:13.3.0"
 	Pg14Image = "supabase/postgres:14.1.0.89"
-	Pg15Image = "supabase/postgres:15.1.0.103"
+	Pg15Image = "supabase/postgres:15.1.0.117"
 	// Append to ServiceImages when adding new dependencies below
 	KongImage        = "library/kong:2.8.1"
 	InbucketImage    = "inbucket/inbucket:3.0.3"
 	PostgrestImage   = "postgrest/postgrest:v11.2.0"
 	DifferImage      = "supabase/pgadmin-schema-diff:cli-0.0.5"
 	MigraImage       = "djrobstep/migra:3.0.1621480950"
 	PgmetaImage      = "supabase/postgres-meta:v0.68.0"
-	StudioImage      = "supabase/studio:20230912-748fd33"
+	StudioImage      = "supabase/studio:20230921-d657f29"
 	ImageProxyImage  = "darthsim/imgproxy:v3.8.0"
 	EdgeRuntimeImage = "supabase/edge-runtime:v1.18.1"
 	VectorImage      = "timberio/vector:0.28.1-alpine"
-	PgbouncerImage   = "bitnami/pgbouncer:1.20.1"
+	PgbouncerImage   = "bitnami/pgbouncer:1.20.1-debian-11-r39"
 	GotrueImage      = "supabase/gotrue:v2.92.1"
 	RealtimeImage    = "supabase/realtime:v2.10.1"
 	StorageImage     = "supabase/storage-api:v0.40.4"
@@ -166,6 +166,7 @@ var (
 	ImportMapsDir         = filepath.Join(SupabaseDirPath, TempDir, "import_maps")
 	ProjectRefPath        = filepath.Join(SupabaseDirPath, TempDir, "project-ref")
 	RemoteDbPath          = filepath.Join(SupabaseDirPath, TempDir, "remote-db-url")
+	PostgresVersionPath   = filepath.Join(SupabaseDirPath, TempDir, "postgres-version")
 	GotrueVersionPath     = filepath.Join(SupabaseDirPath, TempDir, "gotrue-version")
 	RestVersionPath       = filepath.Join(SupabaseDirPath, TempDir, "rest-version")
 	CurrBranchPath        = filepath.Join(SupabaseDirPath, ".branches", "_current_branch")