Add Cloud SQL connector DB mode switch with DB schema search_path + CI-safe DB init for auth-provider by Copilot · Pull Request #46 · F3-Nation/f3-nation-auth

Copilot · 2026-03-23T10:59:09Z

👋 TL;DR

Adds an environment-variable DB connection mode switch for auth-provider (direct or Cloud SQL Connector), plus DB_SCHEMA/search_path support, CI-safe lazy DB initialization, and a direct-mode guard to avoid overriding an existing search_path already set in DATABASE_URL.

🔎 Details

Added DB mode selection in auth-provider/db/index.ts:
- DB_CONNECTION_MODE=direct (default): uses DATABASE_URL
- DB_CONNECTION_MODE=connector: uses @google-cloud/cloud-sql-connector
Added connector env support and validation:
- CLOUD_SQL_CONNECTION_NAME, DB_USER, DB_PASSWORD, DB_NAME
- optional CLOUD_SQL_IP_TYPE (defaults to PUBLIC)
Added PostgreSQL schema/search path support:
- new env var DB_SCHEMA (default: public)
- applied to connector pools via options: -c search_path=...
- for direct mode, applies options: -c search_path=... only when DATABASE_URL does not already specify schema/search path settings
- added schema-name validation and safe quoting for comma-separated schema lists
Refined DB initialization behavior:
- switched to lazy pool initialization (first DB use) instead of eager init at module import
- prevents build-time failures when DB env vars are unavailable during Next.js build steps
CI/build stability adjustment:
- auth-provider/app/page.tsx now exports dynamic = 'force-dynamic' to avoid static page-data collection executing DB queries at build time
Added dependency:
- @google-cloud/cloud-sql-connector@1.9.2
Updated deployment/env docs and config:
- auth-provider/.env.example
- auth-provider/README.md
- auth-provider/apphosting.yaml (includes DB_SCHEMA and connector-related env/secret entries)
- auth-provider/scripts/firebase-secrets.sh (mode-aware required vars and DB_SCHEMA support)

✅ How to Test

Install dependencies:
- npm run install
Validate code quality:
- npm run lint
- npm run typecheck
Validate direct mode (URL already defines search path):
- Set DB_CONNECTION_MODE=direct
- Set DATABASE_URL with schema/search path (for example, via URL options)
- Start app and verify DB-backed auth flows work and URL-provided schema is used
Validate direct mode (URL does not define search path):
- Set DB_CONNECTION_MODE=direct, DATABASE_URL=..., and optional DB_SCHEMA=public (or comma-separated schemas)
- Start app and verify DB-backed auth flows work using DB_SCHEMA
Validate connector mode:
- Set DB_CONNECTION_MODE=connector
- Set CLOUD_SQL_CONNECTION_NAME, DB_USER, DB_PASSWORD, DB_NAME
- (optional) set CLOUD_SQL_IP_TYPE=PUBLIC|PRIVATE
- (optional) set DB_SCHEMA (single schema or comma-separated list)
- Start app and verify DB-backed auth flows work
If using Firebase App Hosting secret automation:
- Ensure .env.prod includes DB_CONNECTION_MODE, DB_SCHEMA, and the appropriate vars for selected mode
- Run npm run firebase:secrets
CI/build check:
- Confirm auth-provider build no longer fails due to eager DB pool initialization when DATABASE_URL is unset at build-time data collection

🥜 GIF

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

…nector support Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/9c96ab8b-9202-488c-b587-e75804d4b908

…ets script Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/9c96ab8b-9202-488c-b587-e75804d4b908

…idation Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/9c96ab8b-9202-488c-b587-e75804d4b908

evanpetzoldt

This all looks fine to me... I don't suppose @pstaylor-patrick would be able to take a quick look? CC @taterhead247

evanpetzoldt

@copilot see suggestion, we need to use a search path to reach the right destination. This will need to be added to secrets.

Also, the CI build is failing, it says DATABASE_URL is missing; I'm not sure why that is, but I'm guessing it's in load_environment_variables()

…l init for CI Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/c31b6414-a65c-49ef-ab8e-531f93287061

Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/c31b6414-a65c-49ef-ab8e-531f93287061

Copilot · 2026-03-23T12:05:14Z

@copilot see suggestion, we need to use a search path to reach the right destination. This will need to be added to secrets.

Also, the CI build is failing, it says DATABASE_URL is missing; I'm not s...

Addressed in 0b18c9a (follow-up bd3ae10). Added DB_SCHEMA search_path support and wired it into apphosting/env/secrets. For the CI failure, logs showed DATABASE_URL was empty at build-time page-data collection, so DB pool creation is now lazy (first DB use) and app/page.tsx is force-dynamic to avoid build-time DB access.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

fonts.googleapis.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/f3-nation-auth/f3-nation-auth/auth-provider/node_modules/.bin/next build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

evanpetzoldt · 2026-03-23T12:10:07Z

+function createDirectPool(): Pool {
+  const connectionString = process.env.DATABASE_URL;
+
+  if (!connectionString) {
+    throw new Error('DATABASE_URL is missing. Cannot connect to the database.');
+  }
+
+  const searchPath = getSearchPath();
+  return new Pool({ connectionString, options: `-c search_path=${searchPath}` });
+}
+


@copilot DATABASE_URL already has a search path in it... will this break by adding it again in the options argument of the Pool constructor?

Good catch — I updated this in 8334ae8. In direct mode, if DATABASE_URL already includes search_path/currentSchema (or options with search_path), we now skip adding Pool options so we don’t duplicate/override it. We only add options when the URL does not already set it. UI screenshot: N/A (backend-only change).

… URL mode Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/273603c9-4156-45e4-8bc3-bb8611cb4052

evanpetzoldt

Alright, I think this looks good again from my perspective

taterhead247

nothing stands out as terribly bad

Copilot AI and others added 3 commits March 23, 2026 10:54

feat(auth-provider): add DB connection mode switch with Cloud SQL con…

8bfc69d

…nector support Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/9c96ab8b-9202-488c-b587-e75804d4b908

chore(auth-provider): wire connector env vars in app hosting and secr…

053fa2e

…ets script Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/9c96ab8b-9202-488c-b587-e75804d4b908

fix(auth-provider): harden DB init failure handling and connector val…

d790be9

…idation Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/9c96ab8b-9202-488c-b587-e75804d4b908

Copilot AI assigned Copilot and evanpetzoldt Mar 23, 2026

Copilot created this pull request from a session on behalf of evanpetzoldt March 23, 2026 11:01 View session

Copilot AI requested a review from evanpetzoldt March 23, 2026 11:02

Copilot finished work on behalf of evanpetzoldt March 23, 2026 11:02

evanpetzoldt approved these changes Mar 23, 2026

View reviewed changes

evanpetzoldt marked this pull request as ready for review March 23, 2026 11:11

evanpetzoldt reviewed Mar 23, 2026

View reviewed changes

Comment thread auth-provider/db/index.ts

Copilot started work on behalf of evanpetzoldt March 23, 2026 11:56 View session

Copilot AI and others added 2 commits March 23, 2026 12:02

fix(auth-provider): add DB_SCHEMA search_path support and lazy DB poo…

0b18c9a

…l init for CI Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/c31b6414-a65c-49ef-ab8e-531f93287061

chore(auth-provider): clean up DB_SCHEMA variable naming

bd3ae10

Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/c31b6414-a65c-49ef-ab8e-531f93287061

Copilot AI changed the title ~~Add Cloud SQL connector DB mode switch for auth-provider~~ Add Cloud SQL connector DB mode switch with DB schema search_path + CI-safe DB init for auth-provider Mar 23, 2026

Copilot AI requested a review from evanpetzoldt March 23, 2026 12:06

Copilot finished work on behalf of evanpetzoldt March 23, 2026 12:07

evanpetzoldt reviewed Mar 23, 2026

View reviewed changes

Copilot started work on behalf of evanpetzoldt March 23, 2026 12:10 View session

fix(auth-provider): avoid duplicate search_path override in direct DB…

8334ae8

… URL mode Co-authored-by: evanpetzoldt <48631145+evanpetzoldt@users.noreply.github.com> Agent-Logs-Url: https://github.com/F3-Nation/f3-nation-auth/sessions/273603c9-4156-45e4-8bc3-bb8611cb4052

Copilot AI requested a review from evanpetzoldt March 23, 2026 12:14

Copilot finished work on behalf of evanpetzoldt March 23, 2026 12:14

evanpetzoldt approved these changes Mar 23, 2026

View reviewed changes

taterhead247 approved these changes Mar 23, 2026

View reviewed changes

evanpetzoldt merged commit 2aab158 into main Mar 23, 2026
12 checks passed

evanpetzoldt deleted the copilot/add-gcp-sql-auth-proxy-switch branch March 23, 2026 13:15

taterhead247 linked an issue Mar 23, 2026 that may be closed by this pull request

Migrate solo repo auth to Auth Proxy #45

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Cloud SQL connector DB mode switch with DB schema search_path + CI-safe DB init for auth-provider#46

Add Cloud SQL connector DB mode switch with DB schema search_path + CI-safe DB init for auth-provider#46
evanpetzoldt merged 6 commits into
mainfrom
copilot/add-gcp-sql-auth-proxy-switch

Copilot AI commented Mar 23, 2026 •

edited

Loading

Uh oh!

evanpetzoldt left a comment

Uh oh!

evanpetzoldt left a comment

Uh oh!

Uh oh!

Copilot AI commented Mar 23, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

evanpetzoldt Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

evanpetzoldt left a comment

Uh oh!

taterhead247 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👋 TL;DR

🔎 Details

✅ How to Test

🥜 GIF

Uh oh!

evanpetzoldt left a comment

Choose a reason for hiding this comment

Uh oh!

evanpetzoldt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

evanpetzoldt Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

evanpetzoldt left a comment

Choose a reason for hiding this comment

Uh oh!

taterhead247 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 23, 2026 •

edited

Loading

Copilot AI commented Mar 23, 2026 •

edited

Loading