supabase / supavisor
75%

DEFAULT BRANCH: main
Repo Added
Files 73
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 75.129% (+1.4%) from 73.729%
22145415097

push

github

web-flow 
feat: support jit access in supavisor (#725)

## What kind of change does this PR introduce?

Feature

Introduces support for Just-in-time (JIT) access via a Personal Access
Token (PAT) or JWT, which is validated against a remote API. This is
implemented as a separate tenant feature, since it is not a standard
postgres feature. The upstream tenant must also be configured for JIT,
which requires a PAM to be installed and configured in the pg_hba.

With JIT in use, a disconnect happens between what the server expects
for auth (pg_hba.conf) and what `pg_authid` stores for user auth. In
most cases pg_authid will have the credentials saved as scram-sha-256,
but with the use of PAM for authentication, the database uses
`AuthenticationCleartext_password`. For this reason, the Supavisor must
be made aware of the tenants changed auth, and we use a new `use_jit`
configuration value for the tenant. When this is active, the pooler will
use AuthenticationCleartext_password, and support either logging in with
the valid user password (which will be checked against the scram-sha-256
retrieved from pg_authid) or a PAT/JWT that is validated against the
upstream API server configured via `jit_api_url`.

Cached credentials keep working as before, except in the case of the
PAT/JWT, the check is always performed against the upstream API server.
This ensures that any revocation of JIT access is respected, alongside
the expiration/revocation of the auth tokens, something that happens
outside of the database.

## What is the current behavior?

Doesn't support JIT.

## What is the new behavior?

Supports JIT, allowing login with:

JWT:
```
psql 'postgresql://postgres.dev_tenant2:eyJhbGciOiJSUzI1NiIsImtpZCI6IjcyYjY2NjA1IiwidHlwIjoiSldUIn0.eyJhYWwiOiJhYWwyIiwiYW1yIjpbeyJtZXRob2QiOiJ0b3RwIiwidGltZXN0YW1wIjOnt9fQ.XbOq_XWg@localhost:6543/postgres'
```

PAT:
```
psql 'postgresql://postgres.dev_tenant2:sbp_39wBdIEXAMPLESdMIg@localhost:6543/postgres'
```

Password:

```
psql 'postgres... (continued)

87 of 102 new or added lines in 7 files covered. (85.29%)

4 existing lines in 3 files now uncovered.

2190 of 2915 relevant lines covered (75.13%)

4241.22 hits per line

Relevant lines Covered
2915 RELEVANT LINES 2190 COVERED LINES
4241.22 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
22145415097 main feat: support jit access in supavisor (#725) ## What kind of change does this PR introduce? Feature Introduces support for Just-in-time (JIT) access via a Personal Access Token (PAT) or JWT, which is validated against a remote API. This is impl... push web-flow github
75.13
22144659588 etienne/sec-488-support-jit-access-in-supavisor Merge a344dc5e2 into cae1ebfb6 Pull #725 web-flow github
75.06
22144531148 main feat: add log for slow pool checkout (#861) push web-flow github pending completion  
22138746602 etienne/sec-488-support-jit-access-in-supavisor Merge 81a0dc32d into bdcbf2f18 Pull #725 web-flow github
75.03
22138575056 feat/add-log-for-slow-pool-checkout Merge 4beff7bb1 into bdcbf2f18 Pull #861 web-flow github
73.52
21983118864 refactor/rework-errors-add-codes Merge 5fd3e64da into bdcbf2f18 Pull #841 web-flow github
76.66
21979016732 refactor/rework-errors-add-codes Merge d6420ab5a into bdcbf2f18 Pull #841 web-flow github
75.94
21978221491 refactor/rework-errors-add-codes Merge ec04e48b5 into bdcbf2f18 Pull #841 web-flow github
84.29
21976342222 refactor/rework-errors-add-codes Merge 7b1feb0a5 into bdcbf2f18 Pull #841 web-flow github
76.29
21976134663 refactor/rework-errors-add-codes Merge 13dd9f537 into bdcbf2f18 Pull #841 web-flow github
82.61
See All Builds (742)