fix(link): refresh masked-password URLs on re-link#117
Merged
Conversation
Pre-0.1.72 cloud `link --auth` wrote DATABASE_URL with a literal placeholder password (the cloud `/database-connection-string` endpoint masks the password as `********`; the unmask via the separate `/database-password` endpoint only landed in #108 / shipped in 0.1.72). `refreshStaleEnvDefaults` only refreshes when the user's value matches the manifest's literal default. Users who linked under an older CLI have `postgresql://postgres:********@cloud-host/db?sslmode=require` in their .env.local — that doesn't match the manifest's `localhost:5432` default, so re-linking under 0.1.72+ never replaces it. BA's pg pool then fails with "password authentication failed for user 'postgres'" on every sign-up attempt. The masked password is never a valid Postgres credential — `:****@` patterns can be safely treated as stale and replaced from the platform value alongside the existing "matches the manifest default" branch. Adds a unit test covering the masked-URL refresh case. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
WalkthroughThe PR adds masked-password detection to the ChangesMasked-Password Credential Refresh
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/auth-providers/apply.ts (1)
403-407:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winRefresh log message is now too specific.
Line 406 says refresh only happens when value matched manifest default, but masked-password refreshes are now another path. Consider neutral wording to avoid confusing users.
Proposed wording update
clack.log.info( `Refreshed stale platform defaults: ${result.envKeysRefreshed.join(', ')}. ` + - `Your value matched the manifest's default, so we replaced it with the live one.`, + `We detected a stale value and replaced it with the live one.`, );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/auth-providers/apply.ts` around lines 403 - 407, The log message in the apply flow (where result.envKeysRefreshed is checked and clack.log.info is called) claims refreshes only occur when a value matched the manifest default, which is no longer always true (masked-passwords can trigger refreshes); make the message neutral and accurate by removing the specific "matched the manifest's default" phrasing and instead state that platform defaults or masked values were refreshed and list result.envKeysRefreshed; update the string in the clack.log.info call in src/auth-providers/apply.ts to reflect this neutral wording, preserving the existing use of json to decide whether to log.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/auth-providers/apply.ts`:
- Around line 141-145: The code marks keys as refreshed whenever matchesDefault
or isMaskedPassword is true, even if the actual value hasn't changed; update the
logic so you only push to refreshed and return the updated `${key}=${real}` when
real !== userValue. In the block using MASKED_PASSWORD_PATTERN, check the
equality of real and userValue (and only treat it as refreshed when different);
if they are the same, do not push key into refreshed and return the original
`${key}=${userValue}` (or leave it unchanged). Reference symbols:
MASKED_PASSWORD_PATTERN, refreshed array, key, userValue, real, matchesDefault,
isMaskedPassword.
---
Outside diff comments:
In `@src/auth-providers/apply.ts`:
- Around line 403-407: The log message in the apply flow (where
result.envKeysRefreshed is checked and clack.log.info is called) claims
refreshes only occur when a value matched the manifest default, which is no
longer always true (masked-passwords can trigger refreshes); make the message
neutral and accurate by removing the specific "matched the manifest's default"
phrasing and instead state that platform defaults or masked values were
refreshed and list result.envKeysRefreshed; update the string in the
clack.log.info call in src/auth-providers/apply.ts to reflect this neutral
wording, preserving the existing use of json to decide whether to log.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0f4b036d-1c7c-4590-817e-45ebab49b9ef
📒 Files selected for processing (2)
src/auth-providers/apply.test.tssrc/auth-providers/apply.ts
Comment on lines
+141
to
145
| const isMaskedPassword = MASKED_PASSWORD_PATTERN.test(userValue); | ||
| if (matchesDefault || isMaskedPassword) { | ||
| refreshed.push(key); | ||
| return `${key}=${real}`; | ||
| } |
There was a problem hiding this comment.
Avoid reporting a refresh when the value is unchanged.
At Line 141–145, masked values are marked refreshed even when real === userValue, which causes no-op rewrites and misleading envKeysRefreshed.
Proposed fix
- if (matchesDefault || isMaskedPassword) {
+ if ((matchesDefault || isMaskedPassword) && real !== userValue) {
refreshed.push(key);
return `${key}=${real}`;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const isMaskedPassword = MASKED_PASSWORD_PATTERN.test(userValue); | |
| if (matchesDefault || isMaskedPassword) { | |
| refreshed.push(key); | |
| return `${key}=${real}`; | |
| } | |
| const isMaskedPassword = MASKED_PASSWORD_PATTERN.test(userValue); | |
| if ((matchesDefault || isMaskedPassword) && real !== userValue) { | |
| refreshed.push(key); | |
| return `${key}=${real}`; | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/auth-providers/apply.ts` around lines 141 - 145, The code marks keys as
refreshed whenever matchesDefault or isMaskedPassword is true, even if the
actual value hasn't changed; update the logic so you only push to refreshed and
return the updated `${key}=${real}` when real !== userValue. In the block using
MASKED_PASSWORD_PATTERN, check the equality of real and userValue (and only
treat it as refreshed when different); if they are the same, do not push key
into refreshed and return the original `${key}=${userValue}` (or leave it
unchanged). Reference symbols: MASKED_PASSWORD_PATTERN, refreshed array, key,
userValue, real, matchesDefault, isMaskedPassword.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Tip: cubic could auto-approve low-risk PRs like this, if it thinks it's safe to merge. Learn more
tonychang04
added a commit
that referenced
this pull request
May 12, 2026
Ship #117 (refresh masked-password DATABASE_URL on re-link). Users who linked any cloud project under 0.1.71 or earlier had a placeholder `********` password in `.env.local`. Re-linking under 0.1.72 didn't fix it because the masked URL doesn't match the manifest's localhost default. 0.1.73 detects the `:****@` pattern as stale and refreshes from the platform-provided real password. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Pre-0.1.72 cloud `link --auth` wrote DATABASE_URL with a literal placeholder password:
```
DATABASE_URL=postgresql://postgres:********@m8s5kmam.us-east.database.insforge.app:5432/insforge?sslmode=require
```
The cloud's `/database-connection-string` endpoint masks the password as `********`; the unmask via the separate `/database-password` endpoint only landed in #108 (shipped in 0.1.72).
Users who linked under an older CLI still have the masked URL in `.env.local`. Re-linking under 0.1.72+ doesn't fix it because `refreshStaleEnvDefaults` only replaces values that match the manifest's literal default (`postgresql://postgres:postgres@127.0.0.1:5432/insforge`). The masked-cloud URL matches neither the default nor a real user customization — it falls into a gap.
The symptom is BA's pg pool failing on every sign-up:
```
password authentication failed for user "postgres"
```
What this PR does
Treat any `:***@` (one or more ``) password pattern as stale and refresh from the platform value, alongside the existing "matches the manifest default" branch.
```diff
refreshed.push(key);
return `${key}=${real}`;
}
```
The masked password is never a valid Postgres credential, so the "treat as stale" carries no risk of clobbering real user data.
Test plan
🤖 Generated with Claude Code
Summary by cubic
Fixes re-linking so masked
DATABASE_URLvalues from older cloud links are replaced with the real password. Detects:****@patterns and refreshes from platform values to prevent Postgres auth failures.refreshStaleEnvDefaultsto refresh values with masked passwords (:\*+@) in addition to default-match cases.Written for commit 50709e2. Summary will update on new commits.
Summary by CodeRabbit