fix(sim-setup): leave a shell-exported POSTGRES_PASSWORD to the operator

Compose interpolates a shell value over .env, so the wizard no longer copies it into .env and no longer needs rules for values .env or DATABASE_URL would change. An empty export is still refused, since Compose would use it and refuse to start.

Author: waleedlatif1

packages/sim-setup/src/compose-database.test.ts

@@ -8,7 +8,6 @@ import {
   LEGACY_POSTGRES_PASSWORD,
   postgresUser,
 } from './compose-database'
-import { SetupError } from './errors'
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..')
 const COMPOSE_FILES = [
@@ -62,27 +61,15 @@ describe('choosePostgresPassword', () => {
     ).toEqual({ value: LEGACY_POSTGRES_PASSWORD, source: 'legacy' })
   })
 
-  it('persists a shell-only password, which is what Compose is using', () => {
+  it('leaves a shell-exported password to the operator, since Compose uses it', () => {
     const hasDatabaseVolume = vi.fn(() => true)
     expect(
       choosePostgresPassword(undefined, 'sim-abc', {
         shell: { POSTGRES_PASSWORD: 'in-shell' },
         hasDatabaseVolume,
       })
-    ).toEqual({ value: 'in-shell', source: 'environment' })
-    expect(hasDatabaseVolume).not.toHaveBeenCalled()
-  })
-
-  it('accepts a shell password that matches .env', () => {
-    expect(
-      choosePostgresPassword('same', 'sim-abc', { shell: { POSTGRES_PASSWORD: 'same' } })
     ).toBeNull()
-  })
-
-  it('refuses a shell password that differs from .env', () => {
-    expect(() =>
-      choosePostgresPassword('in-env-file', 'sim-abc', { shell: { POSTGRES_PASSWORD: 'other' } })
-    ).toThrow(SetupError)
+    expect(hasDatabaseVolume).not.toHaveBeenCalled()
   })
 
   it('refuses an empty shell export, which Compose would use over .env', () => {
@@ -93,38 +80,11 @@ describe('choosePostgresPassword', () => {
     }
   })
 
-  it.each([
-    'pa ss',
-    'pass#word',
-    'pa"ss',
-    "pa'ss",
-    'pa\\ss',
-    'pa$ss',
-    'pa/ss',
-    'pa?ss',
-    'pa%ss',
-    'pa@ss',
-    'pa:ss',
-  ])('refuses to persist %s, which .env or DATABASE_URL would change', (value) => {
-    expect(() =>
-      choosePostgresPassword(undefined, 'sim-abc', {
-        shell: { POSTGRES_PASSWORD: value },
-        hasDatabaseVolume: () => false,
-      })
-    ).toThrow(SetupError)
-  })
-
-  it('persists a shell password made of URL-unreserved characters', () => {
-    expect(
-      choosePostgresPassword(undefined, 'sim-abc', { shell: { POSTGRES_PASSWORD: 'Ab9._~-z' } })
-    ).toEqual({ value: 'Ab9._~-z', source: 'environment' })
-  })
-
   it('reads the process environment by default', () => {
     vi.stubEnv('POSTGRES_PASSWORD', 'from-process')
-    expect(choosePostgresPassword(undefined, 'sim-abc', { hasDatabaseVolume: () => true })).toEqual(
-      { value: 'from-process', source: 'environment' }
-    )
+    expect(
+      choosePostgresPassword(undefined, 'sim-abc', { hasDatabaseVolume: () => true })
+    ).toBeNull()
   })
 })
 

packages/sim-setup/src/compose-database.ts

@@ -25,20 +25,13 @@ export function composeFileRequiresPostgresPassword(composeFile: string): boolea
 }
 
 /** Where a chosen `POSTGRES_PASSWORD` came from. */
-export type PostgresPasswordSource = 'environment' | 'generated' | 'legacy'
+export type PostgresPasswordSource = 'generated' | 'legacy'
 
 export interface PostgresPasswordChoice {
   value: string
   source: PostgresPasswordSource
 }
 
-/**
- * A password the wizard can persist verbatim: Compose interpolates it unescaped
- * into `DATABASE_URL`, and `.env` reinterprets whitespace, comments, quotes and
- * `$`, so only URL-unreserved characters survive both unchanged.
- */
-const PERSISTABLE_PASSWORD = /^[A-Za-z0-9._~-]+$/
-
 interface ChooseOptions {
   /** The shell environment, whose `POSTGRES_PASSWORD` Compose interpolates over `.env`. */
   shell?: NodeJS.ProcessEnv
@@ -47,57 +40,35 @@ interface ChooseOptions {
 
 /**
  * Picks the `POSTGRES_PASSWORD` to write to a Compose install's `.env`, or null
- * when `.env` already has the right one. The production Compose file requires
- * the variable, and the value must match what the data volume was created with —
+ * when nothing should be written. The production Compose file requires the
+ * variable, and the value must match what the data volume was created with —
  * Postgres ignores `POSTGRES_PASSWORD` on an existing data directory, so a
  * wrong value locks the app out of its own database:
  *
- * - A value exported in the shell is what Compose is using. It is persisted when
- *   `.env` has none, so a later run without the export does not fall back to a
- *   guess. An empty export, one that differs from `.env`, or one `.env` cannot
- *   hold verbatim is refused: which value the volume was created with cannot be
- *   known, and either silent choice can lock the app out.
- * - With no value anywhere, an existing volume was created with the legacy
- *   password, and a project with no volume yet gets a generated one.
+ * - A value exported in the shell is the operator's to manage: Compose
+ *   interpolates it over `.env`, so nothing is written. An empty export is
+ *   refused, because Compose would use the empty value and refuse to start
+ *   however good the one in `.env` is.
+ * - Otherwise a value in `.env` stands, an existing volume was created with the
+ *   legacy password the file used to default to, and a project with no volume
+ *   yet gets a generated one.
  */
 export function choosePostgresPassword(
   envFileValue: string | undefined,
   project: string,
   { shell = process.env, hasDatabaseVolume = composeDatabaseVolumeExists }: ChooseOptions = {}
 ): PostgresPasswordChoice | null {
   const shellValue = shell.POSTGRES_PASSWORD
-  if (shellValue === undefined) {
-    if (envFileValue) return null
-    return hasDatabaseVolume(project)
-      ? { value: LEGACY_POSTGRES_PASSWORD, source: 'legacy' }
-      : { value: generateSecret(), source: 'generated' }
-  }
   if (shellValue === '') {
     throw new SetupError(
       'POSTGRES_PASSWORD is exported but empty, and Compose uses it over .env.',
       ['unset it (unset POSTGRES_PASSWORD) so the value in .env applies']
     )
   }
-  if (envFileValue) {
-    if (envFileValue === shellValue) return null
-    throw new SetupError(
-      'POSTGRES_PASSWORD in the shell differs from the one in .env, so it is unclear which one the database was created with.',
-      [
-        'unset the exported POSTGRES_PASSWORD if .env holds the database password',
-        'or set the exported value in .env if that is the database password',
-      ]
-    )
-  }
-  if (!PERSISTABLE_PASSWORD.test(shellValue)) {
-    throw new SetupError(
-      'POSTGRES_PASSWORD is exported only in the shell, and contains characters that cannot be stored in .env and embedded in DATABASE_URL unchanged.',
-      [
-        'use only letters, digits and . _ ~ - (for a new install: openssl rand -hex 24)',
-        'or add it to .env yourself if you have confirmed it works in a connection URL',
-      ]
-    )
-  }
-  return { value: shellValue, source: 'environment' }
+  if (shellValue !== undefined || envFileValue) return null
+  return hasDatabaseVolume(project)
+    ? { value: LEGACY_POSTGRES_PASSWORD, source: 'legacy' }
+    : { value: generateSecret(), source: 'generated' }
 }
 
 /** Whether a Compose project already has a Postgres data volume, found by Compose's own labels. */
@@ -159,10 +130,6 @@ export function reportPostgresPasswordChoice(
   choice: PostgresPasswordChoice,
   { compose, user, envPath }: { compose: string; user: string; envPath: string }
 ): void {
-  if (choice.source === 'environment') {
-    p.log.step(`Saved POSTGRES_PASSWORD from the shell environment to ${envPath}`)
-    return
-  }
   if (choice.source === 'generated') {
     p.log.step(`Generated POSTGRES_PASSWORD in ${envPath}`)
     return