Repository navigation
fix(db): resolve DB URL without ConfigParser interpolation - #19
Merged
thecaffiend merged 2 commits intoJul 22, 2026
Merged
thecaffiend merged 2 commits into
thecaffiend merged 2 commits into
Conversation
Routing the DB URL through Alembic's Config backed it with a ConfigParser using BasicInterpolation, so any '%' in a percent-encoded password raised InterpolationSyntaxError before a connection was attempted. - add side-effect-free resolve_db_url helper in cape_cod_db/db_url.py and stop calling set_main_option; pass the resolved URL straight to the engine and context - online migrations use create_engine; offline passes url= directly - database.py imports the resolved db_url instead of get_main_option, preserving its DB_URL env fallback - mask the password in configuration logs via render_as_string(hide_password=True) - add pytest and regression tests covering percent-encoded passwords Fixes #18
- DB URL resolution decoupled from ConfigParser interpolation - DB password masked in env.py/database.py logs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #18.
env.pyrouted the DB URL through Alembic'sConfig, backed by aConfigParserusingBasicInterpolation, so any%in a percent-encoded password raisedInterpolationSyntaxErrorbefore a connection was attempted. Percent-encoding is unavoidable for passwords containing@ : / <space>etc., and a literal%(e.g. an AWS-rotated RDS password) encodes to%25, so this broke a whole class of valid passwords.env.py / db_url.py
resolve_db_urlhelper incape_cod_db/db_url.py; stop callingset_main_optionand re-reading through the interpolating parser.create_engine(db_url, ...); offline passesurl=db_urldirectly tocontext.configure.database.py
db_urlfromenv.pyinstead ofconfig.get_main_option; the existingDB_URLenv fallback still works.security
make_url(db_url).render_as_string(hide_password=True)in bothenv.pyanddatabase.py.tests / docs
pytestand a regression test covering percent-encoded passwords (% @ : / <space> # ?plus a combined case), assertingmake_url(url).passwordround-trips.Verification
poetry run ruff check,poetry run pyright, andpoetry run pytestall pass. Confirmedmake_url("postgresql://user:p%25ss%40word@host/db").password == "p%ss@word"and that the config log rendersuser:***.Related
Once released,
cape-ph/cape-cod-envcan drop its%%workaround inroles/common/tasks/resolve_db_url.yamland pass the plain percent-encoded URL.