feat(dashboard-api): supabase auth users sync background runner

iac/modules/job-dashboard-api/jobs/dashboard-api.hcl

@@ -80,6 +80,7 @@ job "dashboard-api" {
         AUTH_DB_READ_REPLICA_CONNECTION_STRING = "${auth_db_read_replica_connection_string}"
         CLICKHOUSE_CONNECTION_STRING           = "${clickhouse_connection_string}"
         SUPABASE_JWT_SECRETS                   = "${supabase_jwt_secrets}"
+        SUPABASE_AUTH_USER_SYNC_ENABLED        = "${supabase_auth_user_sync_enabled}"
         OTEL_COLLECTOR_GRPC_ENDPOINT           = "${otel_collector_grpc_endpoint}"
         LOGS_COLLECTOR_ADDRESS                 = "${logs_collector_address}"
       }

iac/modules/job-dashboard-api/main.tf

@@ -15,6 +15,7 @@ resource "nomad_job" "dashboard_api" {
     auth_db_read_replica_connection_string = var.auth_db_read_replica_connection_string
     clickhouse_connection_string           = var.clickhouse_connection_string
     supabase_jwt_secrets                   = var.supabase_jwt_secrets
+    supabase_auth_user_sync_enabled        = var.supabase_auth_user_sync_enabled
 
     subdomain = "dashboard-api"
 

iac/modules/job-dashboard-api/variables.tf

@@ -44,6 +44,10 @@ variable "supabase_jwt_secrets" {
   sensitive = true
 }
 
+variable "supabase_auth_user_sync_enabled" {
+  type = string
+}
+
 variable "otel_collector_grpc_port" {
   type    = number
   default = 4317

iac/provider-gcp/api.tf

@@ -27,6 +27,40 @@ resource "google_secret_manager_secret_version" "postgres_read_replica_connectio
   }
 }
 
+resource "google_secret_manager_secret" "auth_db_connection_string" {
+  secret_id = "${var.prefix}auth-db-connection-string"
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "auth_db_connection_string" {
+  secret      = google_secret_manager_secret.auth_db_connection_string.name
+  secret_data = " "
+
+  lifecycle {
+    ignore_changes = [secret_data]
+  }
+}
+
+resource "google_secret_manager_secret" "dashboard_api_supabase_auth_user_sync_enabled" {
+  secret_id = "${var.prefix}dashboard-api-supabase-auth-user-sync-enabled"
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "dashboard_api_supabase_auth_user_sync_enabled" {
+  secret      = google_secret_manager_secret.dashboard_api_supabase_auth_user_sync_enabled.name
+  secret_data = "false"
+
+  lifecycle {
+    ignore_changes = [secret_data]
+  }
+}
+
 resource "random_password" "api_secret" {
   length  = 32
   special = false

iac/provider-gcp/main.tf

@@ -213,31 +213,33 @@ module "nomad" {
   additional_traefik_arguments = var.additional_traefik_arguments
 
   # API
-  api_server_count                                       = var.api_server_count
-  api_resources_cpu_count                                = var.api_resources_cpu_count
-  api_resources_memory_mb                                = var.api_resources_memory_mb
-  api_machine_count                                      = var.api_cluster_size
-  api_node_pool                                          = var.api_node_pool
-  api_port                                               = var.api_port
-  environment                                            = var.environment
-  google_service_account_key                             = module.init.google_service_account_key
-  api_secret                                             = random_password.api_secret.result
-  custom_envs_repository_name                            = google_artifact_registry_repository.custom_environments_repository.name
-  postgres_connection_string_secret_name                 = module.init.postgres_connection_string_secret_name
-  postgres_read_replica_connection_string_secret_version = google_secret_manager_secret_version.postgres_read_replica_connection_string
-  supabase_jwt_secrets_secret_name                       = module.init.supabase_jwt_secret_name
-  posthog_api_key_secret_name                            = module.init.posthog_api_key_secret_name
-  analytics_collector_host_secret_name                   = module.init.analytics_collector_host_secret_name
-  analytics_collector_api_token_secret_name              = module.init.analytics_collector_api_token_secret_name
-  api_admin_token                                        = random_password.api_admin_secret.result
-  redis_cluster_url_secret_version                       = module.init.redis_cluster_url_secret_version
-  redis_tls_ca_base64_secret_version                     = module.init.redis_tls_ca_base64_secret_version
-  sandbox_access_token_hash_seed                         = random_password.sandbox_access_token_hash_seed.result
-  sandbox_storage_backend                                = var.sandbox_storage_backend
-  db_max_open_connections                                = var.db_max_open_connections
-  db_min_idle_connections                                = var.db_min_idle_connections
-  auth_db_max_open_connections                           = var.auth_db_max_open_connections
-  auth_db_min_idle_connections                           = var.auth_db_min_idle_connections
+  api_server_count                                             = var.api_server_count
+  api_resources_cpu_count                                      = var.api_resources_cpu_count
+  api_resources_memory_mb                                      = var.api_resources_memory_mb
+  api_machine_count                                            = var.api_cluster_size
+  api_node_pool                                                = var.api_node_pool
+  api_port                                                     = var.api_port
+  environment                                                  = var.environment
+  google_service_account_key                                   = module.init.google_service_account_key
+  api_secret                                                   = random_password.api_secret.result
+  custom_envs_repository_name                                  = google_artifact_registry_repository.custom_environments_repository.name
+  postgres_connection_string_secret_name                       = module.init.postgres_connection_string_secret_name
+  auth_db_connection_string_secret_version                     = google_secret_manager_secret_version.auth_db_connection_string
+  postgres_read_replica_connection_string_secret_version       = google_secret_manager_secret_version.postgres_read_replica_connection_string
+  supabase_jwt_secrets_secret_name                             = module.init.supabase_jwt_secret_name
+  dashboard_api_supabase_auth_user_sync_enabled_secret_version = google_secret_manager_secret_version.dashboard_api_supabase_auth_user_sync_enabled
+  posthog_api_key_secret_name                                  = module.init.posthog_api_key_secret_name
+  analytics_collector_host_secret_name                         = module.init.analytics_collector_host_secret_name
+  analytics_collector_api_token_secret_name                    = module.init.analytics_collector_api_token_secret_name
+  api_admin_token                                              = random_password.api_admin_secret.result
+  redis_cluster_url_secret_version                             = module.init.redis_cluster_url_secret_version
+  redis_tls_ca_base64_secret_version                           = module.init.redis_tls_ca_base64_secret_version
+  sandbox_access_token_hash_seed                               = random_password.sandbox_access_token_hash_seed.result
+  sandbox_storage_backend                                      = var.sandbox_storage_backend
+  db_max_open_connections                                      = var.db_max_open_connections
+  db_min_idle_connections                                      = var.db_min_idle_connections
+  auth_db_max_open_connections                                 = var.auth_db_max_open_connections
+  auth_db_min_idle_connections                                 = var.auth_db_min_idle_connections
 
   # Click Proxy
   client_proxy_count               = var.client_proxy_count

iac/provider-gcp/nomad/main.tf

@@ -10,6 +10,10 @@ data "google_secret_manager_secret_version" "postgres_connection_string" {
   secret = var.postgres_connection_string_secret_name
 }
 
+data "google_secret_manager_secret_version" "auth_db_connection_string" {
+  secret = var.auth_db_connection_string_secret_version.secret
+}
+
 data "google_secret_manager_secret_version" "postgres_read_replica_connection_string" {
   secret = var.postgres_read_replica_connection_string_secret_version.secret
 }
@@ -18,6 +22,10 @@ data "google_secret_manager_secret_version" "supabase_jwt_secrets" {
   secret = var.supabase_jwt_secrets_secret_name
 }
 
+data "google_secret_manager_secret_version" "dashboard_api_supabase_auth_user_sync_enabled" {
+  secret = var.dashboard_api_supabase_auth_user_sync_enabled_secret_version.secret
+}
+
 data "google_secret_manager_secret_version" "posthog_api_key" {
   secret = var.posthog_api_key_secret_name
 }
@@ -131,10 +139,11 @@ module "dashboard_api" {
   image = data.google_artifact_registry_docker_image.dashboard_api_image[0].self_link
 
   postgres_connection_string             = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
-  auth_db_connection_string              = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
+  auth_db_connection_string              = trimspace(data.google_secret_manager_secret_version.auth_db_connection_string.secret_data)
   auth_db_read_replica_connection_string = trimspace(data.google_secret_manager_secret_version.postgres_read_replica_connection_string.secret_data)
   clickhouse_connection_string           = local.clickhouse_connection_string
   supabase_jwt_secrets                   = trimspace(data.google_secret_manager_secret_version.supabase_jwt_secrets.secret_data)
+  supabase_auth_user_sync_enabled        = trimspace(data.google_secret_manager_secret_version.dashboard_api_supabase_auth_user_sync_enabled.secret_data)
 
   otel_collector_grpc_port = var.otel_collector_grpc_port
   logs_proxy_port          = var.logs_proxy_port

iac/provider-gcp/nomad/variables.tf

@@ -175,6 +175,10 @@ variable "postgres_connection_string_secret_name" {
   type = string
 }
 
+variable "auth_db_connection_string_secret_version" {
+  type = any
+}
+
 variable "postgres_read_replica_connection_string_secret_version" {
   type = any
 }
@@ -183,6 +187,10 @@ variable "supabase_jwt_secrets_secret_name" {
   type = string
 }
 
+variable "dashboard_api_supabase_auth_user_sync_enabled_secret_version" {
+  type = any
+}
+
 variable "client_proxy_count" {
   type = number
 }

packages/dashboard-api/go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/jackc/pgx/v5 v5.7.5
 	github.com/oapi-codegen/gin-middleware v1.0.2
 	github.com/oapi-codegen/runtime v1.1.1
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.1
 )
 
@@ -117,7 +118,6 @@ require (
 	github.com/shirou/gopsutil/v4 v4.25.9 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/testcontainers/testcontainers-go v0.40.0 // indirect
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0 // indirect
 	github.com/tklauser/go-sysconf v0.3.15 // indirect

packages/dashboard-api/internal/cfg/model.go

@@ -1,8 +1,6 @@
 package cfg
 
-import (
-	"github.com/caarlos0/env/v11"
-)
+import "github.com/caarlos0/env/v11"
 
 type Config struct {
 	Port                       int      `env:"PORT"                                         envDefault:"3010"`
@@ -12,6 +10,8 @@ type Config struct {
 
 	AuthDBConnectionString            string `env:"AUTH_DB_CONNECTION_STRING"`
 	AuthDBReadReplicaConnectionString string `env:"AUTH_DB_READ_REPLICA_CONNECTION_STRING"`
+
+	SupabaseAuthUserSyncEnabled bool `env:"SUPABASE_AUTH_USER_SYNC_ENABLED" envDefault:"false"`
 }
 
 func Parse() (Config, error) {

packages/dashboard-api/internal/supabaseauthusersync/config.go

@@ -0,0 +1,28 @@
+package supabaseauthusersync
+
+import "time"
+
+const (
+	defaultBatchSize    int32         = 50
+	defaultPollInterval time.Duration = 2 * time.Second
+	defaultLockTimeout  time.Duration = 2 * time.Minute
+	defaultMaxAttempts  int32         = 20
+)
+
+type Config struct {
+	Enabled      bool
+	BatchSize    int32
+	PollInterval time.Duration
+	LockTimeout  time.Duration
+	MaxAttempts  int32
+}
+
+func DefaultConfig() Config {
+	return Config{
+		Enabled:      false,
+		BatchSize:    defaultBatchSize,
+		PollInterval: defaultPollInterval,
+		LockTimeout:  defaultLockTimeout,
+		MaxAttempts:  defaultMaxAttempts,
+	}
+}