Skip to content

feat(dashboard-api): supabase auth users sync background runner #2247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ben-fornefeld wants to merge 23 commits into
base: main
Choose a base branch
from
Open

feat(dashboard-api): supabase auth users sync background runner #2247

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
c50d248
feat: supabase auth users sync background runner in dashboard api
ben-fornefeld Mar 28, 2026
68a6265
chore: auto-commit generated changes
github-actions[bot] Mar 28, 2026
9d8fe63
feat(db): enhance auth user sync triggers to retain direct operations…
ben-fornefeld Mar 30, 2026
1e5f28b
Merge branch 'feature/supabase-users-sync-worker' of https://github.c…
ben-fornefeld Mar 30, 2026
56154df
feat(sync): implement user sync queue with enhanced error handling an…
ben-fornefeld Mar 30, 2026
3a431aa
feat(sync): add supabase auth user sync configuration and secrets man…
ben-fornefeld Mar 31, 2026
eb69678
chore: remove smoke test
ben-fornefeld Mar 31, 2026
bb9fa39
add: e2e runner test
ben-fornefeld Mar 31, 2026
461d2ec
chore: change dashboard-api env variable management
ben-fornefeld Mar 31, 2026
ce0cbd1
refactor(sync): update user sync logic to utilize new database structure
ben-fornefeld Mar 31, 2026
4d622ce
fix: lint
ben-fornefeld Mar 31, 2026
84ecd06
test: apply database migrations in end-to-end test setup
ben-fornefeld Mar 31, 2026
3f56979
Merge origin/main into feature/supabase-users-sync-worker
ben-fornefeld Apr 1, 2026
386d0c6
feat(sync): enhance user sync processing and acknowledgment
ben-fornefeld Apr 1, 2026
3e3fa3c
refactor(gcp): remove auth_db_connection_string resources and update …
ben-fornefeld Apr 1, 2026
5e0972b
chore(dashboard-api): refactor environment variable management
ben-fornefeld Apr 1, 2026
6b5a5c8
refactor: use river for queue worker
ben-fornefeld Apr 1, 2026
1113654
chore: auto-commit generated changes
github-actions[bot] Apr 1, 2026
fb0afd4
chore: auto-commit generated changes
github-actions[bot] Apr 1, 2026
bd4dd80
chore: update pgx dependency to v5.9.1 and golang.org/x/mod to v0.34.…
ben-fornefeld Apr 1, 2026
97e305a
Merge branch 'feature/supabase-users-sync-worker' of https://github.c…
ben-fornefeld Apr 1, 2026
c98878f
chore: fix lint
ben-fornefeld Apr 2, 2026
e314b96
chore: auto-commit generated changes
github-actions[bot] Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .env.gcp.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,9 @@ CLICKHOUSE_CLUSTER_SIZE=1

# Dashboard API instance count (default: 0)
DASHBOARD_API_COUNT=
# Additional dashboard-api env vars passed directly to the Nomad job (default: {})
# Example: '{"SUPABASE_AUTH_USER_SYNC_ENABLED":"true"}'
DASHBOARD_API_ENV_VARS=

# Filestore cache for builds shared across cluster (default:false)
FILESTORE_CACHE_ENABLED=
Expand Down
4 changes: 4 additions & 0 deletions iac/modules/job-dashboard-api/jobs/dashboard-api.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,10 @@ job "dashboard-api" {
SUPABASE_JWT_SECRETS = "${supabase_jwt_secrets}"
OTEL_COLLECTOR_GRPC_ENDPOINT = "${otel_collector_grpc_endpoint}"
LOGS_COLLECTOR_ADDRESS = "${logs_collector_address}"

%{ for key, val in env }
${ key } = "${ val }"
%{ endfor }
Copy link
Copy Markdown

@claude claude bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The %{ for key, val in env } loop in dashboard-api.hcl renders env var values directly inside double-quoted HCL strings without escaping. A value containing a double-quote produces syntactically invalid HCL (Nomad job submission fails), and a value containing ${ causes Terraform templatefile() to attempt expression evaluation at render time (plan-time error). DASHBOARD_API_ENV_VARS is documented as accepting arbitrary operator-supplied values, making these characters plausible; fix by escaping double-quotes in values or passing extra env vars via a Nomad template stanza instead.

Extended reasoning...

What the bug is and how it manifests

In iac/modules/job-dashboard-api/jobs/dashboard-api.hcl lines 86-88, a Terraform templatefile() directive renders arbitrary env var values directly inside double-quoted HCL strings:

%{ for key, val in env }
${ key }   = "${ val }"
%{ endfor }

Two distinct injection vectors exist. First, if val contains a double-quote character, the rendered output becomes syntactically invalid HCL (e.g. MY_VAR = "conn"string" breaks the HCL parser), causing Nomad to reject the job spec at submit time. Second, if val contains ${, Terraform's templatefile() function interprets it as an expression interpolation during template rendering and produces a plan-time error before the job is ever submitted.

The specific code path that triggers it

The value flows through: DASHBOARD_API_ENV_VARS env var -> parsed as map(string) in iac/provider-gcp/variables.tf -> passed to module.nomad as dashboard_api_env_vars -> passed to module.dashboard_api as env -> filtered in local.env in main.tf (removes null/empty only) -> passed to templatefile() -> rendered at line 87 with no escaping.

Why existing code does not prevent it

The locals block in main.tf only filters out null/empty values (if value != null && value != ""); it does not escape or sanitize values. Terraform's templatefile() does not automatically escape template variable contents when they are interpolated. The HCL string delimiters are hard-coded double quotes with no escaping mechanism.

What the impact would be

For a double-quote injection (e.g. a PostgreSQL DSN like postgresql://user:p"ass@host/db), the Nomad job submission fails at terraform apply time with an HCL parse error -- the deployment is blocked. For a ${ injection (e.g. a JWT secret or template string containing ${), Terraform fails during plan or apply with an evaluation error. Neither failure is silent, but both are surprising and difficult to debug without knowing the root cause.

How to fix it

The safest fix is to use replace(val, "\"", "\\\"") to escape double-quotes within the current templatefile() approach, or pass extra env vars through a Nomad template stanza which has proper escaping semantics. The ${ vector can be addressed by replacing ${ with $${ (Terraform's escape sequence for a literal ${).

Step-by-step proof

  1. Operator sets DASHBOARD_API_ENV_VARS='{"DB_URL":"postgresql://user:p\"ass@host/db"}' in their env file.
  2. Terraform receives var.dashboard_api_env_vars = {DB_URL = "postgresql://user:p\"ass@host/db"}.
  3. local.env passes it through unchanged (non-null, non-empty).
  4. templatefile() renders line 87 as: DB_URL = "postgresql://user:p"ass@host/db" -- the embedded " terminates the HCL string prematurely.
  5. Nomad's job spec parser receives invalid HCL and rejects the job with a parse error.
  6. Alternatively, for a value containing ${SOME_VAR}: templatefile() evaluates ${SOME_VAR} as a Terraform expression, returning an undefined variable error during terraform apply.

Note: the identical ${ key } = "${ value }" pattern exists in job-api and job-orchestrator for their job_env_vars, but those maps contain hardcoded infrastructure constants (VOLUME_TOKEN_ISSUER, etc.) unlikely to contain special characters. The new DASHBOARD_API_ENV_VARS is explicitly documented as a freeform map for arbitrary operator-supplied values, removing that safety assumption.

}

config {
Expand Down
5 changes: 5 additions & 0 deletions iac/modules/job-dashboard-api/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
locals {
env = { for key, value in var.env : key => value if value != null && value != "" }
}

Copy link
Copy Markdown

@cursor cursor bot Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unused environment variable passed to HCL template

Low Severity

The environment = var.environment is still passed to templatefile() but is no longer referenced in dashboard-api.hcl. After the refactor, ENVIRONMENT is set via local.base_env through the env map loop. This is dead code left over from the migration.

Fix in Cursor Fix in Web

resource "nomad_job" "dashboard_api" {
jobspec = templatefile("${path.module}/jobs/dashboard-api.hcl", {
update_stanza = var.update_stanza
Expand All @@ -15,6 +19,7 @@ resource "nomad_job" "dashboard_api" {
auth_db_read_replica_connection_string = var.auth_db_read_replica_connection_string
clickhouse_connection_string = var.clickhouse_connection_string
supabase_jwt_secrets = var.supabase_jwt_secrets
env = local.env

subdomain = "dashboard-api"

Expand Down
5 changes: 5 additions & 0 deletions iac/modules/job-dashboard-api/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,11 @@ variable "supabase_jwt_secrets" {
sensitive = true
}

variable "env" {
type = map(string)
default = {}
}

variable "otel_collector_grpc_port" {
type = number
default = 4317
Expand Down
1 change: 1 addition & 0 deletions iac/provider-gcp/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@ tf_vars := \
$(call tfvar, LOKI_BOOT_DISK_TYPE) \
$(call tfvar, LOKI_USE_V13_SCHEMA_FROM) \
$(call tfvar, DASHBOARD_API_COUNT) \
$(call tfvar, DASHBOARD_API_ENV_VARS) \
$(call tfvar, DEFAULT_PERSISTENT_VOLUME_TYPE) \
$(call tfvar, PERSISTENT_VOLUME_TYPES) \
$(call tfvar, DB_MAX_OPEN_CONNECTIONS) \
Expand Down
17 changes: 17 additions & 0 deletions iac/provider-gcp/api.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,23 @@ resource "google_secret_manager_secret_version" "postgres_read_replica_connectio
}
}

resource "google_secret_manager_secret" "auth_db_connection_string" {
secret_id = "${var.prefix}auth-db-connection-string"

replication {
auto {}
}
}

resource "google_secret_manager_secret_version" "auth_db_connection_string" {
secret = google_secret_manager_secret.auth_db_connection_string.name
secret_data = " "

lifecycle {
ignore_changes = [secret_data]
}
}

resource "random_password" "api_secret" {
length = 32
special = false
Expand Down
4 changes: 3 additions & 1 deletion iac/provider-gcp/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,7 @@ module "nomad" {
api_secret = random_password.api_secret.result
custom_envs_repository_name = google_artifact_registry_repository.custom_environments_repository.name
postgres_connection_string_secret_name = module.init.postgres_connection_string_secret_name
auth_db_connection_string_secret_version = google_secret_manager_secret_version.auth_db_connection_string
postgres_read_replica_connection_string_secret_version = google_secret_manager_secret_version.postgres_read_replica_connection_string
supabase_jwt_secrets_secret_name = module.init.supabase_jwt_secret_name
posthog_api_key_secret_name = module.init.posthog_api_key_secret_name
Expand Down Expand Up @@ -264,7 +265,8 @@ module "nomad" {
otel_collector_resources_cpu_count = var.otel_collector_resources_cpu_count

# Dashboard API
dashboard_api_count = var.dashboard_api_count
dashboard_api_count = var.dashboard_api_count
dashboard_api_env_vars = var.dashboard_api_env_vars

# Docker reverse proxy
docker_reverse_proxy_port = var.docker_reverse_proxy_port
Expand Down
7 changes: 6 additions & 1 deletion iac/provider-gcp/nomad/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ data "google_secret_manager_secret_version" "postgres_connection_string" {
secret = var.postgres_connection_string_secret_name
}

data "google_secret_manager_secret_version" "auth_db_connection_string" {
secret = var.auth_db_connection_string_secret_version.secret
}

data "google_secret_manager_secret_version" "postgres_read_replica_connection_string" {
secret = var.postgres_read_replica_connection_string_secret_version.secret
}
Expand Down Expand Up @@ -131,10 +135,11 @@ module "dashboard_api" {
image = data.google_artifact_registry_docker_image.dashboard_api_image[0].self_link

postgres_connection_string = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
auth_db_connection_string = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
auth_db_connection_string = trimspace(data.google_secret_manager_secret_version.auth_db_connection_string.secret_data)
auth_db_read_replica_connection_string = trimspace(data.google_secret_manager_secret_version.postgres_read_replica_connection_string.secret_data)
clickhouse_connection_string = local.clickhouse_connection_string
supabase_jwt_secrets = trimspace(data.google_secret_manager_secret_version.supabase_jwt_secrets.secret_data)
env = var.dashboard_api_env_vars

otel_collector_grpc_port = var.otel_collector_grpc_port
logs_proxy_port = var.logs_proxy_port
Expand Down
9 changes: 9 additions & 0 deletions iac/provider-gcp/nomad/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,10 @@ variable "postgres_connection_string_secret_name" {
type = string
}

variable "auth_db_connection_string_secret_version" {
type = any
}

variable "postgres_read_replica_connection_string_secret_version" {
type = any
}
Expand Down Expand Up @@ -453,6 +457,11 @@ variable "dashboard_api_count" {
default = 0
}

variable "dashboard_api_env_vars" {
type = map(string)
default = {}
}

variable "volume_token_issuer" {
type = string
}
Expand Down
5 changes: 5 additions & 0 deletions iac/provider-gcp/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,11 @@ variable "dashboard_api_count" {
default = 0
}

variable "dashboard_api_env_vars" {
type = map(string)
default = {}
}

variable "docker_reverse_proxy_port" {
type = object({
name = string
Expand Down
2 changes: 1 addition & 1 deletion packages/dashboard-api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ require (
github.com/jackc/pgx/v5 v5.7.5
github.com/oapi-codegen/gin-middleware v1.0.2
github.com/oapi-codegen/runtime v1.1.1
github.com/stretchr/testify v1.11.1
go.uber.org/zap v1.27.1
)

Expand Down Expand Up @@ -117,7 +118,6 @@ require (
github.com/shirou/gopsutil/v4 v4.25.9 // indirect
github.com/shopspring/decimal v1.4.0 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/stretchr/testify v1.11.1 // indirect
github.com/testcontainers/testcontainers-go v0.40.0 // indirect
github.com/testcontainers/testcontainers-go/modules/postgres v0.39.0 // indirect
github.com/tklauser/go-sysconf v0.3.15 // indirect
Expand Down
6 changes: 3 additions & 3 deletions packages/dashboard-api/internal/cfg/model.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
package cfg

import (
"github.com/caarlos0/env/v11"
)
import "github.com/caarlos0/env/v11"

type Config struct {
Port int `env:"PORT" envDefault:"3010"`
Expand All @@ -12,6 +10,8 @@ type Config struct {

AuthDBConnectionString string `env:"AUTH_DB_CONNECTION_STRING"`
AuthDBReadReplicaConnectionString string `env:"AUTH_DB_READ_REPLICA_CONNECTION_STRING"`

SupabaseAuthUserSyncEnabled bool `env:"SUPABASE_AUTH_USER_SYNC_ENABLED" envDefault:"false"`
}

func Parse() (Config, error) {
Expand Down
28 changes: 28 additions & 0 deletions packages/dashboard-api/internal/supabaseauthusersync/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
package supabaseauthusersync

import "time"

const (
defaultBatchSize int32 = 50
defaultPollInterval time.Duration = 2 * time.Second
defaultLockTimeout time.Duration = 2 * time.Minute
defaultMaxAttempts int32 = 20
)

type Config struct {
Enabled bool
BatchSize int32
PollInterval time.Duration
LockTimeout time.Duration
MaxAttempts int32
}

func DefaultConfig() Config {
return Config{
Enabled: false,
BatchSize: defaultBatchSize,
PollInterval: defaultPollInterval,
LockTimeout: defaultLockTimeout,
MaxAttempts: defaultMaxAttempts,
}
}
Loading
Loading