feat(webapp,database): opt-in per-client Prisma driver adapters - #4539
Conversation
Add per-client env vars to route each Prisma client through @prisma/adapter-pg (node-postgres) instead of the built-in engine driver. All default off, so behavior is unchanged unless a flag is set: - CONTROL_PLANE_DATABASE_WRITER_DRIVER_ADAPTER - CONTROL_PLANE_DATABASE_REPLICA_DRIVER_ADAPTER - RUN_OPS_DATABASE_WRITER_DRIVER_ADAPTER - RUN_OPS_DATABASE_REPLICA_DRIVER_ADAPTER - RUN_OPS_LEGACY_DATABASE_WRITER_DRIVER_ADAPTER - RUN_OPS_LEGACY_DATABASE_REPLICA_DRIVER_ADAPTER Enables the driverAdapters preview feature on both schemas (keeps the Rust query engine; does not add queryCompiler). Each adapter pool is built with a bounded connectionTimeoutMillis and an onPoolError handler. Handle the connect-failure differences the adapter introduces: - isInfrastructureError now recognizes the adapter's connect-failure shapes (P2010 'not reachable' and raw ECONNREFUSED/ENOTFOUND-class errors) so the DB host is still scrubbed from API-client errors and infra failures are logged. - isPrismaRetriableError treats the adapter pool-acquire timeout as retriable, preserving the P2024 retry behavior. refs TRI-13039 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe web application adds optional PostgreSQL driver-adapter support for control-plane, run-ops, and legacy run-ops Prisma writers and replicas. Environment flags independently enable each adapter. Adapter-backed clients use configured PostgreSQL pools. Default behavior continues to use datasource URLs. Prisma generators and package dependencies are updated. Connectivity detection handles adapter timeout messages, network errors, and connectivity-related 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
- Pass the per-client resolved connection limit into the adapter pool instead of always using DATABASE_CONNECTION_LIMIT, so per-client overrides (e.g. RUN_OPS_DATABASE_READ_REPLICA_CONNECTION_LIMIT) are honored on the adapter path. - Build the adapter pool from the base DSN (drops prisma-only URL params the pg driver ignores and the duplicate application_name). - Scope the connectivity message match to 'database not reachable' so a generic 'not reachable' error is no longer misclassified as infrastructure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
- Pass the datasource schema (?schema=) to PrismaPg as its {schema} option so
custom-schema installs keep talking to the right schema on the adapter (the
adapter does not honor ?schema= in the connection string).
- Set disposeExternalPool: true so $disconnect() closes the pg pool instead of
leaking sockets, matching the engine-driver path.
- Guard the two $metrics consumers (the /metrics route and the OTel batch
observable callback) so a client on a driver adapter degrades to empty metrics
instead of failing the scrape / rejecting the callback.
- isPrismaRetriableError checks the adapter acquire-timeout message independently
of the coded-error branch, so the pool-acquire retry still engages if the
timeout arrives wrapped as a coded error.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Observability mapAs of 18/100 over 413 measured of 429 entry points (base 18, no change) What this PR changed FIX FIRST
AUDIT 3 of 50 sensitive mutations record an actor. 47 without one. What the score is made ofThe score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
The retry decision used retryCodes.includes(error.code) directly, inside the isPrismaKnownError branch, so the broadened isPrismaRetriableError check never governed retries. Route the retry decision through isPrismaRetriableError so the adapter's pool-acquire timeout is retried like P2024 was, while keeping prismaError()/swallow behavior for coded errors only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…r drainer isRetryablePgError only recognized the Rust engine's DB-unreachable shapes (P1001 / "Can't reach database server"). Under a driver adapter the same outage surfaces as P2010 "Database not reachable" / ECONNREFUSED / ENOTFOUND, so buffered runs were permanently failed on a transient outage. Reuse the shared looksLikeConnectivityError predicate (now exported from prismaErrors) so those are retried too. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 participants
What
Adds an opt-in path to run each Prisma client through
@prisma/adapter-pg(the node-postgres driver) instead of the built-in engine driver, controlled by a per-client env var, all off by default:CONTROL_PLANE_DATABASE_WRITER_DRIVER_ADAPTERCONTROL_PLANE_DATABASE_REPLICA_DRIVER_ADAPTERRUN_OPS_DATABASE_WRITER_DRIVER_ADAPTERRUN_OPS_DATABASE_REPLICA_DRIVER_ADAPTERRUN_OPS_LEGACY_DATABASE_WRITER_DRIVER_ADAPTERRUN_OPS_LEGACY_DATABASE_REPLICA_DRIVER_ADAPTERWith every flag unset the construction path is byte-identical to today (
datasourcesURL + Rust engine), so this is inert until a flag is turned on. Per-client granularity allows enabling the adapter only where it's wanted.How
driverAdapterspreview feature on both schemas (@trigger.dev/databaseand@internal/run-ops-database). This keeps the Rust query engine — it does NOT addqueryCompiler— so query behavior, result types, and engine tracing spans are unchanged.buildDriverAdapterPoolbuilds each client'spg.Poolwith an explicitmax, a boundedconnectionTimeoutMillis(the node-postgres pool otherwise waits unbounded on acquire), and anonPoolErrorhandler (an unhandled idle-connection error would otherwise crash the process). Threaded through all four client builders via auseDriverAdapterflag.@prisma/adapter-pg+@types/pgto the webapp;pgis already pinned at8.15.6(adapter-pg 6.x requirespg < 8.17).Connect-failure handling (the important correctness/security bit)
Under the adapter an unreachable DB no longer surfaces as
PrismaClientInitializationError/P1001; it becomes aP2010"Database not reachable: " (or a rawECONNREFUSED/ENOTFOUND-class error). Two handlers are updated so a client on the adapter behaves like today:isInfrastructureErrornow recognizes those shapes (P2010 with a connectivity message, and raw connectivity errno codes). Without this, the DB hostname would leak into API-client-facing errors and the failure would go unlogged. Security-relevant.isPrismaRetriableErrortreats the adapter's pool-acquire timeout ("timeout exceeded when trying to connect") as retriable, preserving theP2024retry behavior the adapter otherwise drops.Evidence
Validated on an isolated stack that mirrors the production DB topology (chained PgBouncers in front of writer + reader):
metaare byte-identical between the engine driver and the adapter across the queried shapes (unique-constraintmeta.target, record-not-found, transaction-timeout, serialization-failure, etc.).Rollout / rollback
All flags default off; enable per client via env var, roll back by unsetting and redeploying (no data migration). Recommended first target is a single writer; enable one client at a time.
Follow-ups (not in this PR)
$metrics-based pool observability is removed under the adapter (the Prometheus route +db.pool.connections.*instruments); the metrics replacement (viapg.Poolcounters) lands in a separate PR.maxWaitdoes not bound pool acquisition —connectionTimeoutMillisdoes.Note on connection-string parameters
The adapter pool is built from the base DSN, so Prisma-specific DSN parameters that node-postgres does not understand are not honored when a client is on the adapter:
sslaccept,sslcert, etc.) — node-postgres usessslmode/sslinstead. Our production DSNs do not use these Prisma-specific TLS params, but any deployment whose DSN relies on them must be checked before enabling a flag.pgbouncer=trueandstatement_cache_size— effectively moot under the adapter, which uses no persistent named prepared statements.connection_limit,pool_timeout, andschemaare handled explicitly (passed asmax/connectionTimeoutMillisand PrismaPg's{schema}option).refs TRI-13039