Database

Updated to just use DATABASE_* in everything other than local docker.

src/lib/db/mysql-pool-config.ts

@@ -1,31 +1,64 @@
 /**
- * Builds the `mariadb` pool config from `DATABASE_URL`, shared by every
- * Prisma Client instance in the app (the main app client, the seed
- * script, and the integration-test fixtures) so the UTC-timezone and
- * connection-limit handling can't drift between them. See
+ * Builds the `mariadb` pool config from the discrete `DATABASE_HOST` /
+ * `DATABASE_PORT` / `DATABASE_NAME` / `DATABASE_USER` / `DATABASE_PASSWORD`
+ * env vars, shared by every Prisma Client instance in the app (the main
+ * app client, the seed script, and the integration-test fixtures) so the
+ * UTC-timezone and connection-limit handling can't drift between them. See
  * src/lib/db/prisma.ts for why `timezone`/`sessionVariables` matter — this
  * file exists only because that reasoning needs to apply to all three
  * call sites, not because the logic itself is complex.
  */
-export function buildMysqlPoolConfig(databaseUrl: string | undefined) {
-  if (!databaseUrl) throw new Error("DATABASE_URL is not set.");
+export function buildMysqlPoolConfig() {
+  const host = process.env.DATABASE_HOST;
+  const database = process.env.DATABASE_NAME;
+  const user = process.env.DATABASE_USER;
+  const password = process.env.DATABASE_PASSWORD;
 
-  // Accept both `mysql://` and `mariadb://` — the `mariadb` driver's own
-  // string parser only recognizes the latter, but the `URL` global parses
-  // either scheme fine since we build the pool config object ourselves.
-  const url = new URL(databaseUrl);
+  if (!host || !database || !user || password === undefined) {
+    throw new Error(
+      "Database connection is not configured. Set DATABASE_HOST, DATABASE_NAME, DATABASE_USER, and DATABASE_PASSWORD (DATABASE_PORT is optional, defaults to 3306).",
+    );
+  }
 
   return {
-    host: url.hostname,
-    port: url.port ? Number(url.port) : 3306,
-    user: decodeURIComponent(url.username),
-    password: decodeURIComponent(url.password),
-    database: url.pathname.replace(/^\//, ""),
+    host,
+    port: process.env.DATABASE_PORT ? Number(process.env.DATABASE_PORT) : 3306,
+    user,
+    password,
+    database,
     connectionLimit: Number(process.env.DATABASE_CONNECTION_LIMIT ?? 5),
     connectTimeout: Number(process.env.DATABASE_CONNECT_TIMEOUT_MS ?? 10_000),
     // Load-bearing, not cosmetic — see src/lib/db/prisma.ts's file header.
     timezone: "Etc/UTC",
     sessionVariables: { time_zone: "+00:00" },
     ssl: process.env.DATABASE_SSL === "true" ? { rejectUnauthorized: true } : undefined,
+    // MySQL 8's default auth plugin (caching_sha2_password) needs to send
+    // the client its RSA public key to encrypt the password, and the
+    // `mariadb` driver refuses to fetch it over a plain connection unless
+    // told to — surfacing as "Public Key Retrieval is not allowed" on
+    // every connection attempt (not intermittent, not env-specific: it
+    // fires against any caching_sha2_password server whenever DATABASE_SSL
+    // isn't "true"). Opting in doesn't weaken authentication itself, only
+    // lets the client ask for that public key; a connection that's already
+    // on `ssl` above doesn't need this exchange in the first place.
+    allowPublicKeyRetrieval: true,
   };
 }
+
+/**
+ * Builds a `mysql://` connection string from the same discrete env vars,
+ * for the one place that genuinely needs a URL rather than a pool config
+ * object: prisma.config.ts, whose `datasource.url` is a plain string
+ * because the Prisma CLI (migrate/introspect) doesn't accept discrete
+ * connection fields.
+ */
+export function buildMysqlConnectionUrl(): string | undefined {
+  const host = process.env.DATABASE_HOST;
+  const database = process.env.DATABASE_NAME;
+  const user = process.env.DATABASE_USER;
+  const password = process.env.DATABASE_PASSWORD;
+  if (!host || !database || !user || password === undefined) return undefined;
+
+  const port = process.env.DATABASE_PORT || "3306";
+  return `mysql://${encodeURIComponent(user)}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
+}

src/lib/db/prisma.ts

@@ -28,7 +28,7 @@ const globalForPrisma = globalThis as unknown as {
   prisma: PrismaClient | undefined;
 };
 
-const adapter = new PrismaMariaDb(buildMysqlPoolConfig(process.env.DATABASE_URL));
+const adapter = new PrismaMariaDb(buildMysqlPoolConfig());
 
 export const prisma =
   globalForPrisma.prisma ??