secrets: DSN_REWRITE superset fix — map real dw_admin PG key names to DATABASE_URL so DB rotation rewrites the DSN (TK-10045, fixes half-fire)

28bb6243b9ce41f1a121cceda345d436b611388f · 2026-07-30 15:22:58 -0700 · steve@designerwallcoverings.com

Files touched

M cli.js

Diff

commit 28bb6243b9ce41f1a121cceda345d436b611388f
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Thu Jul 30 15:22:58 2026 -0700

    secrets: DSN_REWRITE superset fix — map real dw_admin PG key names to DATABASE_URL so DB rotation rewrites the DSN (TK-10045, fixes half-fire)
---
 cli.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/cli.js b/cli.js
index cfa47c0..394588b 100755
--- a/cli.js
+++ b/cli.js
@@ -33,7 +33,13 @@ function routeFor(key) { return (ROUTES.services && ROUTES.services[key]) || ROU
 // DB-password keys whose consumers connect via a full DSN, not a bare var — the
 // fan must rewrite the password INSIDE that DSN in each env_file dest.
 const DSN_REWRITE = {
-  PG_DW_ADMIN_PASSWORD: { dsn: 'DATABASE_URL', user: 'dw_admin' },
+  // Superset fix (TK-10045, 2026-07-30): the master .env uses DW_ADMIN_PG_PASSWORD /
+  // DW_ADMIN_DB_PASSWORD, NOT PG_DW_ADMIN_PASSWORD — so a DB rotation pasted under the
+  // real key names never rewrote the downstream DATABASE_URL DSN (the 2026-06-03
+  // half-fire). Map ALL three names → so whichever var Steve fills also rewrites the DSN.
+  PG_DW_ADMIN_PASSWORD: { dsn: 'DATABASE_URL', user: 'dw_admin' }, // legacy name (kept; harmless if unset)
+  DW_ADMIN_PG_PASSWORD: { dsn: 'DATABASE_URL', user: 'dw_admin' },
+  DW_ADMIN_DB_PASSWORD: { dsn: 'DATABASE_URL', user: 'dw_admin' },
 };
 const MASTER_ENV = path.join(ROOT, '.env');
 // DESKTOP_ENV (~/Desktop/site-factory.env) retired 2026-06-11 (DTD verdict A) —

← d7a8605 auto-save: 2026-07-30T15:19:04 (1 files) — registry.json · back to Secrets Manager · auto-save: 2026-08-02T07:13:15 (1 files) — registry.json c560ed9 →