marketplace/db: never pass undefined password to pg (fixes SASL 'client password must be a string')

37d9df98ecba23744349ee33c564db9eacdf8a2f · 2026-06-12 15:12:04 -0700 · Steve Abrams

Omit password from pool config unless PGPASSWORD/DW_UNIFIED_PG_PASSWORD is
actually set, and String()-coerce when present. The old '|| undefined' fed a
non-string password into pg's SCRAM handshake on Kamatera, throwing the SASL
error. Operational root cause is still a missing MARKETPLACE_DB_URL in the
marketplace pm2 env on prod — this fix surfaces a clearer error and lets the
trust-auth path work where intended.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

M src/marketplace/db.js

Diff

commit 37d9df98ecba23744349ee33c564db9eacdf8a2f
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jun 12 15:12:04 2026 -0700

    marketplace/db: never pass undefined password to pg (fixes SASL 'client password must be a string')
    
    Omit password from pool config unless PGPASSWORD/DW_UNIFIED_PG_PASSWORD is
    actually set, and String()-coerce when present. The old '|| undefined' fed a
    non-string password into pg's SCRAM handshake on Kamatera, throwing the SASL
    error. Operational root cause is still a missing MARKETPLACE_DB_URL in the
    marketplace pm2 env on prod — this fix surfaces a clearer error and lets the
    trust-auth path work where intended.
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/marketplace/db.js | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/src/marketplace/db.js b/src/marketplace/db.js
index 9d78764..693351c 100644
--- a/src/marketplace/db.js
+++ b/src/marketplace/db.js
@@ -23,14 +23,18 @@ if (rawUrl && !url) {
 
 const pool = url
   ? new Pool({ connectionString: url, max: 10 })
-  : new Pool({
-      host: process.env.PGHOST || (isDarwin ? '/tmp' : '127.0.0.1'),
-      port: Number(process.env.PGPORT || 5432),
-      database: process.env.PGDATABASE || (rawUrl && !looksLikeUrl(rawUrl) ? rawUrl : 'dw_unified'),
-      user: process.env.PGUSER || process.env.USER || (isDarwin ? 'stevestudio2' : 'dw_admin'),
-      password: process.env.PGPASSWORD || process.env.DW_UNIFIED_PG_PASSWORD || undefined,
-      max: 10,
-    });
+  : (function () {
+      const rawPassword = process.env.PGPASSWORD || process.env.DW_UNIFIED_PG_PASSWORD;
+      const cfg = {
+        host: process.env.PGHOST || (isDarwin ? '/tmp' : '127.0.0.1'),
+        port: Number(process.env.PGPORT || 5432),
+        database: process.env.PGDATABASE || (rawUrl && !looksLikeUrl(rawUrl) ? rawUrl : 'dw_unified'),
+        user: process.env.PGUSER || process.env.USER || (isDarwin ? 'stevestudio2' : 'dw_admin'),
+        max: 10,
+      };
+      if (rawPassword != null && rawPassword !== '') cfg.password = String(rawPassword);
+      return new Pool(cfg);
+    })();
 
 pool.on('error', (err) => {
   console.error('[marketplace.db] pool error:', err.message);

← 8f57319 Fix hero click landing on wrong design: add pointer-events:n · back to Wallco Ai · Dedupe designs.json snapshot: DISTINCT ON (id) + dedup-aware f55cefc →