@databricks/lakebase: pool drops maxLifetimeSeconds and other pg options, so connections never recycle and Unity Catalog claims access fails after 4 hours

Aberta
  • Algo errado?
#718 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 3 dias

@billmcmillin já está trabalhando nisso.

Desde 6/11/2026.

  • #719 de @billmcmillin — aberto

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
20/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Estagnada
Stack de tecnologia
node.js, typescript
Domínio
backend, databases

Direção de pesquisa

Read packages/lakebase/src/pool-config.ts and inspect getLakebasePgConfig() to see which PoolConfig options reach pg.Pool. Check the pool tests for coverage of forwarded options and the default connection lifetime. Done means caller options are preserved, connections recycle at the intended default, and the warning behavior covers unsafe lifetime settings; linked PR #719 is already open.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

createLakebasePool() passes only 11 options to pg.Pool and silently drops the rest, including maxLifetimeSeconds. Pool connections are therefore never recycled.

Lakebase checks the OAuth token only at login, so most queries keep working on old connections. Access granted through Unity Catalog claims in the token doesn't: it stops 4 hours after the token is minted, while the connection stays open. A busy pool keeps its connections past that point. From then on, every query that relies on that access fails with 42501 permission denied, until the app restarts.

The same bug drops application_name, keepAlive, query_timeout and options. LakebasePoolConfig extends pg's PoolConfig, so all of these type-check and are then ignored.

Affected: every published @databricks/lakebase version, up to and including 0.7.0, and AppKit's createLakebasePool, which wraps it.

Reproduction

The dropped options show without a database. pg.Pool doesn't connect until first use:

import { createLakebasePool } from "@databricks/lakebase";

const pool = createLakebasePool({
  host: "localhost",
  database: "test",
  user: "test",
  password: "test-only",
  sslMode: "disable",
  maxLifetimeSeconds: 900,
  application_name: "my-app",
  query_timeout: 15_000,
});

console.log(pool.options.maxLifetimeSeconds); // 0 (pg-pool's "never recycle"), not 900
console.log(pool.options.application_name);   // undefined
console.log(pool.options.query_timeout);      // undefined
await pool.end();

The access lapse, on a live Lakebase Autoscaling endpoint:

  1. Use a service principal with an OAuth Postgres role and no native GRANTs. Give it SELECT on a synced table through Unity Catalog only.
  2. Create a pool whose password callback returns a token minted with claims: [{ permission_set: "READ_ONLY", resources: [{ table_name: "<catalog.schema.table>" }] }].
  3. Keep a few connections busy, reading the table every 30 seconds, for more than 4 hours.
  4. At about 240 minutes after the token was minted, every read fails with 42501 permission denied for schema …. Liveness queries on the same connections keep succeeding, and the pool never recovers.

In our run, connections were 4.3 hours old by the end, and the lapse came at 240.5 minutes on every connection. With 1-hour tokens, reads kept working for 15 minutes past the token's expiry, and with 5-minute tokens for 29 minutes. So the lapse follows the token's age (4 hours from mint), not its expiry.

Expected

  • Options a caller passes reach pg.Pool.
  • Connections are recycled by default, early enough that no connection outlives its token's Unity Catalog claims.

Root cause

getLakebasePgConfig() in packages/lakebase/src/pool-config.ts builds the pool config from a fixed list:

return {
  host, port, user, database, password, ssl, max,
  idleTimeoutMillis, connectionTimeoutMillis,
  statement_timeout, idle_in_transaction_session_timeout,
};

There's no maxLifetimeSeconds, so pg-pool uses its default of 0, which means connections are never closed for age.

Proposed fix

  • Pass maxLifetimeSeconds, application_name, keepAlive, query_timeout and options through.
  • Default maxLifetimeSeconds to 30 minutes.
  • Log a warning when it's 0 or long enough for a connection to outlive its token's claims. A token can be up to an hour old at login, so with a 30-minute margin the safe maximum is 2.5 hours.

A PR follows.

Notes

  • createLakebasePool doesn't request claims itself, so this hits apps that mint claims tokens (generateDatabaseCredential accepts claims) and pass them as the pool password. Access through native Postgres grants isn't affected.
  • pg-pool recycles only idle connections. A client that's checked out and held for hours isn't closed until it's released, so the fix can't protect it.
Linguagem predominante
TypeScript
Estrelas
119
Forks
36
Merge médio
4d 16h
PRs com merge (30d)
37

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de databricks/appkit

Todas as issues de databricks/appkit

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.