@databricks/lakebase: pool drops maxLifetimeSeconds and other pg options, so connections never recycle and Unity Catalog claims access fails after 4 hours

Đang mở
  • Có gì không ổn?
#718 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 3 ngày

@billmcmillin đang làm issue này rồi.

Từ ngày 6/11/2026.

  • #719 của @billmcmillin — đang mở

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
20/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Đình trệ
Công nghệ
node.js, typescript
Lĩnh vực
backend, databases

Hướng nghiên cứu

Read packages/lakebase/src/pool-config.ts and inspect getLakebasePgConfig() to see which PoolConfig options reach pg.Pool. Check the pool tests for coverage of forwarded options and the default connection lifetime. Done means caller options are preserved, connections recycle at the intended default, and the warning behavior covers unsafe lifetime settings; linked PR #719 is already open.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

createLakebasePool() passes only 11 options to pg.Pool and silently drops the rest, including maxLifetimeSeconds. Pool connections are therefore never recycled.

Lakebase checks the OAuth token only at login, so most queries keep working on old connections. Access granted through Unity Catalog claims in the token doesn't: it stops 4 hours after the token is minted, while the connection stays open. A busy pool keeps its connections past that point. From then on, every query that relies on that access fails with 42501 permission denied, until the app restarts.

The same bug drops application_name, keepAlive, query_timeout and options. LakebasePoolConfig extends pg's PoolConfig, so all of these type-check and are then ignored.

Affected: every published @databricks/lakebase version, up to and including 0.7.0, and AppKit's createLakebasePool, which wraps it.

Reproduction

The dropped options show without a database. pg.Pool doesn't connect until first use:

import { createLakebasePool } from "@databricks/lakebase";

const pool = createLakebasePool({
  host: "localhost",
  database: "test",
  user: "test",
  password: "test-only",
  sslMode: "disable",
  maxLifetimeSeconds: 900,
  application_name: "my-app",
  query_timeout: 15_000,
});

console.log(pool.options.maxLifetimeSeconds); // 0 (pg-pool's "never recycle"), not 900
console.log(pool.options.application_name);   // undefined
console.log(pool.options.query_timeout);      // undefined
await pool.end();

The access lapse, on a live Lakebase Autoscaling endpoint:

  1. Use a service principal with an OAuth Postgres role and no native GRANTs. Give it SELECT on a synced table through Unity Catalog only.
  2. Create a pool whose password callback returns a token minted with claims: [{ permission_set: "READ_ONLY", resources: [{ table_name: "<catalog.schema.table>" }] }].
  3. Keep a few connections busy, reading the table every 30 seconds, for more than 4 hours.
  4. At about 240 minutes after the token was minted, every read fails with 42501 permission denied for schema …. Liveness queries on the same connections keep succeeding, and the pool never recovers.

In our run, connections were 4.3 hours old by the end, and the lapse came at 240.5 minutes on every connection. With 1-hour tokens, reads kept working for 15 minutes past the token's expiry, and with 5-minute tokens for 29 minutes. So the lapse follows the token's age (4 hours from mint), not its expiry.

Expected

  • Options a caller passes reach pg.Pool.
  • Connections are recycled by default, early enough that no connection outlives its token's Unity Catalog claims.

Root cause

getLakebasePgConfig() in packages/lakebase/src/pool-config.ts builds the pool config from a fixed list:

return {
  host, port, user, database, password, ssl, max,
  idleTimeoutMillis, connectionTimeoutMillis,
  statement_timeout, idle_in_transaction_session_timeout,
};

There's no maxLifetimeSeconds, so pg-pool uses its default of 0, which means connections are never closed for age.

Proposed fix

  • Pass maxLifetimeSeconds, application_name, keepAlive, query_timeout and options through.
  • Default maxLifetimeSeconds to 30 minutes.
  • Log a warning when it's 0 or long enough for a connection to outlive its token's claims. A token can be up to an hour old at login, so with a 30-minute margin the safe maximum is 2.5 hours.

A PR follows.

Notes

  • createLakebasePool doesn't request claims itself, so this hits apps that mint claims tokens (generateDatabaseCredential accepts claims) and pass them as the pool password. Access through native Postgres grants isn't affected.
  • pg-pool recycles only idle connections. A client that's checked out and held for hours isn't closed until it's released, so the fix can't protect it.
Ngôn ngữ chính
TypeScript
Star
119
Fork
36
Merge trung bình
4 ngày 16 giờ
Pull request đã merge (30 ngày)
37

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của databricks/appkit

Tất cả issue của databricks/appkit

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.