Eli Foster cf27618e61 refactor(db): make PgTimeout the only way to build a Postgres timeout ...

The rule that a timeout must be one Postgres accepts lived in a doc
comment on PG_TIMEOUT_MAX_MILLIS and was enforced by a parser two crates
away. Three separate escapes were found in review: an unbounded
magnitude, a u128 overflow in the microsecond rounding, and
uncanonicalized uppercase units. All three passed a String-typed
DbConfig unchallenged.

Parse the value into a PgTimeout newtype instead, next to the constant
and the applier. DbConfig and apply_runtime_connection_timeouts now take
PgTimeout, so a value Postgres would reject is unrepresentable rather
than merely tested for, and PG_TIMEOUT_MAX_MILLIS is private.

buzz-admin picked up the relay's 30s/5s defaults through
DbConfig::default() even though it is a one-shot operator CLI with no
shared pool to starve, and it never read the env overrides -- so a bulk
repair outliving 30s was cancelled with no way to widen it. It now
defaults to no caps and honours the same env vars via
PgTimeout::from_env_or.

Signed-off-by: Eli Foster <efoster@squareup.com>

2026-08-12 11:03:52 +10:00

..

src

refactor(db): make PgTimeout the only way to build a Postgres timeout

2026-08-12 11:03:52 +10:00

Cargo.toml

fix(relay): enable Redis TLS for rediss:// (ElastiCache) (#1417)

2026-06-30 21:14:43 -04:00