fix(scram): replace hand-rolled SCRAM client with postgres-protocol

[birdmanmandbir]

Summary

• Root cause: src/scram.rs:67 constructed the SCRAM client-final-message without the p= prefix on the proof attribute. Backend rejected every connection with 08P01 malformed SCRAM message, then the proxy mis-decoded the ErrorResponse and reported "early eof" to the client.
• Fix: Delete the hand-rolled SCRAM module entirely; depend on postgres-protocol = "0.6.11" and use ScramSha256 (the same impl tokio-postgres uses in production).
• Cleanup: SASL wire-framing helpers move into src/wire.rs with unit tests. Crypto deps hmac, sha2, base64 are dropped.

Verification plan (post-merge)

CI builds and pushes the image; then:

1. Roll the deployment: kubectl -n supa-dev rollout restart deploy/pgwire-supabase-proxy
2. Repro the original failing connection from inside the cluster:

   kubectl -n supa-dev run psql-verify --rm -i --restart=Never \
     --image=postgres:16-alpine --command -- \
     psql "postgres://agent:<JWT>@pgwire-supabase-proxy.supa-dev.svc:5432/supabase" \
     -c "SELECT current_user, current_database();"
   

3. Expected: row with authenticated | supabase (NOT "server closed the connection unexpectedly").
4. Check ttal log psp — should show client authenticated, backend SCRAM-SHA-256 auth complete, session ready — entering byte-forward mode, and on disconnect a clean connection closed with non-zero byte counts.

If step 2/3 fails, kubectl rollout undo deploy/pgwire-supabase-proxy and re-open the task.

[birdmanmandbir]

coder (round 3):

CI checks passed (e47aa7d) — all green: fmt, clippy, unit tests. Ready for review.

[birdmanmandbir]

pr-review-lead (round 4):

PR Review: fix/scram-postgres-protocol

5 reviewers ran — code, principles, silent-failure-hunter, test-analyzer, comment-analyzer.

---

✅ Critical Issues — None

---

✅ Important Issues — None

---

💡 Suggestions (3 found)

1. [test-analyzer] read_sasl_auth_message has no unit tests — The write helpers have byte-layout tests but the read path (tag check, auth_type validation, body extraction) is only exercised implicitly by ignored integration tests. Adding unit tests for the error paths (wrong tag, body too short, type mismatch) would catch regressions in the read side of the SCRAM exchange. src/wire.rs

2. [silent-failure-hunter] Missing debug log on cleartext password auth success — The SCRAM branch logs "backend SCRAM-SHA-256 auth complete" but AuthMethod::CleartextPassword has no corresponding success log. Minor observability gap. src/proxy.rs

3. [comment-analyzer] read_sasl_auth_message doc comment could be clearer — The comment lists types 11, 12, 0 but only names two of the three. Suggested wording:

   /// - type=11 (AuthenticationSASLContinue)
   /// - type=12 (AuthenticationSASLFinal)
   /// - type=0  (AuthenticationOk)
   

   src/wire.rs

---

Strengths

• Core bug confirmed fixed (code-reviewer): The old format\!(",{}", client_proof) was missing p= prefix per RFC 5802 §5.1 — this caused CNPG to reject every connection. The postgres-protocol library handles formatting correctly.
• Net −400 LOC: 437 lines of hand-rolled SCRAM crypto replaced with a battle-tested library dependency. Significant reduction in maintenance surface.
• Wire helpers well-placed: Moved to wire.rs where they belong; properly public; good doc comments on the format strings.
• Error propagation is clean: let _ = wire::read_sasl_auth_message(&mut backend, 0).await? is not a silent failure — ? propagates errors, only the unused Vec<u8> is discarded.
• Dependency cleanup: hmac 0.12, sha2 0.10, base64 0.22 all removed. Lock file resolves to unified dep versions.
• Principles clean: DRY, SOLID, KISS, YAGNI all pass. Linear SCRAM flow, no unnecessary abstractions.
• CI green: fmt, clippy, unit tests all pass.

---

VERDICT: LGTM

All suggestions are optional quality improvements — none block merge.

[birdmanmandbir]

coder (round 5):

Triage Update

Fixed

• read_sasl_auth_message has no unit tests — added 2 error-path unit tests in src/wire.rs:571-592 (wrong_tag, type_mismatch)
• Missing debug log on cleartext password auth success — added tracing::debug! in src/proxy.rs:168
• read_sasl_auth_message doc comment could be clearer — updated to explicitly list all 3 auth type values

Remaining

• None

All 3 suggestions addressed. CI green: fmt ✓ clippy ✓ 9 tests ✓. Ready to merge.