fix(scram): replace hand-rolled SCRAM client with postgres-protocol

Cargo.toml

@@ -17,6 +17,7 @@ tokio = { version = "1", features = ["rt-multi-thread", "net", "macros", "sync",
 
 # Wire protocol
 bytes = "1"
+postgres-protocol = "0.6.11"
 
 # Auth
 jsonwebtoken = { version = "10", default-features = false, features = ["aws_lc_rs"] }
@@ -32,13 +33,6 @@ thiserror = "2"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
-# SCRAM
-hmac = "0.12"
-sha2 = "0.10"
-
-# Base64 (SCRAM)
-base64 = "0.22"
-
 # Random
 rand = "0.8"
 

src/lib.rs

@@ -7,7 +7,6 @@
 mod auth;
 mod error;
 mod proxy;
-mod scram;
 mod wire;
 
 // Re-export Config for use by integration tests and main binary.

src/main.rs

@@ -6,8 +6,7 @@ use tokio::net::TcpListener;
 
 #[tokio::main]
 async fn main() -> std::result::Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let backend_postgres_url =
-        std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
+    let backend_postgres_url = std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
     let jwt_secret = std::env::var("SUPABASE_JWT_SECRET").expect("SUPABASE_JWT_SECRET must be set");
     let listen_addr: SocketAddr = std::env::var("LISTEN_ADDR")
         .unwrap_or_else(|_| "0.0.0.0:5432".to_string())

src/proxy.rs

@@ -2,16 +2,13 @@
 
 use crate::auth::{Claims, JwtAuthenticator};
 use crate::error::ProxyError;
-use crate::scram;
 use crate::wire;
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::TcpListener;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
-
-
 /// Start the byte-forward proxy server.
 pub async fn serve(
     config: crate::Config,
@@ -136,14 +133,20 @@ async fn handle_connection(
     let (backend_host, backend_port, backend_user, backend_password, backend_db) =
         parse_backend_url(&config.backend_postgres_url)?;
 
-    let mut backend = match tokio::net::TcpStream::connect((backend_host.as_str(), backend_port)).await {
-        Ok(s) => s,
-        Err(e) => {
-            tracing::error!(peer_addr = %peer_addr, error = %e, "backend TCP connect failed");
-            wire::write_error_response(&mut client, "08001", &format!("backend connection failed: {}", e)).await?;
-            return Ok(());
-        }
-    };
+    let mut backend =
+        match tokio::net::TcpStream::connect((backend_host.as_str(), backend_port)).await {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::error!(peer_addr = %peer_addr, error = %e, "backend TCP connect failed");
+                wire::write_error_response(
+                    &mut client,
+                    "08001",
+                    &format!("backend connection failed: {}", e),
+                )
+                .await?;
+                return Ok(());
+            }
+        };
     tracing::debug!(peer_addr = %peer_addr, backend = %backend_host, "backend TCP opened");
 
     // Step 7: Send backend StartupMessage (plain TCP, no TLS)
@@ -162,17 +165,40 @@ async fn handle_connection(
         }
         wire::AuthMethod::CleartextPassword => {
             wire::write_password_message(&mut backend, &backend_password).await?;
+            tracing::debug!(peer_addr = %peer_addr, "backend auth: cleartext password sent");
         }
         wire::AuthMethod::Sasl { mechanisms } => {
-            if !mechanisms.contains(&"SCRAM-SHA-256".to_string()) {
+            use postgres_protocol::authentication::sasl::{
+                ChannelBinding, ScramSha256, SCRAM_SHA_256,
+            };
+
+            if !mechanisms.iter().any(|m| m.as_str() == SCRAM_SHA_256) {
                 return Err(Box::new(ProxyError::BackendAuth(format!(
                     "unsupported SASL mechanisms: {:?}",
                     mechanisms
                 ))));
             }
-            scram::scram_sha_256_authenticate(&mut backend, &backend_user, &backend_password)
-                .await
-                .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)?;
+
+            let mut scram =
+                ScramSha256::new(backend_password.as_bytes(), ChannelBinding::unsupported());
+
+            wire::write_sasl_initial_response(&mut backend, SCRAM_SHA_256, scram.message()).await?;
+
+            let server_first = wire::read_sasl_auth_message(&mut backend, 11).await?;
+            scram
+                .update(&server_first)
+                .map_err(|e| ProxyError::BackendAuth(format!("scram update: {}", e)))?;
+
+            wire::write_sasl_response(&mut backend, scram.message()).await?;
+
+            let server_final = wire::read_sasl_auth_message(&mut backend, 12).await?;
+            scram
+                .finish(&server_final)
+                .map_err(|e| ProxyError::BackendAuth(format!("scram finish: {}", e)))?;
+
+            let _ = wire::read_sasl_auth_message(&mut backend, 0).await?;
+
+            tracing::debug!(peer_addr = %peer_addr, "backend SCRAM-SHA-256 auth complete");
         }
         wire::AuthMethod::Md5Password { .. } => {
             return Err(Box::new(ProxyError::BackendAuth(