fix: crawlproof-affiliate cron posted to a NULL url and never ran - #305
Merged
Merged
Conversation
20260913120000_openaffiliate.sql scheduled the job with
current_setting('app.site_url', true), which is the exact pattern
20260515090000_cron_config.sql had removed four months earlier. Its header
even explains why: the app.* GUCs can only be set by supabase_admin,
migrations run as `postgres`, so they are never populated. NULL || '/api/...'
is NULL and pg_net rejects the row with "null value in column url of relation
http_request_queue violates not-null constraint".
The job has therefore never run once since 2026-09-13. It hides well: it is
visible only in cron.job_run_details, nothing alerts on it, and the other nine
jobs are green. Found while auditing the ten jobs after the move to dev2 — the
Supabase cloud project had been failing it hourly too, so self-hosting
reproduced the bug rather than causing it.
Fixed by reading public.cron_config like the other nine, NOT by setting the
GUCs: a database-level setting is invisible to pg_dump, so it would be lost by
the next migration and this would return a third time. Adds a guard that fails
the migration loudly if either config value is missing, rather than scheduling
another job that dies hourly in silence.
Applied to dev2; the job now resolves to https://crawlproof.com/api/cron/affiliate
and the route is reachable and secret-gated (401 without it).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan48 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 31 | LOW: 15
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
crawlproof-affiliatehas never run once since it was created on 2026-09-13.20260913120000_openaffiliate.sqlscheduled it withcurrent_setting('app.site_url', true)— the exact pattern20260515090000_cron_config.sqlhad removed four months earlier. That migration's own header explains why it fails:So
NULL || '/api/cron/affiliate'is NULL and pg_net rejects it withnull value in column "url" ... violates not-null constraint.It hides well. It shows up only in
cron.job_run_details, nothing alerts on it, and the other nine jobs are green — 54/54 pg_net responses are 200 with real payloads. I only found it auditing the ten jobs after the move to dev2.Not caused by the migration to self-hosting. The Supabase cloud project had been failing this same job hourly on the same error; every failure in its 41,744-run history is this one job. Self-hosting reproduced it faithfully.
Fixed by reading
public.cron_configlike the other nine — deliberately not by setting the GUCs, since a database-level setting is invisible topg_dumpand would be lost by the next migration, which is how this came back the second time. Adds a guard that fails the migration loudly if either config value is missing, rather than scheduling another job that dies hourly in silence.Applied to dev2: resolves to
https://crawlproof.com/api/cron/affiliate, route reachable and secret-gated (401 without the secret), 10/10 jobs active. Next scheduled run 23:23 UTC.