statement_timeout only counts time spent executing, so a session that
opens a transaction and then stops issuing statements holds its pooled
connection -- and every lock it already took -- with nothing for the
statement timeout to cancel. That is the same connection-starvation
failure the other two limits close, reached a different way.
Set idle_in_transaction_session_timeout alongside them, defaulting to
60s: the budget covers only the gaps between a transaction's statements,
so continuous work is never at risk.
The three limits move into a RuntimeTimeouts struct rather than growing
apply_runtime_connection_timeouts to three same-typed arguments, where a
swapped pair would be a silent misconfiguration. Migration exemption
assertions now iterate every GUC the applier sets, so a fourth limit
added without a matching exemption fails the test.
The armed-pool assertions compare milliseconds read from pg_settings
instead of SHOW text: Postgres re-spells settings on the way out (60s
reads back as 1min), which coupled the test to server formatting.
Signed-off-by: Eli Foster <efoster@squareup.com>
The rule that a timeout must be one Postgres accepts lived in a doc
comment on PG_TIMEOUT_MAX_MILLIS and was enforced by a parser two crates
away. Three separate escapes were found in review: an unbounded
magnitude, a u128 overflow in the microsecond rounding, and
uncanonicalized uppercase units. All three passed a String-typed
DbConfig unchallenged.
Parse the value into a PgTimeout newtype instead, next to the constant
and the applier. DbConfig and apply_runtime_connection_timeouts now take
PgTimeout, so a value Postgres would reject is unrepresentable rather
than merely tested for, and PG_TIMEOUT_MAX_MILLIS is private.
buzz-admin picked up the relay's 30s/5s defaults through
DbConfig::default() even though it is a one-shot operator CLI with no
shared pool to starve, and it never read the env overrides -- so a bulk
repair outliving 30s was cancelled with no way to widen it. It now
defaults to no caps and honours the same env vars via
PgTimeout::from_env_or.
Signed-off-by: Eli Foster <efoster@squareup.com>
Eli Foster