Remove connect-enabled hostname check to support PrivateLink hosts#157
Merged
Conversation
CanConnect previously rejected any host that did not end in ".connect.psdb.cloud" with the error "This password is not connect-enabled, please ensure that your organization is enrolled in the Connect beta." That suffix check was added early on, when Connect was a beta capability that not all PlanetScale credentials had enabled, so it served as an early guard to steer users toward opting in. Connect is now enabled for all PlanetScale credentials, so the check no longer guards anything real. It does, however, block legitimate setups: customers connecting over an AWS PrivateLink endpoint use a hostname that does not end in ".connect.psdb.cloud", so the connector refuses to connect even though the credentials are valid. This removes only the hostname suffix check. The HTTPS reachability probe in checkEdgePassword is retained, so we still fail fast with a clear error when the host is genuinely unreachable. This also brings the Airbyte source in line with the Fivetran source, whose checkEdgePassword performs the reachability probe without any hostname suffix check. No tests cover this path, and the `strings` import is still used elsewhere in the file.
nickvanw
approved these changes
Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CanConnect previously rejected any host that did not end in ".connect.psdb.cloud" with the error "This password is not connect-enabled, please ensure that your organization is enrolled in the Connect beta." That suffix check was added early on, when Connect was a beta capability that not all PlanetScale credentials had enabled, so it served as an early guard to steer users toward opting in.
Connect is now enabled for all PlanetScale credentials, so the check no longer guards anything real. It does, however, block legitimate setups: customers connecting over an AWS PrivateLink endpoint use a hostname that does not end in ".connect.psdb.cloud", so the connector refuses to connect even though the credentials are valid.
This removes only the hostname suffix check. The HTTPS reachability probe in checkEdgePassword is retained, so we still fail fast with a clear error when the host is genuinely unreachable. This also brings the Airbyte source in line with the Fivetran source, whose checkEdgePassword performs the reachability probe without any hostname suffix check.
No tests cover this path, and the
stringsimport is still used elsewhere in the file.