Skip to content

fix(autogenstudio): preserve DB password in alembic.ini (Fixes #7341) - #8147

Closed
maxpetrusenkoagent wants to merge 1 commit into
microsoft:mainfrom
maxpetrusenkoagent:hermes/oss-pr-2026-09-02-autogen-7341
Closed

maxpetrusenkoagent wants to merge 1 commit into
microsoft:mainfrom
maxpetrusenkoagent:hermes/oss-pr-2026-09-02-autogen-7341

Conversation

@maxpetrusenkoagent

Copy link
Copy Markdown

Why are these changes needed?

Fixes #7341 — on first-time startup against PostgreSQL, AutoGen Studio's
Alembic migration step (SchemaManager.generate_revision) fails with
password authentication failed even though the app's own engine connects
successfully with the same DATABASE_URI (verified via psql).

Root cause: _generate_alembic_ini_content() serialized the engine URL
with str(self.engine.url). In SQLAlchemy 2.x, str(URL) masks the password
as *** (URL.__str__ renders with hide_password=True). The URL written to
alembic.ini therefore became:

postgresql+psycopg://autogen:***@postgres:5432/autogen

Alembic's autogenerate then opened a fresh connection using the literal
password ***, which PostgreSQL rejects. This only surfaces on first boot
because generate_revision() runs only when the database is empty; on later
restarts the tables already exist and the migration path is skipped, which is
why the UI "works" while the startup log still shows the error.

Fix: render the URL with URL.render_as_string(hide_password=False) so the
real password is preserved in alembic.ini, keeping the existing % → %%
escaping so passwords containing % still survive ConfigParser interpolation.

Related issue number

Closes #7341

Test plan / evidence

  • New regression tests in tests/test_schema_manager.py (RED first — both
    failed on main with assert '***' == 'autogen', then passed after the fix):
    • test_alembic_ini_preserves_database_password — the ini URL must contain
      the real password, never ***.
    • test_alembic_ini_roundtrips_password_with_special_characters — a password
      with URL-reserved characters (p@ssw0rd) round-trips correctly through
      URL rendering + ConfigParser %% escaping.
  • Local run: pytest tests/test_schema_manager.py tests/test_db_manager.py -q
    → 5 passed; the 3 remaining errors in test_db_manager.py are pre-existing
    on clean main (OpenAIChatCompletionClient fixture fails to construct with
    the released autogen-ext on this host — unrelated to this change, verified
    by running the same tests with the fix stashed).
  • ruff check and ruff format --check pass on the changed files.
  • Second-agent review: hermes chat -Q fresh-context review of the exact diff
    returned CLEAN / findings handled (see below).
  • Note: this is a re-proposal of the same root-cause fix as closed PR fix: preserve database password in Alembic migration config #7349
    (closed unmerged after ~2 months with no maintainer review). This PR adds
    regression tests and an updated explanation; happy to adjust to maintainer
    preference.

Checks

  • I've included any doc changes needed for https://microsoft.github.io/autogen/.
  • I've added tests (if relevant) corresponding to the changes introduced in this PR.
  • I've made sure all auto checks have passed.

SQLAlchemy 2.x masks passwords in str(URL) as ***, so the URL written
to alembic.ini by SchemaManager._generate_alembic_ini_content() ended
with a literal *** password. On first-time startup against PostgreSQL,
create_all() succeeded with the real engine but Alembic generate_revision
authenticated with *** and failed with 'password authentication failed',
even though the same credentials worked via psql.

Use URL.render_as_string(hide_password=False) so the real password is
written, keeping the %% ConfigParser escaping for passwords that
contain %. Adds regression tests for the plain and special-character
password cases.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Autogen Studio: Alembic generate_revision fails with "password authentication failed" despite valid DATABASE_URI and successful psql connections

1 participant