Add support for pgpass

[surister]

We follow the spec in https://www.postgresql.org/docs/current/libpq-pgpass.html,

Order of passfile path is:

1. passfile path specified in connection string, e.g. postgresql://localhost:5432?passfile=/home/someuser/secret/.pgpass
2. default path ~/.pgpass in *nix, %APPDATA%\postgresql\pgpass.conf in windows.

• pgpass file needs to have safe permissions 0600 or we raise an exception.
• pgpass needs to follow the spec format, host:port:db_name:user_name:password, so
  *:*:*:*:password is valid, just password is not.

pgpassfile has precedence over the given connection string.

Fixes: #567

[surister]

@wangxiaoying Adding a bunch of new code to support specific postgres functionality into the __init__ feels bloat, how about we add new code in a new file? maybe something like postgres/pgpass.py?

__init__.py
postgres/pgpass.py

[aimtsou]

How about we do something different? the content we need from pgpass is the password only the restof the elements are used for retrieving it. So:

            for line in f:
                contents = line.read().split(':')
                if len(contents) != 5:
                    raise Exception('Pgpass content should follow: host:port:db_name:user_name:password')
                else:
                    if ((contents['host'] == host or contents['host'] == '*') and
                        (contents['port'] == port or contents['port'] == '*') and
                        (contents['database'] == database or contents['database'] == '*') and
                        (contents['user'] == user or contents['user'] == '*')):
                        return contents['password']

So in this way we do also multiple lines and we return the first line matched.

[aimtsou]

Instead of sys.platform maybe we can use os.name == 'nt'

[surister]

is it better?

[aimtsou]

Same here: os.name != 'nt'

[aimtsou]

We can do the following:
database = parsed_conn.path[1:] or os.environ.get('PGDATABASE', os.getenv('USER'))
host = parsed_conn.hostname or os.environ.get('PGHOST', 'localhost')
port = parsed_conn.port or os.environ.get('PGPORT', '5432')
user = parsed_conn.username or os.environ.get('PGUSER', os.getenv('USER'))
password = parsed_conn.password

We parse 2 times the URI so maybe we need to rethink that maybe we call pgpass from inside reconstruct? That would allow something like that also:

query_params = parse_qs(parsed_con.query)

passfile = query_params.get('passfile', [None])[0] or os.environ.get('PGPASSFILE')
default_pgpass_path = os.path.expanduser('~/.pgpass') if os.name != 'nt' else os.path.join(os.getenv('APPDATA', ''), 'postgresql', 'pgpass.conf')

# Determine the password precedence
if not password:
    if 'PGPASSWORD' in os.environ:
        password = os.environ['PGPASSWORD']
    else:
        pgpass_path = passfile or default_pgpass_path
        password = get_passfile_content(pgpass_path, host or '*', str(port or '*'), database or '*', user or '*')

And with all these information we can get the new connection string.

[aimtsou]

Or postgres is also valid: https://www.postgresql.org/docs/current/libpq-connect.html

[surister]

Then we ought to change it to postgres

[wangxiaoying]

Thanks for the PR and review @surister @aimtsou !

@wangxiaoying Adding a bunch of new code to support specific postgres functionality into the __init__ feels bloat, how about we add new code in a new file? maybe something like postgres/pgpass.py?

__init__.py postgres/pgpass.py

I think moving the logic into an independent file would be great!

[wangxiaoying]

I just pushed a commit to fix the error that cause the fail of the CI. Please feel free to rebase on that one.