fix: clarify db connection error for Address not in tenant allow_list

[samirketema]

What kind of change does this PR introduce?

Fixes #3064

Small DX improvement around an error message when host cannot access the DB due to network restrictions.

What is the current behavior?

Setup

1. Restrict all access for a project's database
2. Attempt to perform go run . db push
3. Note at the error in the output.

failed to connect as temp role: failed to connect to `host=aws-1-us-east-1.pooler.supabase.com user=cli_login_postgres.xhhcxixppntgjgrwlxol database=postgres`: server error (FATAL: Address not in tenant allow_list: {216, 232, 45, 154} (SQLSTATE XX000))
Connect to your database by setting the env var: SUPABASE_DB_PASSWORD
exit status 1

What is the new behavior?

failed to connect as temp role: failed to connect to `host=aws-1-us-east-1.pooler.supabase.com user=cli_login_postgres.xhhcxixppntgjgrwlxol database=postgres`: server error (FATAL: Address not in tenant allow_list: {216, 232, 45, 154} (SQLSTATE XX000))
Make sure your local IP is allowed in Network Restrictions and Network Bans.
https://supabase.com/dashboard/project/_/database/settings
exit status 1

sanity check, tested without the network restrictions:

Remote database is up to date.

Additional context

Two things to note:

• The reason why I tested this via supabase db push is that supabase link seems to no longer connect directly to the db - this issue was originally filed more than a year ago.
• I was unable to reproduce the error received from server in SCRAM exchange: Wrong password scenario mentioned in the issue. I wonder if this is related to the changes above to supabase link

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved error messages and suggestions when connection attempts fail, providing clearer guidance for various failure scenarios including SSL configuration, authentication, and network issues.

• Refactor

  • Centralized connection error handling to streamline error messaging logic.

Walkthrough

The pull request refactors connection error handling by extracting inline error-inspection logic into a new exported function SetConnectSuggestion(err error). This function parses error messages to recognize specific connection failure scenarios, including "Address not in tenant allow_list", SSL requirements, authentication failures, and host-not-found errors. A new exported constant SuggestEnvVar provides the password-related hint. The changes centralize error-based messaging logic and update call sites in db_url.go to delegate error handling to the new function with fallback logic.

Assessment against linked issues

Objective	Addressed	Explanation
Recognize and communicate "Address not in tenant allow_list" errors [#3064]	✅
Recognize and communicate "Wrong password" / SCRAM authentication errors [#3064]	✅
Provide clearer, more specific error messages for connection failures [#3064]	✅

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coveralls]

Pull Request Test Coverage Report for Build 22201786086

Details

• 21 of 26 (80.77%) changed or added relevant lines in 2 files are covered.
• 7 unchanged lines in 2 files lost coverage.
• Overall coverage increased (+0.06%) to 61.866%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/utils/flags/db_url.go	0	5	0.0%

Files with Coverage Reduction	New Missed Lines	%
internal/utils/docker.go	2	76.06%
internal/utils/git.go	5	57.14%

Totals
Change from base Build 22191824220:	0.06%
Covered Lines:	7724
Relevant Lines:	12485

---

💛 - Coveralls

[avallete]

LGTM ! Thanks for your contribution.

[raulb]

👋 @samirketema