From 0981455bd62b8610a8450ac81ac9cef2a7e38788 Mon Sep 17 00:00:00 2001
From: Guillermo Caracuel <633810+gcaracuel@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:19:16 +0200
Subject: [PATCH] fix: use keyword-value DSN format to avoid IAM token URL
 breakage (#18)

IAM auth tokens contain URL-special characters (:, ?, &, =, /) which
cause lib/pq to misparse the postgresql://user:pass@host/db?args URL
format. The error was:

  dial tcp: lookup root:paidly-prd-internal...:5432: no such host

because lib/pq treated the entire user:pass@... as the hostname.

Fix: use lib/pq's keyword-value format (host= port= user= password=
dbname=) which does not rely on URL parsing and handles arbitrary
password characters safely.
---
 pkg/postgres/postgres.go | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkg/postgres/postgres.go b/pkg/postgres/postgres.go
index 299dd5bf..3aa230ae 100644
--- a/pkg/postgres/postgres.go
+++ b/pkg/postgres/postgres.go
@@ -175,7 +175,20 @@ func (c *pg) GetDefaultDatabase() string {
 // When useIAMAuth is true and the cloud provider is AWS, it generates an IAM
 // auth token to use as the password instead of the static password.
 func GetConnection(user, password, host, database, uriArgs string) (*sql.DB, error) {
-	db, err := sql.Open("postgres", fmt.Sprintf("postgresql://%s:%s@%s/%s?%s", user, password, host, database, uriArgs))
+	// Split host:port for keyword-value format
+	hostname, portStr, err := net.SplitHostPort(host)
+	if err != nil {
+		hostname = host
+		portStr = "5432"
+	}
+
+	// Use keyword-value format to avoid URL parsing issues.
+	// IAM auth tokens contain URL-special characters (:, ?, &, =, /)
+	// which break the postgresql://user:pass@host/db?args URL format.
+	uriArgs = strings.TrimPrefix(uriArgs, "?")
+	connStr := fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s %s",
+		hostname, portStr, user, password, database, uriArgs)
+	db, err := sql.Open("postgres", connStr)
 	if err != nil {
 		return nil, err
 	}