Move strr-api deployed DB access to Cloud SQL IAM auth

[Jacky-Pham]

Move strr-api to the shared Cloud SQL Python Connector and pg8000 for deployed IAM authentication, while retaining password/TCP/socket configuration for local development. Migration mode selects DATABASE_MIGRATION_USERNAME and retains SET ROLE ownership of schema objects.

The refreshed branch includes current main 6c02d3ce and pins the same tested common #77 candidate (395a3bdd402d918f2ba3df6d6cf26a629872a121) as #1764. The lock preserves all 160 existing main package versions and sources; only the helper and its required dependencies are added.

Migration fix

Testing the actual pg8000 migration path exposed a failure hidden by the previous psycopg2-only ownership test: Alembic commits before entering an autocommit block, then reads the isolation level. With the installed pg8000/SQLAlchemy combination, that query opens a DBAPI transaction invisible to SQLAlchemy, so CREATE INDEX CONCURRENTLY fails.

A listener scoped to pg8000 migration connections ends that isolation-query transaction before an explicit AUTOCOMMIT transition, only when SQLAlchemy has no active transaction. It does not make the whole migration or API engine autocommit. Regression tests migrate through standalone Alembic and the actual Flask-Migrate configuration using a non-superuser login, verify all four concurrent indexes and object ownership, and confirm a failed ordinary migration rolls back.

Validation

• Full API suite on actual PostgreSQL18.6: 576 passed, six existing skips, 86.10% coverage. All four started database containers reported server version180006. An external fixture adapter selects PG18 for this local run; the repository's default fixture update remains in test: align STRR database fixtures with PostgreSQL 18 #1853.
• Real pg8000 query, both full migration paths, special-character local password, owner-role checks and failed-migration rollback pass. Cloud/database IAM is not mocked into a claim of live login.
• Poetry lock, Black, isort and diff checks pass. Broad optional Pylint reports9.88/10; all reported files are unchanged from main. No unrelated lint cleanup or suppression is included.
• Final 07183914 CI is green: eleven successful checks and five neutral frontend checks. API run35920064868 passes setup, linting, production image build, unit tests (576 passed/six skipped) and coverage; CodeQL and Sonar pass. This run resolves SRE workflow196c16c5, which selects the image named postgres15-postgis-anon. Its recorded digest sha256:8ea288e1f1dce2e8e2024a594c018d8e77dfa3b984bbb13125c0e3cc92ac12fa actually starts PostgreSQL 18.6, despite its name. The repository test containers still default to PG16; CI uses Python 3.14.7. The separate local result above establishes actual PG18 coverage.

Before merge / rollout

Merging to main starts deployment. These gates remain:

• Review/merge feat(cloud-sql): centralize environment settings sbc-connect-common#77, then switch the fork source to bcgov's official merge commit, regenerate the lock and rerun affected checks. Use STRR API IAM helper for jobs and queues #1764 changes separate files and is not an API merge-order prerequisite.
• Confirm the DEV vault values for instance connection, API IAM username, migration IAM username, database name and owner role. The API/migration prerequisites extend beyond Use STRR API IAM helper for jobs and queues #1764's three missing fields.
• Prepare the existing migration job's verified image, command, intended attached identity and IAM/owner-role variables. Fresh DEV metadata shows it still runs as sa-job, references update_db.sh, uses the mutable strr-api:dev image and lacks the IAM instance, migration username and owner role. update_db.sh itself selects migration mode. The shared deployment template describes/executes the existing job; it does not configure these properties. A dedicated migration-stage image is not currently defined by this API Dockerfile; verify the chosen API image and entrypoint instead of assuming one was built.
• Verify real Cloud SQL IAM login and effective API/migration privileges, including SET ROLE strr. Draft test: add protected DEV IAM catalog verification #1854 prepares a read-only DEV API/job catalog verifier; it has not run and does not verify the migration identity/owner-role path or final consumers.
• Use full deployment or explicitly remove legacy database settings; the redeploy path preserves old variables. DEV project is bcrbk9-dev; TEST/UAT bcrbk9-test; sandbox bcrbk9-tools; PROD bcrbk9-prod.

No cloud migration, application deployment, database mutation, vault edit or IAM change was performed during this refresh. Local test databases were disposable.

[bcregistry-sre]

Temporary Url for review: https://strr-hosts-dev--pr-1763-ciu8zc70.web.app

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud