fix(backend): end request-scoped pg pools on workerd to stop Hyperdrive slot exhaustion

[posthog-eu]

Summary (AI generated)

• closeClient was a no-op on the workerd runtime, so every request-scoped pg.Pool from getPgClient was never ended — the Hyperdrive sockets leaked until the pool slots ran out.
• The failing write path is checkWriteAppAccess (supabase/functions/_backend/files/files.ts), which gates paid bundle uploads; the api worker leaks on the same auth/RBAC path.
• Fix: closeClient now always ends the pool, deferring end() to waitUntil via backgroundTask (no added request latency) and logging end() failures instead of throwing.

 export function closeClient(c: Context, db: ReturnType<typeof getPgClient>) {
-  if (getRuntimeKey() !== 'workerd')
-    return backgroundTask(c, db.end())
-  return undefined
+  return backgroundTask(c, Promise.resolve(db.end()).catch((error: unknown) => {
+    cloudlogErr({ requestId: c.get('requestId'), message: 'PG client end failed', error: serializePostgresError(error) })
+  }))
 }

Motivation (AI generated)

• Each request minted several pools that nobody closed: api-key and subkey resolution (hono_middleware.ts), RBAC checks (rbac.ts), and checkWriteAppAccess (files.ts). The TUS path re-runs checkWriteAppAccess on every PATCH chunk, so one large upload could drain slots on its own.
• Hyperdrive then rejected new connections with "Timed out while waiting for an open slot in the pool."
• Every leaking call site already wraps its client in try/finally { closeClient }, so re-enabling end() on workerd fixes all of them at one point. This is the codebase's own established pattern — plugin_runtime/utils/pg.ts already ends its non-Hyperdrive pools this way.
• Module-scoped reused pools (file_read_cache.ts's sharedDeletedLookupPool) are never passed to closeClient, so they keep their intended lifetime.

Business Impact (AI generated)

• Restores reliability on the paid bundle-upload write path across two production workers (capgo_files-prod:files and capgo_api-prod:api), where authorization was failing at the database step.
• Removing the per-request pool leak should cut the pool-exhaustion errors toward zero on the upload path; the nightly bundle-cleanup burst may still peak, so a residual floor is expected rather than a full elimination.

Test Plan (AI generated)

• oxlint passes on the changed backend file and the new test.
• bun test:unit — new tests/pg-close-client-lifecycle.unit.test.ts asserts closeClient ends the pool and swallows end() failures. (Could not run locally: this environment has no bun/node_modules; relying on CI.)
• After deploy, confirm the "Timed out while waiting for an open slot in the pool" exception volume drops on capgo_files-prod:files and capgo_api-prod:api.
• Confirm bundle uploads (including multi-chunk TUS PATCH) still authorize and complete.

Checklist

• My code follows the code style of this project and passes bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce my tests.

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 347c8910-b824-47f1-b7bb-a2fff3d3dcd6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will improve performance by 82.43%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 42 untouched benchmarks
⏩ 2 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	/updates manifest response with metadata	255.5 µs	140.1 µs	+82.43%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing posthog-self-driving/fixbackend-stop-leaking-per-request-8884b3 (861ebcd) with main (ea1a1ed)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[rihoarvutikonto]

Unique: always-end() on workerd Hyperdrive Pool fights the plugin_runtime Client+skipEnd contract; the new test already expects end() to be unsupported.

[cursor]

@coderabbitai review

[cursor]

@coderabbitai review

[cursor]

@coderabbitai review

[cursor]

@coderabbitai review

[TorichanCapgo]

@coderabbitai full review

[TorichanCapgo]

@coderabbitai full review

[TorichanCapgo]

@coderabbitai full review

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.4% Duplication on New Code

See analysis details on SonarQube Cloud

[TorichanCapgo]

@coderabbitai full review