fix(cubejs): match checkSqlAuth signature to Cube.js v1.6

[acmeguy]

Summary

• Fix checkSqlAuth callback signature — Cube.js v1.6 passes (request, user, password) as three positional args; our code expected (_, user) and treated the username string as the password.
• Unblocks Postgres / MySQL wire auth against the CubeJS SQL API.

Root cause

@cubejs-backend/api-gateway/dist/src/sql-server.js:291,105 wraps the callback and always calls it with three positional args. When a Postgres client connects (e.g. psql -U e0m19ghdz9), Cube hands us:

request  = { protocol: "postgres", method: "password", apiType: "sql" }
user     = "e0m19ghdz9"
password = "<client-supplied>"

The existing code:

const checkSqlAuth = async (_, user) => {
  const password = typeof user === "string" ? user : user?.password;
  const username = typeof user === "string" ? _    : user?.username;
  ...
  const sqlCredentials = await findSqlCredentials(username || user);
}

With user being a string, this assigned the username string to password and the request object to username. findSqlCredentials then called Hasura with an object variable:

parsing Text failed, expected String, but encountered Object
path: $.selectionSet.sql_credentials.args.where.username._eq

Every SQL login failed before the password was ever compared. Reproduced with psql -h <cubejs> -p 15432 -U <valid> -d db → 28P01 FATAL: password authentication failed.

Fix

• Declare the callback with the v1.6 signature: (request, userArg, passwordArg).
• Keep a defensive branch for the legacy object-shape ({ username, password }) to not break anyone still on the old path.
• Reject non-string username before the Hasura lookup so a misrouted request surfaces as Incorrect user name or password rather than a 503 with a GraphQL parse error.

Test plan

• Build new container image; update data/synmetrix/overlays/dev/kustomization.yaml to the new tag
• Deploy and verify psql -h dbx.fraios.dev -p 15432 -U <valid_sql_user> -d db authenticates
• Verify JWT-as-password path still works (psql -U <datasource_id> -d db with a FraiOS JWT in PGPASSWORD)
• Verify a bad password still returns 28P01

🤖 Generated with Claude Code