From 82517ee69daef075dfc0eef9b13099d60ff6a604 Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Wed, 1 Jul 2026 12:44:33 -0700
Subject: [PATCH] Move dbSync to environment config

---
 .../shared/src/config/schema-fuzzer.test.ts   | 22 ++++-----
 packages/shared/src/config/schema.ts          | 49 +++++++++++++------
 2 files changed, 46 insertions(+), 25 deletions(-)

diff --git a/packages/shared/src/config/schema-fuzzer.test.ts b/packages/shared/src/config/schema-fuzzer.test.ts
index 531f1c5f8..6ea556c3e 100644
--- a/packages/shared/src/config/schema-fuzzer.test.ts
+++ b/packages/shared/src/config/schema-fuzzer.test.ts
@@ -61,17 +61,6 @@ const branchSchemaFuzzerConfig = [{
     }],
     signUpRulesDefaultAction: ["allow", "reject"],
   }],
-  dbSync: [{
-    externalDatabases: [{
-      "some-external-db-id": [{
-        type: ["postgres"] as const,
-        connectionString: [
-          "postgres://user:password@host:port/database",
-          "some-connection-string",
-        ],
-      }],
-    }],
-  }],
   dataVault: [{
     stores: [{
       "some-store-id": [{
@@ -250,6 +239,17 @@ const environmentSchemaFuzzerConfig = [{
     ...branchSchemaFuzzerConfig[0].payments[0],
     testMode: [false, true],
   }],
+  dbSync: [{
+    externalDatabases: [{
+      "some-external-db-id": [{
+        type: ["postgres"] as const,
+        connectionString: [
+          "postgres://user:password@host:port/database",
+          "some-connection-string",
+        ],
+      }],
+    }],
+  }],
   analytics: [{
     queryFolders: [{
       "some-folder-id": [{
diff --git a/packages/shared/src/config/schema.ts b/packages/shared/src/config/schema.ts
index 46a49b3cd..cb262800f 100644
--- a/packages/shared/src/config/schema.ts
+++ b/packages/shared/src/config/schema.ts
@@ -327,20 +327,6 @@ export const branchConfigSchema = canNoLongerBeOverridden(projectConfigSchema, [
 
   payments: branchPaymentsSchema,
 
-  dbSync: yupObject({
-    externalDatabases: yupRecord(
-      userSpecifiedIdSchema("externalDatabaseId"),
-      yupObject({
-        type: yupString().oneOf(["postgres"]).defined(),
-        connectionString: yupString().when("type", {
-          is: "postgres",
-          then: (schema) => schema.defined(),
-          otherwise: (schema) => schema.optional(),
-        }),
-      }),
-    ),
-  }),
-
 
   dataVault: yupObject({
     stores: yupRecord(
@@ -449,6 +435,20 @@ export const environmentConfigSchema = branchConfigSchema.concat(yupObject({
     testMode: yupBoolean(),
   })),
 
+  dbSync: yupObject({
+    externalDatabases: yupRecord(
+      userSpecifiedIdSchema("externalDatabaseId"),
+      yupObject({
+        type: yupString().oneOf(["postgres"]).defined(),
+        connectionString: yupString().when("type", {
+          is: "postgres",
+          then: (schema) => schema.defined(),
+          otherwise: (schema) => schema.optional(),
+        }),
+      }),
+    ),
+  }),
+
   analytics: environmentAnalyticsSchema,
   customDashboards: schemaFields.customDashboardsSchema,
 }));
@@ -567,6 +567,13 @@ export function migrateConfigOverride(type: "project" | "branch" | "environment"
   }
   // END
 
+  // BEGIN 2026-07-01: dbSync.externalDatabases contains environment-specific connection strings.
+  // It should never be rendered from branch config, which can be read by branch-scoped tools.
+  if (type === "branch") {
+    res = removeProperty(res, p => p[0] === "dbSync");
+  }
+  // END
+
   // return the result
   return res;
 };
@@ -587,6 +594,20 @@ import.meta.vitest?.test("migrateConfigOverride removes legacy sourceOfTruth ove
   })).toEqual({});
 });
 
+import.meta.vitest?.test("migrateConfigOverride removes legacy branch-level dbSync overrides", ({ expect }) => {
+  const dbSync = {
+    externalDatabases: {
+      main: {
+        type: "postgres",
+        connectionString: "postgres://user:password@host:5432/database",
+      },
+    },
+  };
+
+  expect(migrateConfigOverride("branch", { dbSync })).toEqual({});
+  expect(migrateConfigOverride("environment", { dbSync })).toEqual({ dbSync });
+});
+
 function removeProperty(obj: Record<string, any>, pathCond: (path: (string | symbol)[]) => boolean): any {
   return mapProperty(obj, pathCond, () => undefined);
 }