feat(dashboard-api): supabase auth users sync background runner

.env.gcp.template

@@ -77,6 +77,10 @@ CLICKHOUSE_CLUSTER_SIZE=1
 
 # Dashboard API instance count (default: 0)
 DASHBOARD_API_COUNT=
+# Additional dashboard-api env vars passed directly to the Nomad job (default: {})
+# Values here are merged into the job env and can override module defaults.
+# Example: '{"ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER":"true"}'
+DASHBOARD_API_ENV_VARS=
 
 # Filestore cache for builds shared across cluster (default:false)
 FILESTORE_CACHE_ENABLED=

iac/modules/job-dashboard-api/jobs/dashboard-api.hcl

@@ -71,20 +71,9 @@ job "dashboard-api" {
       }
 
       env {
-        GIN_MODE                               = "release"
-        ENVIRONMENT                            = "${environment}"
-        NODE_ID                                = "$${node.unique.id}"
-        PORT                                   = "$${NOMAD_PORT_api}"
-        POSTGRES_CONNECTION_STRING             = "${postgres_connection_string}"
-        AUTH_DB_CONNECTION_STRING              = "${auth_db_connection_string}"
-        AUTH_DB_READ_REPLICA_CONNECTION_STRING = "${auth_db_read_replica_connection_string}"
-        CLICKHOUSE_CONNECTION_STRING           = "${clickhouse_connection_string}"
-        SUPABASE_JWT_SECRETS                   = "${supabase_jwt_secrets}"
-        REDIS_URL                              = "${redis_url}"
-        REDIS_CLUSTER_URL                      = "${redis_cluster_url}"
-        REDIS_TLS_CA_BASE64                    = "${redis_tls_ca_base64}"
-        OTEL_COLLECTOR_GRPC_ENDPOINT           = "${otel_collector_grpc_endpoint}"
-        LOGS_COLLECTOR_ADDRESS                 = "${logs_collector_address}"
+        %{ for key, value in env ~}
+        ${key} = "${value}"
+        %{ endfor ~}
       }
 
       config {

iac/modules/job-dashboard-api/main.tf

@@ -1,27 +1,37 @@
+locals {
+  base_env = {
+    GIN_MODE                               = "release"
+    ENVIRONMENT                            = var.environment
+    NODE_ID                                = "$${node.unique.id}"
+    PORT                                   = "$${NOMAD_PORT_api}"
+    POSTGRES_CONNECTION_STRING             = var.postgres_connection_string
+    AUTH_DB_CONNECTION_STRING              = var.auth_db_connection_string
+    AUTH_DB_READ_REPLICA_CONNECTION_STRING = var.auth_db_read_replica_connection_string
+    CLICKHOUSE_CONNECTION_STRING           = var.clickhouse_connection_string
+    SUPABASE_JWT_SECRETS                   = var.supabase_jwt_secrets
+    REDIS_URL                              = var.redis_url
+    REDIS_CLUSTER_URL                      = var.redis_cluster_url
+    REDIS_TLS_CA_BASE64                    = var.redis_tls_ca_base64
+    OTEL_COLLECTOR_GRPC_ENDPOINT           = "localhost:${var.otel_collector_grpc_port}"
+    LOGS_COLLECTOR_ADDRESS                 = "http://localhost:${var.logs_proxy_port.port}"
+  }
+
+  env = merge(local.base_env, var.extra_env)
+}
+
 resource "nomad_job" "dashboard_api" {
   jobspec = templatefile("${path.module}/jobs/dashboard-api.hcl", {
     update_stanza = var.update_stanza
     node_pool     = var.node_pool
     image_name    = var.image
-    environment   = var.environment
 
     count = var.count_instances
 
     memory_mb = 512
     cpu_count = 1
 
-    postgres_connection_string             = var.postgres_connection_string
-    auth_db_connection_string              = var.auth_db_connection_string
-    auth_db_read_replica_connection_string = var.auth_db_read_replica_connection_string
-    clickhouse_connection_string           = var.clickhouse_connection_string
-    supabase_jwt_secrets                   = var.supabase_jwt_secrets
-    redis_url                              = var.redis_url
-    redis_cluster_url                      = var.redis_cluster_url
-    redis_tls_ca_base64                    = var.redis_tls_ca_base64
+    env = local.env
 
     subdomain = "dashboard-api"
-
-    otel_collector_grpc_endpoint = "localhost:${var.otel_collector_grpc_port}"
-    logs_collector_address       = "http://localhost:${var.logs_proxy_port.port}"
   })
 }

iac/modules/job-dashboard-api/variables.tf

@@ -44,6 +44,11 @@ variable "supabase_jwt_secrets" {
   sensitive = true
 }
 
+variable "extra_env" {
+  type    = map(string)
+  default = {}
+}
+
 variable "otel_collector_grpc_port" {
   type    = number
   default = 4317

iac/provider-gcp/Makefile

@@ -76,6 +76,7 @@ tf_vars := \
 	$(call tfvar, LOKI_BOOT_DISK_TYPE) \
 	$(call tfvar, LOKI_USE_V13_SCHEMA_FROM) \
 	$(call tfvar, DASHBOARD_API_COUNT) \
+	$(call tfvar, DASHBOARD_API_ENV_VARS) \
 	$(call tfvar, DEFAULT_PERSISTENT_VOLUME_TYPE) \
 	$(call tfvar, PERSISTENT_VOLUME_TYPES) \
 	$(call tfvar, DB_MAX_OPEN_CONNECTIONS) \

iac/provider-gcp/main.tf

@@ -275,7 +275,8 @@ module "nomad" {
   otel_collector_resources_cpu_count = var.otel_collector_resources_cpu_count
 
   # Dashboard API
-  dashboard_api_count = var.dashboard_api_count
+  dashboard_api_count    = var.dashboard_api_count
+  dashboard_api_env_vars = var.dashboard_api_env_vars
 
   # Docker reverse proxy
   docker_reverse_proxy_port                = var.docker_reverse_proxy_port

iac/provider-gcp/nomad/main.tf

@@ -138,6 +138,7 @@ module "dashboard_api" {
   redis_url                              = local.redis_url
   redis_cluster_url                      = local.redis_cluster_url
   redis_tls_ca_base64                    = trimspace(data.google_secret_manager_secret_version.redis_tls_ca_base64.secret_data)
+  extra_env                              = var.dashboard_api_env_vars
 
   otel_collector_grpc_port = var.otel_collector_grpc_port
   logs_proxy_port          = var.logs_proxy_port

iac/provider-gcp/nomad/variables.tf

@@ -454,6 +454,11 @@ variable "dashboard_api_count" {
   default = 0
 }
 
+variable "dashboard_api_env_vars" {
+  type    = map(string)
+  default = {}
+}
+
 variable "volume_token_issuer" {
   type = string
 }

iac/provider-gcp/variables.tf

@@ -230,6 +230,11 @@ variable "dashboard_api_count" {
   default = 0
 }
 
+variable "dashboard_api_env_vars" {
+  type    = map(string)
+  default = {}
+}
+
 variable "docker_reverse_proxy_port" {
   type = object({
     name        = string

packages/api/go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/grafana/loki/v3 v3.6.4
 	github.com/hashicorp/nomad/api v0.0.0-20251216171439-1dee0671280e
-	github.com/jackc/pgx/v5 v5.7.5
+	github.com/jackc/pgx/v5 v5.9.1
 	github.com/launchdarkly/go-sdk-common/v3 v3.3.0
 	github.com/launchdarkly/go-server-sdk/v7 v7.13.0
 	github.com/oapi-codegen/gin-middleware v1.0.2
@@ -386,7 +386,7 @@ require (
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
 	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.35.0 // indirect

packages/api/internal/db/snapshots_test.go

@@ -23,7 +23,7 @@ func createTestTeam(t *testing.T, db *testutils.Database) uuid.UUID {
 
 	// Insert a team directly into the database using raw SQL
 	// Using the default tier 'base_v1' that is created in migrations
-	err := db.AuthDb.TestsRawSQL(t.Context(),
+	err := db.AuthDB.TestsRawSQL(t.Context(),
 		"INSERT INTO public.teams (id, name, tier, email, slug) VALUES ($1, $2, $3, $4, $5)",
 		teamID, "Test Team "+teamID.String(), "base_v1", "test-"+teamID.String()+"@example.com", slug,
 	)

packages/api/internal/handlers/template_alias_test.go

@@ -28,7 +28,7 @@ func TestQueryNotExistingTemplateAlias(t *testing.T) {
 
 	store := &APIStore{
 		sqlcDB:        testDB.SqlcClient,
-		authDB:        testDB.AuthDb,
+		authDB:        testDB.AuthDB,
 		templateCache: templatecache.NewTemplateCache(testDB.SqlcClient, redis),
 	}
 
@@ -38,7 +38,7 @@ func TestQueryNotExistingTemplateAlias(t *testing.T) {
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest(http.MethodGet, fmt.Sprintf("/templates/aliases/%s", alias), nil)
+	c.Request = httptest.NewRequestWithContext(t.Context(), http.MethodGet, fmt.Sprintf("/templates/aliases/%s", alias), nil)
 	auth.SetTeamInfo(c, &types.Team{
 		Team: &authqueries.Team{
 			ID:   teamID,
@@ -69,13 +69,13 @@ func TestQueryExistingTemplateAlias(t *testing.T) {
 
 	store := &APIStore{
 		sqlcDB:        testDB.SqlcClient,
-		authDB:        testDB.AuthDb,
+		authDB:        testDB.AuthDB,
 		templateCache: templatecache.NewTemplateCache(testDB.SqlcClient, redis),
 	}
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest(http.MethodGet, fmt.Sprintf("/templates/aliases/%s", alias), nil)
+	c.Request = httptest.NewRequestWithContext(t.Context(), http.MethodGet, fmt.Sprintf("/templates/aliases/%s", alias), nil)
 	auth.SetTeamInfo(c, &types.Team{
 		Team: &authqueries.Team{
 			ID:   teamID,
@@ -114,13 +114,13 @@ func TestQueryExistingTemplateAliasAsNotOwnerTeam(t *testing.T) {
 
 	store := &APIStore{
 		sqlcDB:        testDB.SqlcClient,
-		authDB:        testDB.AuthDb,
+		authDB:        testDB.AuthDB,
 		templateCache: templatecache.NewTemplateCache(testDB.SqlcClient, redis),
 	}
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest(http.MethodGet, fmt.Sprintf("/templates/aliases/%s", alias), nil)
+	c.Request = httptest.NewRequestWithContext(t.Context(), http.MethodGet, fmt.Sprintf("/templates/aliases/%s", alias), nil)
 	auth.SetTeamInfo(c,
 		&types.Team{
 			Team: &authqueries.Team{

packages/api/internal/orchestrator/placement/placement_benchmark_test.go

@@ -334,12 +334,12 @@ func runBenchmark(b *testing.B, algorithm Algorithm, config BenchmarkConfig, nod
 		mu               sync.Mutex
 		placementTimes   []time.Duration
 		activeSandboxes  sync.Map // sandboxID -> *LiveSandbox
-		sandboxIDCounter int64
+		sandboxIDCounter atomic.Int64
 
 		// Metrics for time series
 		recentPlacements []time.Duration
-		recentSuccesses  int64
-		recentFailures   int64
+		recentSuccesses  atomic.Int64
+		recentFailures   atomic.Int64
 	)
 
 	// Start sandbox cleanup goroutine
@@ -384,7 +384,7 @@ func runBenchmark(b *testing.B, algorithm Algorithm, config BenchmarkConfig, nod
 			select {
 			case <-ticker.C:
 				// Generate sandbox with variance
-				sandboxID := atomic.AddInt64(&sandboxIDCounter, 1)
+				sandboxID := sandboxIDCounter.Add(1)
 
 				cpuVariance := (rand.Float64()*2 - 1) * config.CPUVariance
 				requestedCPU := max(int64(float64(config.AvgSandboxCPU)*(1+cpuVariance)), 1)
@@ -448,15 +448,15 @@ func runBenchmark(b *testing.B, algorithm Algorithm, config BenchmarkConfig, nod
 								if simNode.PlaceSandbox(sbx) {
 									activeSandboxes.Store(sbx.ID, sbx)
 									metrics.SuccessfulPlacements++
-									atomic.AddInt64(&recentSuccesses, 1)
+									recentSuccesses.Add(1)
 									success = true
 								}
 							}
 						}
 
 						if !success {
 							metrics.FailedPlacements++
-							atomic.AddInt64(&recentFailures, 1)
+							recentFailures.Add(1)
 						}
 						mu.Unlock()
 					}

packages/api/internal/sandbox/storage/memory/operations_test.go

@@ -832,8 +832,8 @@ func TestConcurrency_StressTest(t *testing.T) {
 	stopCh := make(chan struct{})
 
 	// Metrics
-	var opsCompleted uint64
-	var errorCount uint64
+	var opsCompleted atomic.Uint64
+	var errorCount atomic.Uint64
 
 	// Launch workers that continuously perform random operations
 	for i := range 200 {
@@ -857,21 +857,21 @@ func TestConcurrency_StressTest(t *testing.T) {
 							if finish != nil {
 								finish(t.Context(), nil)
 							}
-							atomic.AddUint64(&opsCompleted, 1)
+							opsCompleted.Add(1)
 						} else if err != nil {
-							atomic.AddUint64(&errorCount, 1)
+							errorCount.Add(1)
 						}
 					case 1: // Read state
 						_ = sbx.State()
-						atomic.AddUint64(&opsCompleted, 1)
+						opsCompleted.Add(1)
 					case 2: // Wait with timeout
 						waitCtx, cancel := context.WithTimeout(t.Context(), time.Microsecond*10)
 						_ = waitForStateChange(waitCtx, sbx)
 						cancel()
-						atomic.AddUint64(&opsCompleted, 1)
+						opsCompleted.Add(1)
 					case 3: // Read _data
 						_ = sbx.Data()
-						atomic.AddUint64(&opsCompleted, 1)
+						opsCompleted.Add(1)
 					}
 				}
 
@@ -887,8 +887,8 @@ func TestConcurrency_StressTest(t *testing.T) {
 	close(stopCh)
 	wg.Wait()
 
-	finalOps := atomic.LoadUint64(&opsCompleted)
-	finalErrors := atomic.LoadUint64(&errorCount)
+	finalOps := opsCompleted.Load()
+	finalErrors := errorCount.Load()
 	t.Logf("Stress test completed: %d operations, %d errors", finalOps, finalErrors)
 
 	// Should have completed many operations without panic

packages/auth/go.mod

@@ -64,7 +64,7 @@ require (
 	github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jellydator/ttlcache/v3 v3.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect

packages/clickhouse/go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
@@ -93,7 +93,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect