Port @azure/postgresql-auth package from postgres-entra-auth repo

[KarishmaGhiya]

Description

Migrates the standalone azure-postgresql-auth library into the monorepo as @azure/postgresql-auth - a new Azure SDK client package providing Entra ID authentication for PostgreSQL connections via both pg (node-postgres) and Sequelize clients.

Key changes:

• Source: TypeScript implementation with full type safety
  • getEntraTokenPassword() - acquires Entra ID token for use as PostgreSQL password
  • configureEntraIdAuth() - registers Sequelize beforeConnect hook for automatic token-based auth
• Build: Uses warp build system with 4 targets (browser, react-native, esm, commonjs)
• Tests: 19 unit tests with vitest (all passing)
• Peer deps: pg (>=8.0.0) and sequelize (>=6.0.0) as optional peer dependencies
• CI: New sdk/postgresql/ci.yml data-plane pipeline
• CODEOWNERS: Updated

References

• Standalone source: https://github.com/Azure/postgres-entra-auth/tree/main/javascript
• .NET reference: [PostgreSQL] Add Microsoft.Azure.PostgreSQL.Auth library azure-sdk-for-net#55231

Release Plan Details

• Release Plan: https://web.powerapps.com/apps/821ab569-ae60-420d-8264-d7b5d5ef734c?release-plan-id=0213048b-d1f0-f011-8407-000d3a3b8d97
• Work Item Link: https://dev.azure.com/azure-sdk/fe81d705-3c06-41e5-bf7c-5ebea18efe89/_workitems/edit/30201
• Spec Pull Request:
• Spec API version: 1.0.0

[Copilot]

Pull request overview

Migrates the standalone azure-postgresql-auth library into this repo as a new package @azure/postgresql-auth, providing Entra ID token acquisition for PostgreSQL connections (via pg) and a Sequelize beforeConnect hook for automatic token-based auth.

Changes:

• Introduces the new @azure/postgresql-auth package (source, build config, API extractor config, docs, changelog, license).
• Adds Vitest unit tests for getEntraTokenPassword and configureEntraIdAuth, plus shared test utilities.
• Adds samples (JavaScript + TypeScript) and wires up CI + CODEOWNERS + lockfile entries.

Reviewed changes

Copilot reviewed 32 out of 33 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
sdk/postgresql/postgresql-auth/warp.config.yml	Warp build/export configuration for the new package
sdk/postgresql/postgresql-auth/vitest.config.ts	Hooks package tests into the repo’s shared Vitest config
sdk/postgresql/postgresql-auth/tsconfig.test.node.json	Test TS config and path mappings for local test runs
sdk/postgresql/postgresql-auth/tsconfig.test.json	TS project references for test compilation
sdk/postgresql/postgresql-auth/tsconfig.src.json	TS config for building the library source
sdk/postgresql/postgresql-auth/tsconfig.json	TS project references (src + tests)
sdk/postgresql/postgresql-auth/test/public/utils/testUtils.ts	Shared test utilities (mock credentials, mock Sequelize hooks, JWT helpers)
sdk/postgresql/postgresql-auth/test/public/getEntraTokenPassword.spec.ts	Unit tests for token acquisition helper
sdk/postgresql/postgresql-auth/test/public/configureEntraIdAuth.spec.ts	Unit tests for Sequelize hook configuration and username derivation
sdk/postgresql/postgresql-auth/src/logger.ts	Package logger setup via @azure/logger
sdk/postgresql/postgresql-auth/src/index.ts	Public entrypoint exports for the package
sdk/postgresql/postgresql-auth/src/entraConnection.ts	Core implementation of token acquisition + Sequelize hook
sdk/postgresql/postgresql-auth/samples/v1-beta/typescript/tsconfig.json	TS sample compilation config
sdk/postgresql/postgresql-auth/samples/v1-beta/typescript/src/sequelizeConnection.ts	TypeScript Sequelize sample
sdk/postgresql/postgresql-auth/samples/v1-beta/typescript/src/pgConnection.ts	TypeScript pg sample
sdk/postgresql/postgresql-auth/samples/v1-beta/typescript/sample.env	Sample environment variable template
sdk/postgresql/postgresql-auth/samples/v1-beta/typescript/package.json	TypeScript samples’ package manifest
sdk/postgresql/postgresql-auth/samples/v1-beta/typescript/README.md	TypeScript samples README
sdk/postgresql/postgresql-auth/samples/v1-beta/javascript/sequelizeConnection.js	JavaScript Sequelize sample
sdk/postgresql/postgresql-auth/samples/v1-beta/javascript/sample.env	JavaScript sample environment variable template
sdk/postgresql/postgresql-auth/samples/v1-beta/javascript/pgConnection.js	JavaScript pg sample
sdk/postgresql/postgresql-auth/samples/v1-beta/javascript/package.json	JavaScript samples’ package manifest
sdk/postgresql/postgresql-auth/samples/v1-beta/javascript/README.md	JavaScript samples README
sdk/postgresql/postgresql-auth/review/postgresql-auth-node.api.md	API Extractor report for public surface validation
sdk/postgresql/postgresql-auth/package.json	Package metadata, scripts, exports, deps/peer deps
sdk/postgresql/postgresql-auth/eslint.config.mjs	Package ESLint rule configuration
sdk/postgresql/postgresql-auth/api-extractor.json	API Extractor configuration (extends repo base)
sdk/postgresql/postgresql-auth/README.md	Package README with usage examples
sdk/postgresql/postgresql-auth/LICENSE	Package license file
sdk/postgresql/postgresql-auth/CHANGELOG.md	Initial changelog entry for beta.1
sdk/postgresql/ci.yml	Adds CI pipeline for the postgresql service directory/package
pnpm-lock.yaml	Workspace lockfile updates for the new package (and deps)
.github/CODEOWNERS	Adds code ownership for the new package path

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

You can also share your feedback on Copilot code review. Take the survey.

[maorleger]

We're close, just need a few things @KarishmaGhiya to tidy this up 👍

[github-actions]

Archie API Review — @azure/postgresql-auth (new package, v1.0.0-beta.1)

This is a new package being ported into the Azure SDK for JavaScript monorepo. 4 API design issues were found (0 critical, 3 medium, 1 low). No breaking changes (first release). CI status was not blocking review.

Summary of findings:

#	Severity	Issue
1	🟡 Medium	entraTokenProvider should use a verb prefix (getEntraToken) per naming conventions
2	🟡 Medium	GetEntraTokenPasswordOptions must extend OperationOptions to support AbortSignal cancellation
3	🟡 Medium	Return type typeof sequelizeInstance should be expressed as a generic <T extends SequelizeBeforeConnectHook>: T
4	🔵 Low	Export alias GetEntraAccessTokenOptions as GetEntraTokenPasswordOptions mixes "Token" and "Password" terminology

All findings are actionable before the first beta release.

📊 Structured Report

{"agent":"archie","pr":37647,"summary":"issues_found","findings":[{"file":"sdk/postgresql/postgresql-auth/review/postgresql-auth-node.api.md","line":18,"severity":"medium","category":"naming","description":"entraTokenProvider does not follow verb-first naming convention; should be getEntraToken or similar per Azure SDK guidelines"},{"file":"sdk/postgresql/postgresql-auth/review/postgresql-auth-node.api.md","line":22,"severity":"medium","category":"options-design","description":"GetEntraTokenPasswordOptions does not extend OperationOptions; async operation missing AbortSignal cancellation support"},{"file":"sdk/postgresql/postgresql-auth/review/postgresql-auth-node.api.md","line":10,"severity":"medium","category":"type-safety","description":"Return type typeof sequelizeInstance is non-idiomatic; should use generic <T extends SequelizeBeforeConnectHook>: T"},{"file":"sdk/postgresql/postgresql-auth/src/index.ts","line":16,"severity":"low","category":"naming","description":"Export alias GetEntraAccessTokenOptions as GetEntraTokenPasswordOptions mixes Token/Password terminology inconsistently"}]}

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• #37647 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #37647 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

🏗️ Reviewed by Architecture Review

[github-actions]

This PR introduces a new @azure/postgresql-auth package with generally good documentation. Found 4 issues (0 critical, 2 medium, 2 low):

1. [medium] Snippet test names ("entraTokenProvider", "configureEntraAuthentication", "Logging") don't follow the ReadmeSample<Feature> convention used across the repo — both snippets.spec.ts and the snippet: tags in README.md need renaming.
2. [medium] README code fences use dynamic await import() while the samples use standard static imports — this inconsistency can mislead users who copy from the README.
3. [low] GetEntraTokenPasswordOptions (scope override) and SequelizeBeforeConnectHook are exported but not mentioned in the README Key Concepts section.
4. [low] The @param options JSDoc on entraTokenProvider should reference the exported public type name GetEntraTokenPasswordOptions (not the internal alias GetEntraAccessTokenOptions) for consistency with the API report.

📊 Structured Report

{"agent":"scribe","pr":37647,"summary":"issues_found","findings":[{"file":"sdk/postgresql/postgresql-auth/test/snippets.spec.ts","line":9,"severity":"medium","category":"snippet-naming","description":"Snippet names do not follow ReadmeSample<Feature> convention; should be ReadmeSampleEntraTokenProvider, ReadmeSampleConfigureEntraAuthentication, ReadmeSampleLogging"},{"file":"sdk/postgresql/postgresql-auth/README.md","line":57,"severity":"medium","category":"consistency","description":"README examples use dynamic await import() while samples use static ES module imports, creating inconsistency for users"},{"file":"sdk/postgresql/postgresql-auth/README.md","line":41,"severity":"low","category":"missing-docs","description":"Key Concepts section omits GetEntraTokenPasswordOptions (scope override) and SequelizeBeforeConnectHook from the public API description"},{"file":"sdk/postgresql/postgresql-auth/src/index.ts","line":16,"severity":"low","category":"tsdoc","description":"entraTokenProvider `@param` options should reference the exported public type name GetEntraTokenPasswordOptions, not the internal GetEntraAccessTokenOptions alias"}]}

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• #37647 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #37647 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

📝 Proofread by Documentation Review