Skip to content

**Bug: Database Conflict When PraisonAI Detects Supabase/Postgres in Production Environments** #335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jimboswankster opened this issue Jan 24, 2025 · 6 comments · Fixed by #537

Comments

@jimboswankster
Copy link

Title:

Bug: Database Conflict When PraisonAI Detects Supabase/Postgres in Production Environments


Description:

Issue:

When using PraisonAI in environments where a .env file includes credentials for Supabase or PostgreSQL (e.g., production setups), PraisonAI prioritizes these databases over SQLite. This behavior causes schema conflicts, particularly with the users table, as PraisonAI expects a different schema than most production applications.

Impact:

  • Data Integrity Risks: Production databases may be unintentionally modified.
  • Tool Inaccessibility: The tool cannot be used without modifying .env or isolating it in a separate environment.
  • Data Safety This is a necessary feature for data security and safety during production.
  • Separation of concerns keep the real db safe, while working with the praisonAi [code] tool.

Steps to Reproduce:

  1. Configure a .env file with Supabase or PostgreSQL connection strings.
  2. Run PraisonAI in a project where the database schema conflicts with the tool (e.g., a production app with different users table requirements).
  3. Observe schema conflicts and resulting errors.

Suggested Solution:

A feature was added in [Pull Request #<PR_NUMBER>](<PR_LINK>) to introduce a FORCE_SQLITE toggle. This toggle bypasses Supabase/Postgres detection and forces the tool to use SQLite, ensuring isolation from production databases.


Workaround:

Before this feature is merged, users can manually:

  1. Patch the db.py file to skip Supabase/Postgres detection and enforce SQLite usage.
  2. Use the patch provided in the codePatches directory of the pull request.

Linked Resources:


Request for Maintainers:

Consider merging the feature in Pull Request: #334 and adding documentation for users who might encounter similar issues.
Let me know if there are any additional adjustments you'd like me to make! It is my opinion that this would be well suited for a centralized config file where the user can select whichever database they want used instead of having auto-detect, or in addition to having autodetect.

@MervinPraison
Copy link
Owner

@claude review this request

Copy link
Contributor

claude bot commented May 28, 2025

Claude finished @MervinPraison's task —— View job


Database Conflict Issue Review

Issue Analysis Complete

Problem Validation: The reported issue is VALID and poses significant risks in production environments.

🔍 Root Cause Analysis

Automatic Database Detection Logic

The current implementation in both sql_alchemy.py:37-41 and db.py:60-63 automatically prioritizes external databases:

# Priority order (hardcoded):
1. SUPABASE_DATABASE_URL (highest priority)
2. DATABASE_URL (fallback)  
3. SQLite (only if neither exists)

Schema Conflict Points

  • users table: PraisonAI expects specific columns (id, identifier, meta, createdAt)
  • Data types: PostgreSQL vs SQLite boolean handling differences
  • Primary keys: SERIAL vs INTEGER AUTOINCREMENT incompatibilities

⚠️ Security & Data Integrity Risks

  1. Unintended Production DB Access: PraisonAI will automatically connect to production databases
  2. Schema Modifications: May attempt to create/modify tables without consent
  3. Data Corruption: Potential conflicts with existing users tables
  4. No User Control: Zero option to override database selection

💡 Recommended Solutions

Immediate Fix (FORCE_SQLITE approach)

# In both sql_alchemy.py and db.py
FORCE_SQLITE = os.getenv("FORCE_SQLITE", "false").lower() == "true"
if FORCE_SQLITE:
    DATABASE_URL = None
    SUPABASE_DATABASE_URL = None
# ... existing logic

Better Long-term Solution: Centralized Database Config

DATABASE_PROVIDER = os.getenv("PRAISONAI_DATABASE_PROVIDER", "auto")
# Values: "sqlite", "postgresql", "supabase", "auto"

📋 Implementation Recommendations

  1. Priority: Implement FORCE_SQLITE toggle immediately for safety
  2. Enhancement: Add centralized database configuration system
  3. Documentation: Clear warnings about production database usage
  4. Validation: Pre-flight checks for schema compatibility
  5. Isolation: Consider database prefixing/namespacing for PraisonAI tables

Issue Verdict

APPROVED for implementation. This is a critical data safety feature that should be prioritized. The FORCE_SQLITE approach provides immediate protection while allowing for more sophisticated configuration management in the future.


Job run

@MervinPraison
Copy link
Owner

@claude Is there any code change required ?

Copy link
Contributor

claude bot commented May 28, 2025

Claude finished @MervinPraison's task —— View job


Code Change Analysis Complete

YES, code changes are required to fix the database conflict issue described in this issue.

Current Problem Analysis:

🔍 Database Auto-Detection Logic Found

Both db.py:60-63 and sql_alchemy.py:37-41 contain automatic database detection that prioritizes external databases:

# db.py:60-63
self.database_url = os.getenv("DATABASE_URL")
supabase_url = os.getenv("SUPABASE_DATABASE_URL")
if supabase_url:
    self.database_url = supabase_url

# sql_alchemy.py:37-41  
DATABASE_URL = os.getenv("DATABASE_URL")
SUPABASE_DATABASE_URL = os.getenv("SUPABASE_DATABASE_URL")
if SUPABASE_DATABASE_URL:
    DATABASE_URL = SUPABASE_DATABASE_URL

Missing FORCE_SQLITE Feature

  • Searched codebase: No FORCE_SQLITE environment variable handling exists
  • No way for users to override automatic database detection
  • Production databases are automatically used when environment variables are present

🚨 Confirmed Risk Factors:

  1. Automatic Production DB Access: PraisonAI will connect to production databases without user consent
  2. Schema Conflicts: Creates PraisonAI-specific tables (users, threads, steps, etc.) in production databases
  3. No User Control: Zero mechanism to force SQLite usage

💡 Required Implementation:

Immediate Solution - Add FORCE_SQLITE Toggle:

# Both db.py and sql_alchemy.py need:
FORCE_SQLITE = os.getenv("FORCE_SQLITE", "false").lower() == "true"
if FORCE_SQLITE:
    DATABASE_URL = None
    SUPABASE_DATABASE_URL = None

Files Requiring Changes:

  1. src/praisonai/praisonai/ui/db.py (lines 60-63)
  2. src/praisonai/praisonai/ui/sql_alchemy.py (lines 37-41)

Conclusion:

Code changes are REQUIRED to implement the FORCE_SQLITE feature. This is a critical data safety issue that prevents users from accidentally connecting PraisonAI to production databases.


Job run

@MervinPraison
Copy link
Owner

@claude implement those changes

Copy link
Contributor

claude bot commented May 29, 2025

Claude finished @MervinPraison's task —— View jobclaude/issue-335-20250529_033521Create PR ➔


Implementing FORCE_SQLITE Feature

  • Analyze current database detection logic in target files
  • Implement FORCE_SQLITE toggle in db.py
  • Implement FORCE_SQLITE toggle in sql_alchemy.py
  • Test the implementation (skipped - no bash permissions)
  • Commit changes and provide PR link

✅ Implementation Complete

Changes Made:

  • Added FORCE_SQLITE environment variable check in both database files
  • When FORCE_SQLITE=true, external database URLs are completely ignored
  • SQLite will be used regardless of production database environment variables present
  • Maintains backward compatibility - defaults to false for existing behavior

Usage:

export FORCE_SQLITE=true
# Now PraisonAI will use SQLite regardless of DATABASE_URL or SUPABASE_DATABASE_URL

Files Modified:

  • src/praisonai/praisonai/ui/db.py:60-71
  • src/praisonai/praisonai/ui/sql_alchemy.py:37-50

Job run

claude bot added a commit that referenced this issue May 29, 2025
…ase detection

- Add FORCE_SQLITE flag in both db.py and sql_alchemy.py
- When FORCE_SQLITE=true, ignores DATABASE_URL and SUPABASE_DATABASE_URL
- Forces SQLite usage to prevent accidental production database connections
- Maintains backward compatibility with default behavior (FORCE_SQLITE=false)
- Resolves database conflict issues in production environments

Fixes #335

Co-authored-by: MervinPraison <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants