feat(pam): in-browser web access terminal for PAM postgres accounts by saifsmailbox98 · Pull Request #5425 · Infisical/infisical

saifsmailbox98 · 2026-02-10T21:53:30Z

Context

Adds browser-based web access for PAM accounts (PostgreSQL)

Screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

…REPL, and session lifecycle management

linear · 2026-02-10T21:53:33Z

PAM-4 PAM Web launcher: Implement Postgres access via browser

maidul98 · 2026-02-10T21:54:21Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-02-10T22:11:37Z

Greptile Overview

Greptile Summary

Adds browser-based web access for PAM PostgreSQL accounts by issuing a one-time WebSocket ticket, establishing a gateway-v2 relay tunnel, and running a pg-backed SQL REPL over the socket. Introduces session tracking (duration, concurrent-session limit, expiry scheduling) and a new SessionEnd server message so the frontend terminal can show completion/quit/connection-lost reasons. Also extends gateway proxy protocols to support PAM and adds long-lived relay socket support.

Confidence Score: 3/5

This PR is close to mergeable, but has a couple of concrete issues to address before it’s safe to ship.
Core flow (ticket -> tunnel -> pg REPL) is coherent and covered by unit tests for lexer/formatter/REPL. However, cleanup currently opens a relay connection that may not be closed (FD leak risk), and the frontend introduces new native-regex usage that violates the repo’s ReDoS policy.
backend/src/ee/services/pam-web-access/pam-web-access-service.ts; frontend/src/pages/pam/PamAccountsPage/components/PamWebAccess/usePamWebAccessSession.ts

Important Files Changed

Filename	Overview
backend/src/db/migrations/20260210074536_pam-session-access-method.ts	Adds idempotent migration to add nullable accessMethod column to PamSession.
backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts	Adds web-access ticket + WebSocket routes and tightens auditLogInfo typing for ticket payload.
backend/src/ee/services/pam-session/pam-session-dal.ts	Adds DAL method countActiveWebSessions to enforce per-user concurrent session limit.
backend/src/ee/services/pam-web-access/pam-web-access-service.ts	Replaces echo-mode with actual pg-backed SQL REPL over gateway tunnel; adds session lifecycle, keepalive, and cancellation (one cleanup socket-close issue noted).
backend/src/lib/gateway-v2/gateway-v2.ts	Exports createGatewayConnection and adds longLived option to disable timeouts and enable keepalive for relay/gateway sockets.
frontend/src/pages/pam/PamAccountsPage/components/PamWebAccess/usePamWebAccessSession.ts	Adds disconnect helper, syncs Ctrl+C buffer clearing, and handles SessionEnd (introduces native regex use per policy).

greptile-apps

_{20 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

frontend/src/pages/pam/PamAccountsPage/components/PamWebAccess/usePamWebAccessSession.ts

backend/src/ee/services/pam-web-access/pam-web-access-service.ts

…cated PAM account access page

backend/src/ee/services/pam-web-access/pam-web-access-service.ts

frontend/src/pages/pam/PamAccountByIDPage/PamAccountByIDPage.tsx

frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx

frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceAccountsSection.tsx

frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx

frontend/src/routeTree.gen.ts

backend/src/ee/services/pam-web-access/pam-web-access-service.ts

backend/src/ee/services/pam-web-access/pam-web-access-repl.ts

backend/src/ee/services/pam-web-access/pam-web-access-service.ts

backend/src/ee/services/pam-web-access/pam-web-access-repl.test.ts

…rce connection details and account credentials more descriptive, cast them once

…rap around

saifsmailbox98 · 2026-02-12T18:43:47Z

Suppressed the toast errors coming from the errors generated by the ticket generation API when MFA or approval is required.

sheensantoscapadngan

LGTM

saifsmailbox98 added 2 commits February 11, 2026 03:22

Implement PostgreSQL web access sessions with gateway tunneling, SQL …

6d692be

…REPL, and session lifecycle management

Removed magic numbers for postgres types

3c955ae

saifsmailbox98 changed the title ~~Saif/pam 4 pam web launcher implement postgres access via browser 3~~ feat(pam): in-browser web access terminal for PAM postgres accounts Feb 10, 2026

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

frontend/src/pages/pam/PamAccountsPage/components/PamWebAccess/usePamWebAccessSession.ts Outdated Show resolved Hide resolved

backend/src/ee/services/pam-web-access/pam-web-access-service.ts Outdated Show resolved Hide resolved

Fix relay socket leak in session cancellation cleanup

0cb0e57

saifsmailbox98 requested a review from sheensantoscapadngan February 10, 2026 22:17

Remove PAM web access modal and related components, replace with dedi…

ef84a10

…cated PAM account access page