fix(stdlib): wrap HA signer databaseUrl in SecretValue

yarn-project/end-to-end/src/composed/ha/e2e_ha_full.test.ts

@@ -104,7 +104,7 @@ describe('HA Full Setup', () => {
     databaseConfig = createHADatabaseConfig('ha-full-test');
 
     // Connect to database (migrations already run by docker-compose entrypoint)
-    mainPool = setupHADatabase(databaseConfig.databaseUrl);
+    mainPool = setupHADatabase(databaseConfig.databaseUrl.getValue()!);
 
     attesterPrivateKeys = Array.from(
       { length: VALIDATOR_COUNT },
@@ -130,7 +130,10 @@ describe('HA Full Setup', () => {
     await refreshWeb3Signer(web3SignerUrl, ...attesterAddresses, ...publisherAddresses);
 
     // Create database pools for HA nodes
-    haNodePools = Array.from({ length: NODE_COUNT }, () => new Pool({ connectionString: databaseConfig.databaseUrl }));
+    haNodePools = Array.from(
+      { length: NODE_COUNT },
+      () => new Pool({ connectionString: databaseConfig.databaseUrl.getValue()! }),
+    );
 
     const initialValidators = createInitialValidatorsFromPrivateKeys(attesterPrivateKeys);
 

yarn-project/end-to-end/src/fixtures/ha_setup.ts

@@ -11,7 +11,7 @@ import { privateKeyToAccount } from 'viem/accounts';
  */
 export interface HADatabaseConfig {
   /** PostgreSQL connection URL */
-  databaseUrl: string;
+  databaseUrl: SecretValue<string>;
   /** Node ID for HA coordination */
   nodeId: string;
   /** Enable HA signing */
@@ -28,7 +28,9 @@ export interface HADatabaseConfig {
  * Get database configuration from environment variables
  */
 export function createHADatabaseConfig(nodeId: string): HADatabaseConfig {
-  const databaseUrl = process.env.DATABASE_URL || 'postgresql://aztec:aztec@localhost:5432/aztec_ha_test';
+  const databaseUrl = new SecretValue(
+    process.env.DATABASE_URL || 'postgresql://aztec:aztec@localhost:5432/aztec_ha_test',
+  );
 
   return {
     databaseUrl,

yarn-project/sequencer-client/src/sequencer/checkpoint_voter.ha.integration.test.ts

@@ -240,7 +240,7 @@ describe('CheckpointVoter HA Integration', () => {
       pollingIntervalMs: 100,
       signingTimeoutMs: 3000,
       maxStuckDutiesAgeMs: 72000,
-      databaseUrl: 'postgresql://test',
+      databaseUrl: new SecretValue('postgresql://test'),
       dataStoreMapSizeKb: 128 * 1024 * 1024,
     };
 

yarn-project/stdlib/src/ha-signing/config.ts

@@ -1,11 +1,13 @@
 import type { L1ContractAddresses } from '@aztec/ethereum/l1-contract-addresses';
 import {
   type ConfigMappingsType,
+  SecretValue,
   booleanConfigHelper,
   getConfigFromMappings,
   getDefaultConfig,
   numberConfigHelper,
   optionalNumberConfigHelper,
+  secretStringConfigHelper,
 } from '@aztec/foundation/config';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import type { ZodFor } from '@aztec/foundation/schemas';
@@ -88,7 +90,7 @@ export interface ValidatorHASignerConfig extends BaseSignerConfig {
    * PostgreSQL connection string
    * Format: postgresql://user:password@host:port/database
    */
-  databaseUrl?: string;
+  databaseUrl?: SecretValue<string>;
   /** Maximum number of clients in the pool (default: 10) */
   poolMaxCount?: number;
   /** Minimum number of clients in the pool (default: 0) */
@@ -110,6 +112,7 @@ export const validatorHASignerConfigMappings: ConfigMappingsType<ValidatorHASign
     env: 'VALIDATOR_HA_DATABASE_URL',
     description:
       'PostgreSQL connection string for validator HA signer (format: postgresql://user:password@host:port/database)',
+    ...secretStringConfigHelper(),
   },
   poolMaxCount: {
     env: 'VALIDATOR_HA_POOL_MAX',
@@ -148,7 +151,7 @@ export function getConfigEnvVars(): ValidatorHASignerConfig {
 
 export const ValidatorHASignerConfigSchema = BaseSignerConfigSchema.extend({
   haSigningEnabled: z.boolean(),
-  databaseUrl: z.string().optional(),
+  databaseUrl: SecretValue.schema(z.string()).optional(),
   poolMaxCount: z.number().min(0).optional(),
   poolMinCount: z.number().min(0).optional(),
   poolIdleTimeoutMs: z.number().min(0).optional(),

yarn-project/validator-client/src/validator.ha.integration.test.ts

@@ -144,7 +144,7 @@ describe('ValidatorClient HA Integration', () => {
       pollingIntervalMs: 100,
       signingTimeoutMs: 3000,
       maxStuckDutiesAgeMs: 72000,
-      databaseUrl: 'postgresql://test',
+      databaseUrl: new SecretValue('postgresql://test'),
       dataStoreMapSizeKb: 128 * 1024 * 1024,
     };
 

yarn-project/validator-ha-signer/src/factory.ts

@@ -57,7 +57,8 @@ export async function createHASigner(
   const { databaseUrl, poolMaxCount, poolMinCount, poolIdleTimeoutMs, poolConnectionTimeoutMs, ...signerConfig } =
     config;
 
-  if (!databaseUrl) {
+  const databaseUrlValue = databaseUrl?.getValue();
+  if (!databaseUrlValue) {
     throw new Error('databaseUrl is required for createHASigner');
   }
 
@@ -68,7 +69,7 @@ export async function createHASigner(
   let pool: Pool;
   if (!deps?.pool) {
     pool = new Pool({
-      connectionString: databaseUrl,
+      connectionString: databaseUrlValue,
       max: poolMaxCount ?? 10,
       min: poolMinCount ?? 0,
       idleTimeoutMillis: poolIdleTimeoutMs ?? 10_000,