Safely handle and sanitize invalid database URLs

backend/core/config.py

@@ -28,10 +28,15 @@ class Settings(BaseSettings):
         if not v or not isinstance(v, str) or not v.strip():
             return "sqlite+aiosqlite:////tmp/autoforge.db"
         v = v.strip()
+        # If someone accidentally pasted an HTTP/HTTPS URL (e.g. dashboard URL)
+        if v.startswith("http://") or v.startswith("https://"):
+            return "sqlite+aiosqlite:////tmp/autoforge.db"
         if v.startswith("postgres://"):
             return v.replace("postgres://", "postgresql+asyncpg://", 1)
         if v.startswith("postgresql://") and not v.startswith("postgresql+asyncpg://"):
             return v.replace("postgresql://", "postgresql+asyncpg://", 1)
+        if not (v.startswith("sqlite") or v.startswith("postgresql")):
+            return "sqlite+aiosqlite:////tmp/autoforge.db"
         return v
     secret_key: str = "change-me-in-production-use-a-long-random-string"
     encryption_key: str = "change-me-32-byte-base64-fernet-key-here="

backend/db/session.py

@@ -1,24 +1,37 @@
+import logging
 from collections.abc import AsyncGenerator
 
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from backend.core.config import get_settings
 
+logger = logging.getLogger(__name__)
 settings = get_settings()
 
-db_url = settings.database_url
-if db_url.startswith("sqlite"):
-    engine = create_async_engine(
-        db_url,
-        echo=False,
-        connect_args={"check_same_thread": False},
-    )
-else:
-    engine = create_async_engine(
-        db_url,
-        echo=False,
-        pool_pre_ping=True,
-    )
+
+def _create_engine_safely(url: str):
+    try:
+        if url.startswith("sqlite"):
+            return create_async_engine(
+                url,
+                echo=False,
+                connect_args={"check_same_thread": False},
+            )
+        return create_async_engine(
+            url,
+            echo=False,
+            pool_pre_ping=True,
+        )
+    except Exception as exc:
+        logger.error("Failed to create engine for %s, falling back to SQLite: %s", url, exc)
+        return create_async_engine(
+            "sqlite+aiosqlite:////tmp/autoforge.db",
+            echo=False,
+            connect_args={"check_same_thread": False},
+        )
+
+
+engine = _create_engine_safely(settings.database_url)
 
 AsyncSessionLocal = async_sessionmaker(
     engine,