Fix db test-connection command to work with keyring password storage

- Add buildConnectionConfig() function to handle pgx config with password retrieval
- Refactor testDatabaseConnection() to use buildConnectionConfig() for better testability
- Set config.Password when using keyring storage method for pgx authentication
- Preserve existing pgpass behavior (pgx automatically checks ~/.pgpass file)
- Update function signatures to pass service parameter for password retrieval
- Add comprehensive tests that verify password is actually set in pgx config:
  - TestBuildConnectionConfig_KeyringPassword: Stores real password in keyring and verifies config.Password is set
  - TestBuildConnectionConfig_PgpassStorage_NoPasswordSet: Verifies no password set for pgpass method
- Update existing tests with service parameter for compatibility
- Follow same pattern as db psql fix for consistency

The db test-connection command now works properly with all password storage methods:
- keyring: Retrieves password from keyring and sets config.Password for pgx
- pgpass: Lets pgx automatically read ~/.pgpass file (unchanged)
- none: Uses interactive prompts or existing environment variables (unchanged)

Tests actually verify that password retrieval and config setting works correctly.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: cevian

internal/tiger/cmd/db.go

@@ -194,7 +194,7 @@ Examples:
 			}
 
 			// Test the connection
-			return testDatabaseConnection(connectionString, dbTestConnectionTimeout, cmd)
+			return testDatabaseConnection(connectionString, dbTestConnectionTimeout, service, cmd)
 		},
 	}
 
@@ -382,8 +382,30 @@ func buildPsqlCommand(connectionString, psqlPath string, additionalFlags []strin
 	return psqlCmd
 }
 
+// buildConnectionConfig creates a pgx connection config with proper password handling
+func buildConnectionConfig(connectionString string, service api.Service) (*pgx.ConnConfig, error) {
+	// Parse the connection string first to validate it
+	config, err := pgx.ParseConfig(connectionString)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set password from keyring storage if available
+	// pgpass storage works automatically since pgx checks ~/.pgpass file
+	storage := GetPasswordStorage()
+	if _, isKeyring := storage.(*KeyringStorage); isKeyring {
+		if password, err := storage.Get(service); err == nil && password != "" {
+			config.Password = password
+		}
+		// Note: If keyring password retrieval fails, we let pgx try without it
+		// This allows fallback to other authentication methods
+	}
+
+	return config, nil
+}
+
 // testDatabaseConnection tests the database connection and returns appropriate exit codes
-func testDatabaseConnection(connectionString string, timeout time.Duration, cmd *cobra.Command) error {
+func testDatabaseConnection(connectionString string, timeout time.Duration, service api.Service, cmd *cobra.Command) error {
 	// Create context with timeout if specified
 	var ctx context.Context
 	var cancel context.CancelFunc
@@ -395,10 +417,10 @@ func testDatabaseConnection(connectionString string, timeout time.Duration, cmd
 		ctx = context.Background()
 	}
 
-	// Parse the connection string first to validate it
-	config, err := pgx.ParseConfig(connectionString)
+	// Build connection config with proper password handling
+	config, err := buildConnectionConfig(connectionString, service)
 	if err != nil {
-		fmt.Fprintf(cmd.ErrOrStderr(), "Failed to parse connection string: %v\n", err)
+		fmt.Fprintf(cmd.ErrOrStderr(), "Failed to build connection config: %v\n", err)
 		return exitWithCode(3, err) // Invalid parameters
 	}
 

internal/tiger/cmd/db_test.go

@@ -417,6 +417,85 @@ func TestBuildPsqlCommand_PgpassStorage_NoEnvVar(t *testing.T) {
 	}
 }
 
+func TestBuildConnectionConfig_KeyringPassword(t *testing.T) {
+	// This test verifies that buildConnectionConfig properly sets password from keyring
+	
+	// Set keyring as the password storage method for this test
+	originalStorage := viper.GetString("password_storage")
+	viper.Set("password_storage", "keyring")
+	defer viper.Set("password_storage", originalStorage)
+	
+	// Create a test service
+	serviceID := "test-connection-config-service"
+	projectID := "test-connection-config-project"
+	service := api.Service{
+		ServiceId: &serviceID,
+		ProjectId: &projectID,
+	}
+
+	// Store a test password in keyring
+	testPassword := "test-connection-config-password-789"
+	storage := GetPasswordStorage()
+	err := storage.Save(service, testPassword)
+	if err != nil {
+		t.Fatalf("Failed to save test password: %v", err)
+	}
+	defer storage.Remove(service) // Clean up after test
+
+	connectionString := "postgresql://testuser@testhost:5432/testdb?sslmode=require"
+	
+	// Call the actual production function that builds the config
+	config, err := buildConnectionConfig(connectionString, service)
+	
+	if err != nil {
+		t.Fatalf("buildConnectionConfig failed: %v", err)
+	}
+	
+	if config == nil {
+		t.Fatal("buildConnectionConfig returned nil config")
+	}
+	
+	// Verify that the password was set in the config
+	if config.Password != testPassword {
+		t.Errorf("Expected password '%s' to be set in config, but got '%s'", testPassword, config.Password)
+	}
+}
+
+func TestBuildConnectionConfig_PgpassStorage_NoPasswordSet(t *testing.T) {
+	// This test verifies that buildConnectionConfig doesn't set password for pgpass storage
+	
+	// Set pgpass as the password storage method for this test
+	originalStorage := viper.GetString("password_storage")
+	viper.Set("password_storage", "pgpass")
+	defer viper.Set("password_storage", originalStorage)
+	
+	// Create a test service
+	serviceID := "test-connection-config-pgpass"
+	projectID := "test-connection-config-project"
+	service := api.Service{
+		ServiceId: &serviceID,
+		ProjectId: &projectID,
+	}
+
+	connectionString := "postgresql://testuser@testhost:5432/testdb?sslmode=require"
+	
+	// Call the actual production function that builds the config
+	config, err := buildConnectionConfig(connectionString, service)
+	
+	if err != nil {
+		t.Fatalf("buildConnectionConfig failed: %v", err)
+	}
+	
+	if config == nil {
+		t.Fatal("buildConnectionConfig returned nil config")
+	}
+	
+	// Verify that no password was set in the config (pgx will check ~/.pgpass automatically)
+	if config.Password != "" {
+		t.Errorf("Expected no password to be set in config for pgpass storage, but got '%s'", config.Password)
+	}
+}
+
 func TestSeparateServiceAndPsqlArgs(t *testing.T) {
 	testCases := []struct {
 		name                string
@@ -582,7 +661,8 @@ func TestTestDatabaseConnection_InvalidConnectionString(t *testing.T) {
 
 	// Test with malformed connection string (should return exit code 3)
 	invalidConnectionString := "this is not a valid connection string at all"
-	err := testDatabaseConnection(invalidConnectionString, 1, cmd)
+	service := api.Service{} // Dummy service for test
+	err := testDatabaseConnection(invalidConnectionString, 1, service, cmd)
 
 	if err == nil {
 		t.Error("Expected error for invalid connection string")
@@ -610,8 +690,9 @@ func TestTestDatabaseConnection_Timeout(t *testing.T) {
 	// Use a connection string to a non-routable IP to test timeout
 	timeoutConnectionString := "postgresql://user:pass@192.0.2.1:5432/db?sslmode=disable&connect_timeout=1"
 
+	service := api.Service{} // Dummy service for test
 	start := time.Now()
-	err := testDatabaseConnection(timeoutConnectionString, 1, cmd) // 1 second timeout
+	err := testDatabaseConnection(timeoutConnectionString, 1, service, cmd) // 1 second timeout
 	duration := time.Since(start)
 
 	if err == nil {