From 266e45f16f9ee4a5f1aaee21b99df47ed91d992f Mon Sep 17 00:00:00 2001
From: blaisadmin <corey@blaishome.online>
Date: Thu, 26 Mar 2026 10:49:15 -0400
Subject: [PATCH] Fixing login

---
 README.md          |  5 +++++
 backend/src/app.ts | 19 +++++++++++++++----
 docker-compose.yml |  6 +++++-
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 7a01334..74cb61f 100644
--- a/README.md
+++ b/README.md
@@ -109,6 +109,11 @@ The app includes an Express API in [backend/src/app.ts](/home/corey/github/Arsen
 - `DEMO_ACCOUNT_PASSWORD`
 - `DEMO_ACCOUNT_NAME`
 
+Database note:
+
+- In Docker Compose, the backend uses `POSTGRES_HOST`, `POSTGRES_PORT`, `POSTGRES_DB`, `POSTGRES_USER`, and `POSTGRES_PASSWORD`
+- This avoids malformed `DATABASE_URL` issues when the database password contains URL-sensitive characters
+
 ### Response shape notes
 
 - Validation and business-rule errors generally return:
diff --git a/backend/src/app.ts b/backend/src/app.ts
index de62eee..69b629a 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -94,9 +94,12 @@ declare global {
 
 const app = express();
 const port = Number(process.env.PORT ?? 5000);
-const databaseUrl =
-  process.env.DATABASE_URL ||
-  `postgresql://${process.env.POSTGRES_USER}:${process.env.POSTGRES_PASSWORD}@localhost:5432/${process.env.POSTGRES_DB}`;
+const databaseUrl = process.env.DATABASE_URL || '';
+const postgresHost = process.env.POSTGRES_HOST ?? 'localhost';
+const postgresPort = Number(process.env.POSTGRES_PORT ?? 5432);
+const postgresDatabase = process.env.POSTGRES_DB ?? 'arsenal_iq';
+const postgresUser = process.env.POSTGRES_USER ?? 'arsenal';
+const postgresPassword = process.env.POSTGRES_PASSWORD ?? 'arsenal_dev_password';
 const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:3000';
 const apiBaseUrl = process.env.API_BASE_URL || 'http://localhost:5000/api';
 const allowRegistration = (process.env.ALLOW_REGISTRATION ?? 'true').toLowerCase() !== 'false';
@@ -104,7 +107,15 @@ const allowDemoAccount = (process.env.ALLOW_DEMO_ACCOUNT ?? 'false').toLowerCase
 const demoAccountPassword = process.env.DEMO_ACCOUNT_PASSWORD ?? 'demo1234';
 const demoAccountName = process.env.DEMO_ACCOUNT_NAME ?? 'Demo User';
 const { Pool } = pg;
-const pool = new Pool({ connectionString: databaseUrl });
+const pool = databaseUrl
+  ? new Pool({ connectionString: databaseUrl })
+  : new Pool({
+      host: postgresHost,
+      port: postgresPort,
+      database: postgresDatabase,
+      user: postgresUser,
+      password: postgresPassword,
+    });
 
 const defaultCalibers = ['9mm', '.22 LR', '5.56 NATO', '.308 Win', '12 Gauge', '.45 ACP'];
 const firearmCategories = ['Handgun', 'Rifle', 'Shotgun', 'PCC', 'Other'];
diff --git a/docker-compose.yml b/docker-compose.yml
index fb5c23a..e843a2b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -27,7 +27,11 @@ services:
     environment:
       PORT: 5000
       NODE_ENV: ${NODE_ENV:-development}
-      DATABASE_URL: postgresql://${POSTGRES_USER:-arsenal}:${POSTGRES_PASSWORD:-arsenal_dev_password}@postgres:5432/${POSTGRES_DB:-arsenal_iq}
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: 5432
+      POSTGRES_DB: ${POSTGRES_DB:-arsenal_iq}
+      POSTGRES_USER: ${POSTGRES_USER:-arsenal}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-arsenal_dev_password}
       FRONTEND_URL: ${FRONTEND_URL:-http://localhost:3000}
       ALLOW_REGISTRATION: ${ALLOW_REGISTRATION:-true}
       ALLOW_DEMO_ACCOUNT: ${ALLOW_DEMO_ACCOUNT:-false}