registry: add sqlx checks for auth profile reads

crates/crank-registry/src/postgres/auth.rs

@@ -395,48 +395,71 @@ impl PostgresRegistry {
         workspace_id: &WorkspaceId,
         auth_profile_id: &crank_core::AuthProfileId,
     ) -> Result<Option<AuthProfile>, RegistryError> {
-        let row = sqlx::query(
+        let row = sqlx::query!(
             "select
                 id,
                 workspace_id,
                 name,
                 kind,
                 config_json,
-                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
-                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as updated_at
+                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"created_at!\",
+                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"updated_at!\"
              from auth_profiles
              where workspace_id = $1 and id = $2",
+            workspace_id.as_str(),
+            auth_profile_id.as_str(),
         )
-        .bind(workspace_id.as_str())
-        .bind(auth_profile_id.as_str())
         .fetch_optional(&self.pool)
         .await?;
 
-        row.as_ref().map(map_auth_profile).transpose()
+        row.map(|row| {
+            build_auth_profile(
+                row.id,
+                row.workspace_id,
+                row.name,
+                row.kind,
+                row.config_json,
+                row.created_at,
+                row.updated_at,
+            )
+        })
+        .transpose()
     }
 
     pub async fn list_auth_profiles(
         &self,
         workspace_id: &WorkspaceId,
     ) -> Result<Vec<AuthProfile>, RegistryError> {
-        let rows = sqlx::query(
+        let rows = sqlx::query!(
             "select
                 id,
                 workspace_id,
                 name,
                 kind,
                 config_json,
-                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
-                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as updated_at
+                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"created_at!\",
+                to_char(updated_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as \"updated_at!\"
              from auth_profiles
              where workspace_id = $1
              order by name asc",
+            workspace_id.as_str(),
         )
-        .bind(workspace_id.as_str())
         .fetch_all(&self.pool)
         .await?;
 
-        rows.iter().map(map_auth_profile).collect()
+        rows.into_iter()
+            .map(|row| {
+                build_auth_profile(
+                    row.id,
+                    row.workspace_id,
+                    row.name,
+                    row.kind,
+                    row.config_json,
+                    row.created_at,
+                    row.updated_at,
+                )
+            })
+            .collect()
     }
 
     pub async fn list_auth_profiles_referencing_secret(

crates/crank-registry/src/postgres/mod.rs

@@ -665,18 +665,6 @@ fn map_operation_agent_ref(row: &PgRow) -> Result<OperationAgentRef, RegistryErr
     })
 }
 
-fn map_auth_profile(row: &PgRow) -> Result<AuthProfile, RegistryError> {
-    Ok(AuthProfile {
-        id: crank_core::AuthProfileId::new(row.try_get::<String, _>("id")?),
-        workspace_id: WorkspaceId::new(row.try_get::<String, _>("workspace_id")?),
-        name: row.try_get("name")?,
-        kind: deserialize_enum_text(&row.try_get::<String, _>("kind")?, "kind")?,
-        config: deserialize_json_value(row.try_get::<Json<Value>, _>("config_json")?.0)?,
-        created_at: row.try_get("created_at")?,
-        updated_at: row.try_get("updated_at")?,
-    })
-}
-
 fn map_agent_binding(row: &PgRow) -> Result<AgentOperationBinding, RegistryError> {
     Ok(AgentOperationBinding {
         operation_id: OperationId::new(row.try_get::<String, _>("operation_id")?),
@@ -758,6 +746,26 @@ fn build_operation_summary(
     })
 }
 
+fn build_auth_profile(
+    id: String,
+    workspace_id: String,
+    name: String,
+    kind: String,
+    config_json: Value,
+    created_at: String,
+    updated_at: String,
+) -> Result<AuthProfile, RegistryError> {
+    Ok(AuthProfile {
+        id: crank_core::AuthProfileId::new(id),
+        workspace_id: WorkspaceId::new(workspace_id),
+        name,
+        kind: deserialize_enum_text(&kind, "kind")?,
+        config: deserialize_json_value(config_json)?,
+        created_at,
+        updated_at,
+    })
+}
+
 fn build_agent_version_record(
     summary: &AgentSummary,
     version: i32,