@lightdash/warehouses 2.164.0 → 2.165.0

package/dist/ssh/sshTunnel.d.ts

@@ -1,10 +1,15 @@
 import { CreateWarehouseCredentials } from '@lightdash/common';
+export type SshTunnelOptions = {
+    staticIp: string | null;
+    probeForward: boolean;
+};
 export declare class SshTunnel<T extends CreateWarehouseCredentials> {
     readonly originalCredentials: T;
     overrideCredentials: T;
     localPort: number | undefined;
     private sshConnection;
-    constructor(credentials: T);
+    private readonly options;
+    constructor(credentials: T, options?: SshTunnelOptions);
     connect: () => Promise<T>;
     disconnect: () => Promise<void>;
 }

package/dist/ssh/sshTunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sshTunnel.d.ts","sourceRoot":"","sources":["../../src/ssh/sshTunnel.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,0BAA0B,EAI7B,MAAM,mBAAmB,CAAC;AAoO3B,qBAAa,SAAS,CAAC,CAAC,SAAS,0BAA0B;IACvD,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEhC,mBAAmB,EAAE,CAAC,CAAC;IAEvB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B,OAAO,CAAC,aAAa,CAAyB;IAE9C,YAAY,WAAW,EAAE,CAAC,EAKzB;IAED,OAAO,QAAa,OAAO,CAAC,CAAC,CAAC,CA0D5B;IAEF,UAAU,QAAa,OAAO,CAAC,IAAI,CAAC,CAIlC;CACL"}
+{"version":3,"file":"sshTunnel.d.ts","sourceRoot":"","sources":["../../src/ssh/sshTunnel.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,0BAA0B,EAK7B,MAAM,mBAAmB,CAAC;AAwW3B,MAAM,MAAM,gBAAgB,GAAG;IAG3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAIxB,YAAY,EAAE,OAAO,CAAC;CACzB,CAAC;AAOF,qBAAa,SAAS,CAAC,CAAC,SAAS,0BAA0B;IACvD,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEhC,mBAAmB,EAAE,CAAC,CAAC;IAEvB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B,OAAO,CAAC,aAAa,CAAyB;IAE9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAE3C,YACI,WAAW,EAAE,CAAC,EACd,OAAO,GAAE,gBAA6C,EAOzD;IAED,OAAO,QAAa,OAAO,CAAC,CAAC,CAAC,CA4E5B;IAEF,UAAU,QAAa,OAAO,CAAC,IAAI,CAAC,CAIlC;CACL"}

package/dist/ssh/sshTunnel.js

@@ -39,13 +39,31 @@ const common_1 = require("@lightdash/common");
 const crypto = __importStar(require("crypto"));
 const net = __importStar(require("net"));
 const ssh2 = __importStar(require("ssh2"));
+const sshTunnelFailure_1 = require("./sshTunnelFailure");
+// The TCP connect is done here, not by ssh2, so a bastion that silently drops
+// packets fails as a tcp stage with ETIMEDOUT instead of ssh2's generic
+// handshake timeout. ssh2's ready timeout then only covers handshake and auth.
+const TCP_CONNECT_TIMEOUT_MS = 10000;
+const SSH_READY_TIMEOUT_MS = 15000;
+class SshTunnelStageFailure extends Error {
+    constructor(stage, cause) {
+        super(cause);
+        this.name = 'SshTunnelStageFailure';
+        this.stage = stage;
+    }
+}
 class SSH2Tunnel {
     constructor(args) {
         this.error = undefined;
+        this.tcpConnected = false;
+        this.handshakeCompleted = false;
         // Wall-clock (ms) when this tunnel was constructed. Used only for logging:
         // how long a connection survived before it was closed / dropped / timed out.
         this.openedAt = Date.now();
         this.id = crypto.randomBytes(8).toString('hex');
+        this.probeForwardOnConnect = args.probeForward;
+        this.sshHost = args.sshHost;
+        this.sshPort = args.sshPort;
         this.databaseHostOnRemote = args.databaseHostOnRemote;
         this.databasePortOnRemote = args.databasePortOnRemote;
         this.sshConnectConfig = {
@@ -53,6 +71,7 @@ class SSH2Tunnel {
             privateKey: args.sshPrivateKey,
             host: args.sshHost,
             port: args.sshPort,
+            readyTimeout: SSH_READY_TIMEOUT_MS,
         };
         this.sshClient = new ssh2.Client();
         this.localTcpServer = net.createServer();
@@ -74,6 +93,7 @@ class SSH2Tunnel {
             console.log(`SSH tunnel ${this.id} - ssh client received "end"`);
         });
         this.sshClient.on('handshake', () => {
+            this.handshakeCompleted = true;
             console.log(`SSH tunnel ${this.id} - ssh client handshake success`);
         });
         this.localTcpServer.on('close', () => {
@@ -155,53 +175,126 @@ class SSH2Tunnel {
         this.sshClient.end();
         this.localTcpServer.close(onClose);
     }
+    // Opens one forward to the database host and closes it straight away, so
+    // a bastion that cannot reach the database fails here as a "forward"
+    // stage instead of later as an opaque database error.
+    probeForward() {
+        return new Promise((resolve, reject) => {
+            this.sshClient.forwardOut('127.0.0.1', 0, this.databaseHostOnRemote, this.databasePortOnRemote, (err, stream) => {
+                if (err) {
+                    console.error(`SSH tunnel ${this.id} - forward probe to ${this.databaseHostOnRemote}:${this.databasePortOnRemote} failed: ${err.message}`);
+                    reject(new SshTunnelStageFailure('forward', err.message));
+                    return;
+                }
+                console.log(`SSH tunnel ${this.id} - forward probe to ${this.databaseHostOnRemote}:${this.databasePortOnRemote} succeeded`);
+                stream.close();
+                resolve();
+            });
+        });
+    }
     async connect() {
         return new Promise((resolve, reject) => {
+            let settled = false;
+            const fail = (stage, cause) => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(new SshTunnelStageFailure(stage, cause));
+            };
             if (this.error) {
-                reject(this.error);
+                fail('tcp', this.error.message);
+                return;
             }
             this.localTcpServer.on('error', (e) => {
-                reject(e);
+                fail('forward', e.message);
             });
             this.sshClient.on('error', (e) => {
-                reject(e);
+                fail((0, sshTunnelFailure_1.classifySshClientError)(e, {
+                    tcpConnected: this.tcpConnected,
+                    handshakeCompleted: this.handshakeCompleted,
+                }), (0, sshTunnelFailure_1.sshClientErrorMessage)(e));
+            });
+            const sock = net.connect({
+                host: this.sshHost,
+                port: this.sshPort,
+            });
+            sock.setTimeout(TCP_CONNECT_TIMEOUT_MS);
+            const onConnectError = (e) => {
+                sock.destroy();
+                fail((0, sshTunnelFailure_1.classifySshClientError)(e, {
+                    tcpConnected: false,
+                    handshakeCompleted: false,
+                }), (0, sshTunnelFailure_1.sshClientErrorMessage)(e));
+            };
+            const onConnectTimeout = () => {
+                const e = Object.assign(new Error(`connect ETIMEDOUT ${this.sshHost}:${this.sshPort} after ${TCP_CONNECT_TIMEOUT_MS}ms`), { code: 'ETIMEDOUT' });
+                onConnectError(e);
+            };
+            sock.once('error', onConnectError);
+            sock.once('timeout', onConnectTimeout);
+            sock.once('connect', () => {
+                this.tcpConnected = true;
+                sock.setTimeout(0);
+                sock.off('error', onConnectError);
+                sock.off('timeout', onConnectTimeout);
+                console.log(`SSH tunnel ${this.id} - tcp connected to ${this.sshHost}:${this.sshPort}`);
+                this.sshClient.connect({ ...this.sshConnectConfig, sock });
             });
-            this.sshClient.connect(this.sshConnectConfig);
-            // When SSH Client has connected - start listening on local tcp server
+            // When SSH Client has connected and the forward works - start
+            // listening on local tcp server
             this.sshClient.on('ready', () => {
                 console.log(`SSH tunnel ${this.id} - ssh client ready`);
-                this.localTcpServer.listen(0); // random port
+                const probe = this.probeForwardOnConnect
+                    ? this.probeForward()
+                    : Promise.resolve();
+                probe
+                    .then(() => {
+                    this.localTcpServer.listen(0); // random port
+                })
+                    .catch((e) => {
+                    this.close();
+                    if (e instanceof SshTunnelStageFailure) {
+                        fail(e.stage, e.message);
+                    }
+                    else {
+                        fail('forward', (0, common_1.getErrorMessage)(e));
+                    }
+                });
             });
             // When local tcp server is listening - resolve
             this.localTcpServer.on('listening', () => {
                 const address = this.localTcpServer.address();
                 if (address === null || typeof address === 'string') {
-                    reject(new Error('local tcp server address has no port'));
+                    fail('forward', 'local tcp server address has no port');
                     return;
                 }
                 console.log(`SSH tunnel ${this.id} - local tcp server listening on ${address.port}`);
+                settled = true;
                 resolve(address.port);
             });
         });
     }
 }
+const DEFAULT_SSH_TUNNEL_OPTIONS = {
+    staticIp: null,
+    probeForward: false,
+};
 class SshTunnel {
-    constructor(credentials) {
+    constructor(credentials, options = DEFAULT_SSH_TUNNEL_OPTIONS) {
         this.connect = async () => {
             const { type } = this.originalCredentials;
             switch (type) {
                 case common_1.WarehouseTypes.POSTGRES:
                 case common_1.WarehouseTypes.REDSHIFT:
                     if (this.originalCredentials.useSshTunnel) {
+                        const remoteHostConfig = {
+                            host: this.originalCredentials.sshTunnelHost || '',
+                            port: this.originalCredentials.sshTunnelPort || 22,
+                            username: this.originalCredentials.sshTunnelUser || '',
+                            privateKey: this.originalCredentials.sshTunnelPrivateKey || '',
+                            reconnect: false,
+                        };
                         try {
-                            const remoteHostConfig = {
-                                host: this.originalCredentials.sshTunnelHost || '',
-                                port: this.originalCredentials.sshTunnelPort || 22,
-                                username: this.originalCredentials.sshTunnelUser || '',
-                                privateKey: this.originalCredentials.sshTunnelPrivateKey ||
-                                    '',
-                                reconnect: false,
-                            };
                             this.sshConnection = new SSH2Tunnel({
                                 sshHost: remoteHostConfig.host,
                                 sshPort: remoteHostConfig.port,
@@ -209,6 +302,7 @@ class SshTunnel {
                                 sshPrivateKey: remoteHostConfig.privateKey,
                                 databaseHostOnRemote: this.originalCredentials.host,
                                 databasePortOnRemote: this.originalCredentials.port,
+                                probeForward: this.options.probeForward,
                             });
                             console.info(`Opening SSH tunnel to remote host: ${this.originalCredentials.host}:${this.originalCredentials.port}`);
                             this.localPort = await this.sshConnection.connect();
@@ -220,7 +314,26 @@ class SshTunnel {
                         }
                         catch (e) {
                             console.error(`Failed to connect to remote host: ${this.originalCredentials.host}:${this.originalCredentials.port}`);
-                            throw new common_1.SshTunnelError(`Could not open SSH tunnel: ${(0, common_1.getErrorMessage)(e)}`);
+                            const stage = e instanceof SshTunnelStageFailure
+                                ? e.stage
+                                : 'tcp';
+                            const cause = (0, common_1.getErrorMessage)(e);
+                            throw new common_1.SshTunnelError((0, sshTunnelFailure_1.describeSshTunnelFailure)({
+                                stage,
+                                sshHost: remoteHostConfig.host,
+                                sshPort: remoteHostConfig.port,
+                                sshUser: remoteHostConfig.username,
+                                databaseHost: this.originalCredentials.host,
+                                databasePort: this.originalCredentials.port,
+                                staticIp: this.options.staticIp,
+                                cause,
+                            }), {
+                                stage,
+                                sshHost: remoteHostConfig.host,
+                                sshPort: remoteHostConfig.port,
+                                sshUser: remoteHostConfig.username,
+                                cause,
+                            });
                         }
                     }
                     break;
@@ -246,6 +359,7 @@ class SshTunnel {
         this.overrideCredentials = credentials;
         this.localPort = undefined;
         this.sshConnection = undefined;
+        this.options = options;
     }
 }
 exports.SshTunnel = SshTunnel;

package/dist/ssh/sshTunnelFailure.d.ts

@@ -0,0 +1,24 @@
+import { type SshTunnelStage } from '@lightdash/common';
+export type SshClientError = Error & {
+    level?: string;
+    code?: string;
+    errors?: Error[];
+};
+export declare const sshClientErrorMessage: (error: SshClientError) => string;
+export type SshConnectionProgress = {
+    tcpConnected: boolean;
+    handshakeCompleted: boolean;
+};
+export declare const classifySshClientError: (error: SshClientError, { tcpConnected, handshakeCompleted }: SshConnectionProgress) => SshTunnelStage;
+export type SshTunnelFailureContext = {
+    stage: SshTunnelStage;
+    sshHost: string;
+    sshPort: number;
+    sshUser: string;
+    databaseHost: string;
+    databasePort: number;
+    staticIp: string | null;
+    cause: string;
+};
+export declare const describeSshTunnelFailure: ({ stage, sshHost, sshPort, sshUser, databaseHost, databasePort, staticIp, cause, }: SshTunnelFailureContext) => string;
+//# sourceMappingURL=sshTunnelFailure.d.ts.map

package/dist/ssh/sshTunnelFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sshTunnelFailure.d.ts","sourceRoot":"","sources":["../../src/ssh/sshTunnelFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE3E,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CACpB,CAAC;AAIF,eAAO,MAAM,qBAAqB,UAAW,cAAc,KAAG,MAO7D,CAAC;AAIF,MAAM,MAAM,qBAAqB,GAAG;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,EAAE,OAAO,CAAC;CAC/B,CAAC;AAKF,eAAO,MAAM,sBAAsB,UACxB,cAAc,wCACiB,qBAAqB,KAC5D,cAOF,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,wBAAwB,uFASlC,uBAAuB,KAAG,MAmB5B,CAAC"}

package/dist/ssh/sshTunnelFailure.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeSshTunnelFailure = exports.classifySshClientError = exports.sshClientErrorMessage = void 0;
+const common_1 = require("@lightdash/common");
+// Node's happy-eyeballs connect surfaces a refused port as an AggregateError
+// with an empty message, so fall back to the inner errors or the code.
+const sshClientErrorMessage = (error) => {
+    if (error.message)
+        return error.message;
+    const inner = (error.errors ?? [])
+        .map((e) => e.message)
+        .filter((m) => m.length > 0);
+    if (inner.length > 0)
+        return inner.join('; ');
+    return error.code ?? 'connection failed';
+};
+exports.sshClientErrorMessage = sshClientErrorMessage;
+const RESOLVE_CODES = new Set(['ENOTFOUND', 'EAI_AGAIN', 'EAI_FAIL']);
+// The TCP connect is ours, so anything before it is resolve or tcp. After it,
+// ssh2 tags errors with a level, and whether the handshake event fired
+// separates handshake from auth.
+const classifySshClientError = (error, { tcpConnected, handshakeCompleted }) => {
+    if (error.code && RESOLVE_CODES.has(error.code))
+        return 'resolve';
+    if (!tcpConnected)
+        return 'tcp';
+    if (handshakeCompleted)
+        return 'auth';
+    if (error.level === 'client-authentication')
+        return 'auth';
+    if (/authentication methods failed/i.test(error.message))
+        return 'auth';
+    return 'handshake';
+};
+exports.classifySshClientError = classifySshClientError;
+const describeSshTunnelFailure = ({ stage, sshHost, sshPort, sshUser, databaseHost, databasePort, staticIp, cause, }) => {
+    const from = staticIp ? ` from Lightdash (${staticIp})` : '';
+    const allow = staticIp
+        ? `Allow inbound SSH from ${staticIp} in the bastion's security group or firewall.`
+        : "Allow inbound SSH from Lightdash's IP in the bastion's security group or firewall.";
+    switch (stage) {
+        case 'resolve':
+            return `The SSH host "${sshHost}" does not resolve to an address. Check the SSH Remote Host for typos and make sure it is a public hostname or IP. (${cause})`;
+        case 'tcp':
+            return `Could not reach ${sshHost} on port ${sshPort}${from}. ${allow} (${cause})`;
+        case 'handshake':
+            return `Reached ${sshHost}:${sshPort} but nothing answered as an SSH server. Check that sshd is listening on that port and that a firewall is not dropping the session after connect. (${cause})`;
+        case 'auth':
+            return `The bastion ${sshHost} rejected the key for user "${sshUser}". Add the public key shown above to ~/.ssh/authorized_keys for that user on the bastion, and check the user exists and the file is mode 600. (${cause})`;
+        case 'forward':
+            return `Connected to the bastion, but it could not open a connection to ${databaseHost}:${databasePort}. Either AllowTcpForwarding is off in the bastion's sshd_config, or the bastion cannot reach the database endpoint. Check the database's security group allows the bastion on port ${databasePort}. (${cause})`;
+        default:
+            return (0, common_1.assertUnreachable)(stage, 'Unknown SSH tunnel stage');
+    }
+};
+exports.describeSshTunnelFailure = describeSshTunnelFailure;

package/dist/ssh/sshTunnelFailure.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sshTunnelFailure.test.d.ts.map

package/dist/ssh/sshTunnelFailure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sshTunnelFailure.test.d.ts","sourceRoot":"","sources":["../../src/ssh/sshTunnelFailure.test.ts"],"names":[],"mappings":""}

package/dist/ssh/sshTunnelFailure.test.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const sshTunnelFailure_1 = require("./sshTunnelFailure");
+const err = (message, extra = {}) => Object.assign(new Error(message), extra);
+const before = { tcpConnected: false, handshakeCompleted: false };
+const afterTcp = { tcpConnected: true, handshakeCompleted: false };
+const afterHandshake = { tcpConnected: true, handshakeCompleted: true };
+(0, vitest_1.describe)('classifySshClientError', () => {
+    (0, vitest_1.it)('maps DNS failures to resolve', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('getaddrinfo ENOTFOUND bastion.example', {
+            code: 'ENOTFOUND',
+        }), before)).toBe('resolve');
+    });
+    (0, vitest_1.it)('maps anything before the TCP connect to tcp, including a dropped SYN', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('connect ETIMEDOUT 34.195.79.184:22 after 10000ms', {
+            code: 'ETIMEDOUT',
+        }), before)).toBe('tcp');
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('connect ECONNREFUSED 127.0.0.1:2222', {
+            code: 'ECONNREFUSED',
+        }), before)).toBe('tcp');
+    });
+    (0, vitest_1.it)('maps a ready timeout after the TCP connect to handshake', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('Timed out while waiting for handshake', {
+            level: 'client-timeout',
+        }), afterTcp)).toBe('handshake');
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('Connection lost before handshake', {
+            level: 'client-socket',
+        }), afterTcp)).toBe('handshake');
+    });
+    (0, vitest_1.it)('maps rejected keys to auth', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('All configured authentication methods failed', {
+            level: 'client-authentication',
+        }), afterHandshake)).toBe('auth');
+    });
+    (0, vitest_1.it)('treats a socket reset after the handshake as auth, not tcp', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.classifySshClientError)(err('read ECONNRESET', {
+            code: 'ECONNRESET',
+            level: 'client-socket',
+        }), afterHandshake)).toBe('auth');
+    });
+});
+(0, vitest_1.describe)('describeSshTunnelFailure', () => {
+    const base = {
+        sshHost: '34.195.79.184',
+        sshPort: 22,
+        sshUser: 'lightdash',
+        databaseHost: 'redshift.internal',
+        databasePort: 5439,
+        staticIp: '35.1.2.3',
+        cause: 'connect ETIMEDOUT',
+    };
+    (0, vitest_1.it)('tells the bastion admin which IP to allow on tcp failures', () => {
+        const message = (0, sshTunnelFailure_1.describeSshTunnelFailure)({ ...base, stage: 'tcp' });
+        (0, vitest_1.expect)(message).toContain('Could not reach 34.195.79.184 on port 22');
+        (0, vitest_1.expect)(message).toContain('from Lightdash (35.1.2.3)');
+        (0, vitest_1.expect)(message).toContain('Allow inbound SSH from 35.1.2.3');
+    });
+    (0, vitest_1.it)('omits the IP when the instance has none', () => {
+        const message = (0, sshTunnelFailure_1.describeSshTunnelFailure)({
+            ...base,
+            staticIp: null,
+            stage: 'tcp',
+        });
+        (0, vitest_1.expect)(message).not.toContain('35.1.2.3');
+        (0, vitest_1.expect)(message).toContain("Lightdash's IP");
+    });
+    (0, vitest_1.it)('names the user on auth failures', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.describeSshTunnelFailure)({ ...base, stage: 'auth' })).toContain('rejected the key for user "lightdash"');
+    });
+    (0, vitest_1.it)('names the database endpoint on forward failures', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.describeSshTunnelFailure)({ ...base, stage: 'forward' })).toContain('redshift.internal:5439');
+    });
+});
+(0, vitest_1.describe)('sshClientErrorMessage', () => {
+    (0, vitest_1.it)('unpacks the empty-message AggregateError Node emits for a refused port', () => {
+        const aggregate = err('', {
+            code: 'ECONNREFUSED',
+            errors: [
+                new Error('connect ECONNREFUSED ::1:2299'),
+                new Error('connect ECONNREFUSED 127.0.0.1:2299'),
+            ],
+        });
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.sshClientErrorMessage)(aggregate)).toBe('connect ECONNREFUSED ::1:2299; connect ECONNREFUSED 127.0.0.1:2299');
+    });
+    (0, vitest_1.it)('falls back to the code, then a fixed string', () => {
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.sshClientErrorMessage)(err('', { code: 'ETIMEDOUT' }))).toBe('ETIMEDOUT');
+        (0, vitest_1.expect)((0, sshTunnelFailure_1.sshClientErrorMessage)(err(''))).toBe('connection failed');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/warehouses",
-  "version": "2.164.0",
+  "version": "2.165.0",
   "description": "Warehouse connectors for Lightdash",
   "license": "MIT",
   "repository": {
@@ -28,7 +28,7 @@
     "snowflake-sdk": "2.3.4",
     "ssh2": "1.14.0",
     "trino-client": "0.2.9",
-    "@lightdash/common": "2.164.0"
+    "@lightdash/common": "2.165.0"
   },
   "devDependencies": {
     "oxlint": "1.75.0",