Update PostgreSQL demo secret connection

samples/demo/README.md

@@ -14,3 +14,10 @@ docker build \
   --tag radius-demo:local \
   samples/demo
 ```
+
+## PostgreSQL variant
+
+`app-postgresql.bicep` uses the Kubernetes Container Recipe's direct Secret connection support to project the database password as `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. This requires a Radius edge installation containing the Kubernetes Recipe contract from
+[`radius-project/resource-types-contrib#300`](https://github.com/radius-project/resource-types-contrib/pull/300).
+
+The demo image prefers that variable and retains `CONNECTION_POSTGRESQL_PASSWORD` as a compatibility fallback for older or mixed installations whose PostgreSQL Recipe still supplies the password. If both variables are present, they must match. Azure ACI does not project direct Secret connections, so this new password path is Kubernetes-only; its existing connection behavior is unchanged.

samples/demo/app-postgresql.bicep

@@ -37,6 +37,9 @@ resource demoContainer 'Radius.Compute/containers@2025-08-01-preview' = {
       postgresql: {
         source: postgresql.id
       }
+      postgresqlcredentials: {
+        source: postgresqlClientCredentials.id
+      }
     }
   }
 }
@@ -52,3 +55,16 @@ resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = {
     password: password
   }
 }
+
+resource postgresqlClientCredentials 'Radius.Security/secrets@2025-08-01-preview' = {
+  name: 'postgresql-client-credentials-${environmentName}'
+  properties: {
+    environment: environment
+    application: demoApp.id
+    data: {
+      password: {
+        value: password
+      }
+    }
+  }
+}

samples/demo/src/db/repository.ts

@@ -66,11 +66,19 @@ export function createFactory(): RepositoryFactory {
 
     if (process.env.CONNECTION_POSTGRESQL_HOST) {
         console.log("Using PostgreSQL: found hostname in environment variable CONNECTION_POSTGRESQL_HOST");
+        const secretConnectionPassword = process.env.CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD;
+        const legacyConnectionPassword = process.env.CONNECTION_POSTGRESQL_PASSWORD;
+        if (secretConnectionPassword !== undefined &&
+            legacyConnectionPassword !== undefined &&
+            secretConnectionPassword !== legacyConnectionPassword) {
+            throw new Error("Conflicting PostgreSQL passwords found in CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD and CONNECTION_POSTGRESQL_PASSWORD");
+        }
+
         const connection = {
             host: process.env.CONNECTION_POSTGRESQL_HOST!,
             port: process.env.CONNECTION_POSTGRESQL_PORT!,
             username: process.env.CONNECTION_POSTGRESQL_USERNAME || '',
-            password: process.env.CONNECTION_POSTGRESQL_PASSWORD || '',
+            password: secretConnectionPassword ?? legacyConnectionPassword ?? '',
             database: process.env.CONNECTION_POSTGRESQL_DATABASE || '',
         }
         const url = `postgresql://${connection.username}:${connection.password}@${connection.host}:${connection.port}/${connection.database}`