fix(supabase): explain ip allow list rejections during source setup

products/warehouse_sources/backend/temporal/data_imports/sources/postgres/source.py

@@ -240,6 +240,14 @@
         "Your database user isn't allowed to sign in. Grant it the LOGIN privilege or use a "
         "different user, then try again."
     ),
+    # Supavisor rejects a client IP outside the project's network restrictions with
+    # "FATAL: (EADDRNOTALLOWED) address not in tenant allow_list: ...". `get_non_retryable_errors`
+    # already handles this on the streaming path; map it here too so validation returns an
+    # actionable message instead of the generic fallback.
+    "address not in tenant allow_list": (
+        "Your database provider rejected the connection because PostHog's IP address isn't on its IP "
+        "allow list. Add PostHog's IP addresses to that allow list, then try again."
+    ),
     "could not translate host name": _DNS_RESOLUTION_VALIDATION_ERROR,
     # libpq prefixes a DNS-resolution failure with "could not translate host name ..." (matched
     # above), but the same getaddrinfo failure also surfaces as the raw socket wording with no such
@@ -1427,7 +1435,7 @@
                 extra={"source_id": str(source.id), "slot_name": cdc_config.slot_name},
             )
 
     def get_schemas(
         self,
         config: PostgresSourceConfig,
         team_id: int,
@@ -1656,7 +1664,7 @@
 
         return schemas
 
     def validate_credentials(
         self,
         config: PostgresSourceConfig,
         team_id: int,

products/warehouse_sources/backend/temporal/data_imports/sources/postgres/test_postgres.py

@@ -5069,6 +5069,13 @@ def config(self, source):
                 'repeated authentication failures ("too many authentication failures"). This usually '
                 "means the username or password is wrong. Check your credentials and try again.",
             ),
+            # Supavisor rejects a client IP outside the project's network restrictions.
+            (
+                'connection failed: connection to server at "203.0.113.10", port 5432 failed: '
+                "FATAL:  (EADDRNOTALLOWED) address not in tenant allow_list: {192, 0, 2, 1}",
+                "Your database provider rejected the connection because PostHog's IP address isn't on its IP "
+                "allow list. Add PostHog's IP addresses to that allow list, then try again.",
+            ),
             # A proxy/pooler in front of some providers rejects bad credentials during its own
             # database-identification step, wrapping the rejection in its own sentence instead of
             # libpq's "password authentication failed for user".