Jared Gorbahn
Menu

Personal build / Live demo / Acceptance in progress

ERD Explorer

A session-only database explorer with Microsoft Entra as the default, complete SQL preview and explicit, single-use extraction approval.

Review and extension of an existing ERD application · Updated 2026-10-06

Problem
Understanding a warehouse database means finding its structures and distinguishing declared relationships from assumptions.
My contribution
Add session connections and exact-query approval while preserving the graph, coloring and earlier catalog-discovery work.
Current scope
A personal, Entra-protected Azure demo using invented data and one approved SQL Server destination. Persistent saved-model operations are unavailable in the current session-only mode.
Evidence & limits
Release 0ef82f9 is deployed with a verified runtime inventory and healthy, protected endpoints. Earlier registered-mode SQL results remain historical; real database acceptance for the new session flow is open.

Historical registered-mode checks / Invented database contents

Earlier SQL checks. Recorded evidence.

The SQL, access and automated checks below are historical results from registered-mode releases, recorded on 2026-10-03 (Mountain time), at runtime revision 5ab5907. They preserve the earlier achievements and limits; they do not verify the new session extraction flow.

Live-generation website integration was verified at revision cb41d54: a live model with 4 entities and 2 relationships opened inside the website using an existing signed-in session.

Use Explorer on this website →

203Local automated checks passed
25 core · 143 unit · 35 HTTP
3Live SQL integration tests passed
0 skipped · 4 identities matched
12 deniedAnonymous / spoofed-header requests
All returned HTTP 401

Browser

Approved account

Sign in through Microsoft Entra. Select a registered source and inspect the resulting model.

Application

Explicit access

Use server-side managed identities, bounded discovery and coverage warnings. Persist saved model versions separately.

Private endpoint

Azure SQL

Read catalog metadata. Public database access is disabled; row sampling is disabled for the demo.

Historical registered-mode path for this personal demo. It omits operational identifiers and network configuration. The current session release keeps the approved-account and private-endpoint boundaries, but does not offer these persistent saved-model operations.

Earlier release / One paused-source request

57.992 seconds

Recorded at revision 1f1ffb4 on 2026-10-02. The first request succeeded without a user retry; management readback confirmed the source was paused. This duration was not remeasured for the current release.

  1. Attempt 1 · SQL 40613Wait 5 seconds
  2. Attempt 2 · SQL 40613Wait 10 seconds
  3. Attempt 3 · ConnectedExtract metadata once

One cold SQL result is not a reliability guarantee. During the earlier deployment, a manual restart overlapped automatic package activation and the first warmup failed. Later demand-start succeeded. Later registered-mode releases activated without an explicit restart. A separate healthy-package rollback cycle was rehearsed; it does not establish database backup/restore, outage recovery or a maximum recovery time.

Warehouse relationship inference / Development fixtures

20 of 23 selected missing links recovered

Complete-key naming rules were evaluated against 3 authored warehouse scenarios: normalized SQL Server, legacy WMS and PostgreSQL-shaped metadata. Suggestions preserve composite key scope and remain subject to review.

The original selected labels left 43 of 63 proposals unjudged. A separate post-hoc review at source revision 3dc784f supports 41 of those through documented relationship paths; 2 stock-balance joins still need their business meaning clarified. Precision is unknown.

23 of the additional mappings repeat paths already present in declared foreign keys. Support does not make every suggestion useful. These fixtures informed development; this is neither a held-out benchmark nor an AI-model evaluation. PostgreSQL 18.6 has local catalog and saved-model workflow evidence; hosted PostgreSQL remains unverified.

Separate transfer challenge / Labels fixed before inference

15 of 15 selected links recovered, with 1 known wrong join

A separate author created 12 synthetic warehouse tables without seeing the inference rules or results. Business labels were reviewed and frozen at revision 461c9b8 before the first run on 2026-10-03. This is a metadata-only scenario, with no database execution or AI evaluation.

The unchanged rules suggested that a warehouse landlord code identified a stock owner. The fixed business rules say those are unrelated domains: matching names and complete keys do not prove shared meaning. Of 33 graph suggestions, 17 remain unjudged. Precision is unknown. Both ambiguous return-inventory meanings stayed outside graph additions.

This small selected challenge is separate from the three development fixtures above. Its perfect selected-link recall does not establish general accuracy. The first result and labels are preserved; stronger semantic evidence and further unseen cases are needed before broader claims.

Historical coverage and remaining checks

Observed in registered mode

The earlier metadata rehearsal at revision 5fb36ac returned 4 entities, 2 declared relationships and 8 complete metadata facets, with 0 warnings. Source and store were initially paused. A newly saved baseline reopened in Explorer; the earlier five-entity, four-relationship model also remained readable. A restricted source produced partial-coverage warnings.

The live integration tests cover identity/source isolation and cancellation, an independent catalog oracle, and transactional version/concurrency/rollback behavior. Browser inspection is a separate controlled rehearsal.

Embedded cancellation verified. On 2026-10-03, canceling an extraction from source A preserved the loaded source-B baseline with 4 entities and 2 relationships. Before-and-after JSON exports were byte-identical, and a subsequent live metadata preview succeeded. This existing-session browser check did not trace backend query termination or exercise unsaved annotations, simultaneous requests or session expiry.

Live catalog change and baseline preservation verified. At revision 5ab5907 on 2026-10-03, adding an empty test table and composite foreign key changed extraction from 4 entities/2 relationships to 5/3. The earlier saved baseline remained unchanged, and downloading it again produced a byte-identical JSON file. The operator restored the original source catalog and verified both original saved models were intact.

Standalone import and version recovery verified. The changed export was imported and saved as v2; importing the original export restored its contents as v3. All 3 versions remained available during that rehearsal, with v1 still the baseline. Stored model hashes match the exports, fresh diagram loads show the expected changed/restored contents, and the restored download is byte-identical to the original. A first save failed; the store was checked before one successful retry, and the cause remains unknown. File-picker tooling was slow, so import latency and unattended reliability were not established. Embedded file selection and database backup recovery remain unverified.

Sequential source switching verified. At revision 5ab5907 on 2026-10-03, a separate live rehearsal kept an empty test table in source B while the same browser generated A → B → A → B. Source A stayed at four entities/two relationships; B returned five/three both times. Comparing the complete exported models, excluding only extraction ID and capture time, confirmed A was unchanged and B retained its distinct object. The operator restored B, a fresh export matched its earlier metadata, and saved versions remained unchanged. This existing-session check did not exercise overlapping requests or local annotation isolation.

Healthy-package rollback verified. On 2026-10-03, the application moved from 5ab5907 to retained release aba7c91 and back. Each activation changed the serving process and matched the retained package files. Private SQL reads preserved all 5 saved versions, and a fresh page load reopened the saved diagram on each release. The release then under test and its protected configuration were preserved. This was one cycle between healthy, compatible packages; failed-deployment, schema-migration and database backup recovery were not exercised.

A historical saved-model request failed with a database sign-in error whose exact cause remains unknown. Follow-up testing reproduced a gap in connection acquisition after pool initialization; the registered-mode acquisition fix repaired that path without replaying queries or writes.

At revision aba7c91, a read-only probe recovered from two SQL-unavailable responses while the store resumed, then read both saved models. After 35 seconds, the initialized pool had no physical connections; the next read opened a new connection and returned the same 2 saved models unchanged. The database was warm during that second read. A saved baseline also reopened inside this website using the existing sign-in.

Full serverless pause now verified. A later read-only probe kept that same initialized store alive for more than 61 minutes, confirmed Azure reported the database paused, then read both saved versions unchanged. Two transient connection failures preceded success in 46.360 seconds. This pause/resume probe was one measured cycle, completed October 3 UTC; it did not exercise writes, restore or deployment rollback.

Unverified in that historical record

  • Failed-deployment and schema-migration recovery
  • Session expiry and real role/tenant subjects
  • Embedded file selection and model-store backup recovery
  • Representative-user UAT
  • Evaluated AI inference, hosted PostgreSQL and authorized-source onboarding

The inference result above comes from local authored metadata, not the live four-entity scope. No production-scale result, full security audit or representative-user acceptance is claimed.

Context

I am extending an existing ERD explorer into a browser-accessible tool for people investigating unfamiliar databases. The aim is to preserve its useful visualization while making source access, metadata coverage and relationship evidence understandable. Warehouse systems make a demanding test case: identifiers are often scoped by tenant, site or owner, and useful relationships may never have been declared as foreign keys.

This case study covers a personal Azure environment with invented database contents. The current hosted destination is SQL Server/Azure SQL. Earlier registered-mode results retain their own revisions; additional hosted-engine acceptance and evaluated AI assistance remain delivery goals.

Architecture

The current Node.js deployment uses session-only connections. Connection setup defaults to Microsoft Entra; an explicit database-password option is available only where the host policy permits it. This personal demo permits one approved synthetic SQL Server destination on its private Azure network.

Before metadata extraction, the application prepares the complete SQL for the selected scope. The user reviews and explicitly approves that exact plan; approval is single-use and invalidated by source, account or scope changes. Extraction does not assume a named schema, and the existing graph coloring is preserved.

Connection details, credentials and tokens, approvals and working models are held in memory for the session. Persistent model-store operations are unavailable in this deployment. Earlier saved versions were retained; this release did not migrate or delete them.

Earlier registered-mode releases used server-side source registrations and managed identities, with persistent model versions stored separately. The historical SQL and saved-model evidence below belongs to those releases.

A dedicated workspace on this website displays the protected application in a frame after the visitor chooses to load it. Microsoft sign-in opens separately, and a full-window option remains available when browser session policies prevent embedding. The static portfolio has no database access and does not proxy authentication.

Engineering Decisions

Keep catalog facts and proposed relationships distinct. A declared constraint carries different evidence from a naming guess, and a partially visible catalog must not appear complete. Discovery uses metadata permissions with row sampling disabled in this demo.

A database can be reachable yet paused. Connection establishment and later pool acquisition have bounded retry budgets. The application disables the driver's nested retry loop and retries only before handing a connection to caller work; queries, writes and transaction operations are never automatically replayed.

Earlier Control Center work used a structured grid, yellow connection panel, charcoal version area and restrained red accents to distinguish discovery, versioning and review. Keyboard focus, file selection and narrow layouts were checked in that registered-mode workflow. The session release preserves diagram colors while making connection setup and exact SQL approval explicit.

How It Breaks

The first retry implementation passed tests whose simulated login errors retained a SQL error number. The actual driver discarded that number when wrapping the error. Review also found that native retries could multiply the application's attempts and exceed the intended deadline.

Application activation is a separate failure mode. In an earlier rollout, selecting a package started activation before an explicit restart was issued. The restart overlapped the first warmup, which failed; a later demand-start succeeded. The logs prove the overlap but do not establish it as the cause. Subsequent registered-mode releases activated successfully without an explicit restart, and a healthy-package rollback cycle was later rehearsed. Database backup/restore, schema-migration recovery and broader outage recovery remain unproven.

During the website embedding check, one saved-model request reported a database sign-in error. Its log lacked the underlying SQL number, so that historical cause remains unknown. Follow-up driver tests reproduced a separate gap: the successful initial probe did not protect later physical connection acquisition. A later transient SQL error could therefore fail a request as an authentication error.

Testing & UAT

Current release 0ef82f9 was deployed on October 6, 2026 (UTC). Its CI package passed source/browser, container and Windows package checks. Live readback matched all 8,337 mounted files, confirmed a changed serving process and the approved session configuration, and verified health and unauthenticated access denials. These deployment checks did not execute SQL or complete a real database sign-in.

The new session flow still needs real Microsoft Entra database consent, database-rights and extraction checks, a previously unseen SQL Server source, hosted PostgreSQL and database access across resource tenants. MySQL remains planned. Authenticated representative-user UAT, fresh sign-in, session expiry and browser restrictions on embedded sessions remain open.

Historical registered-mode release 5ab5907 passed 203 local Node checks: 25 core, 143 unit and 35 HTTP, with zero skips. All three CI jobs passed on the first attempt. Three integration tests were rerun against actual Azure SQL with zero skips, covering identity/source isolation and cancellation, an independent catalog oracle, and transactional version/concurrency/rollback behavior. All four expected database identities matched.

At earlier release 5fb36ac, authenticated browser inspection generated a four-entity model with two declared relationships from an initially paused source, saved a baseline to an initially paused store and reopened it. The Control Center passed 21 existing browser UAT checks and responsive inspection from 320 to 1440 CSS pixels. These earlier observations retain their own revision.

Embedding release cb41d54 passed all three CI jobs and 23 Control Center browser checks in both framed and standalone harnesses. A fresh live four-entity/two-relationship model opened inside the published website. On earlier release aba7c91, both saved models listed successfully and the source-B baseline reopened in the same frame. These browser checks used an existing signed-in session.

Three authored warehouse scenarios exercise normalized SQL Server, a legacy WMS and PostgreSQL metadata. The two SQL Server seeds ran against a local Developer instance and matched an independent catalog check. Earlier registered-mode PostgreSQL 18.6 discovery passed 18 actual local integration checks over verified TLS, including native catalogs and HTTP preview/generate/save/reopen. Actual browser checks also confirmed Keep and Escape preserve an unsaved model, Continue loads the saved baseline, and Explorer renders its 12 entities and 25 relationships. The PostgreSQL adapter remains included in the package, but no hosted PostgreSQL destination is approved or verified for the current demo. Representative-user UAT, real role/tenant subjects, fresh sign-in and the complete demo walkthrough remain open.

AI: Now / Future

The inference goal is useful assistance that explains its evidence and can abstain. A confident-looking diagram is not enough if a suggested link joins records across warehouse or tenant boundaries.

Now

Relationship suggestions use deterministic complete-key naming rules, including composite key scope. The development result remains 20 of 23 selected missing links recovered. A separate post-hoc review supports 41 additional mappings through documented paths and leaves two stock-balance joins unresolved. Twenty-three additions duplicate declared paths, so support alone does not establish usefulness. Overall precision is unknown. No model-backed inference has been implemented or evaluated.

Future · Proposed

Reduce redundant suggestions and address the wrong join exposed by the frozen transfer challenge. Future revisions need stronger semantic evidence, further unseen evaluation and the same abstention requirements. Any provider integration needs an explicit metadata boundary. The current session connection flow is deployed; hosted PostgreSQL, new-source and cross-resource-tenant acceptance remain unverified. MySQL remains planned.

Observability & Measurements

At the earlier runtime revision 1f1ffb4, the first request after management readback confirmed a paused source finished in 57,992 milliseconds. Two connection attempts returned SQL 40613 before a third connected; extraction then ran once. This is one historical request, not a latency distribution or a new measurement for the current release.

The earlier metadata rehearsal at revision 5fb36ac returned four entities, two declared relationships and eight complete facets with no warnings. At the earlier registered-mode release 5ab5907, restricted-source discovery again returned one visible table and six warnings, and twelve anonymous or spoofed-header requests received HTTP 401. These establish specific behavior in this personal environment, not comprehensive security or production-scale acceptance.

What Changed After Testing

Earlier registered-mode recovery work captured numeric login errors per physical connection and covered pool acquisition after initialization. Tests retain the installed driver and pool while replacing external transport. Review caught a cancellation race that leaked an acquired connection, pool timers that masked native timeouts, and failed transaction-begin cleanup; regression tests passed after correction. Runtime source hashes and protected configuration were verified after deployment.

In the historical registered-mode work, the first read-only probe verified unchanged saved models after 35-second physical pool expiry while the database was warm. A later probe kept the same initialized store alive for over 61 minutes and confirmed Azure reported it paused. Its next request recovered through two SQL 40613 failures, then read both saved versions unchanged in 46.360 seconds. This closes that specific pause/resume check. A later healthy-package rollback moved from 5ab5907 to retained aba7c91 and back, preserving all five saved versions and reopening the diagram on each release. Database backup recovery, failed-deployment recovery and session acceptance remain separate.

During the earlier registered-mode embedding work, the first embedded handoff opened a new window with an empty model. Keeping model navigation inside the frame preserved its browser storage context and fixed the observed failure. Opening a different saved version then also respected the existing unsaved-change confirmation; standalone behavior remained unchanged.

Warehouse fixture evaluation exposed the limits of single-column naming guesses. Inference requires complete primary or unique keys, coherent relationship roles and compatible known types. It recovers 20 of 23 selected missing links. A separate post-hoc review now accounts for the 43 additional proposals: 41 follow documented relationship paths and two stock-balance joins have unresolved business meaning. Twenty-three of the supported additions repeat declared FK paths, exposing diagram clutter as well as the limits of an accuracy count. Overall precision remains unknown.

In the earlier registered-mode workflow, switching away from an unsaved model stalled at a native browser confirmation before any saved-model request reached the server. An in-page Keep/Continue dialog handled cancellation, duplicate prompts and stale decisions. The corrected flow passed 68 relevant browser harness checks and a separate interactive PostgreSQL walkthrough. A missing delegated sign-in bundle path was also corrected; serving that bundle is not evidence of a completed delegated sign-in.

What I’d Change at 10× Scale

First measure extraction duration, catalog size, memory, cancellation and model-version growth under representative workloads. Those results should determine whether discovery needs background jobs or further limits. Keep per-source identity and coverage visible as more engines are introduced.

A separate transfer scenario was authored and reviewed before inference, then frozen in Git. The unchanged rules recovered all 15 selected links but emitted one known wrong landlord-to-stock-owner join and 17 unjudged suggestions. That metadata-only challenge exposes the need for semantic evidence beyond names and keys. Preserve its baseline, measure false suggestions and explained abstention, and use further unseen cases before broader claims. Additional engines need actual connector and catalog tests.

← All projects