40 lines
1.5 KiB
TypeScript
40 lines
1.5 KiB
TypeScript
/**
|
|
* P014: lib/db.ts's `getSql()` used to hardcode `ssl: "require"`
|
|
* unconditionally. That is correct for every REAL deployment target this
|
|
* app has (Vercel Postgres, managed Postgres) but made ANY plain,
|
|
* non-TLS Postgres -- compose.dev.yaml's own local-dev container, or a
|
|
* throwaway restore-drill target -- silently unreachable through this
|
|
* function, contradicting compose.dev.yaml's own doc comment and its
|
|
* "UNVERIFIED... not smoke-tested" caveat. Found and fixed while executing
|
|
* P014's real restore drill (see docs/runbook/backup-restore.md).
|
|
*/
|
|
import { describe, it, expect, beforeEach, afterEach } from "vitest";
|
|
import { sslMode } from "@/lib/db";
|
|
|
|
describe("sslMode", () => {
|
|
const saved = process.env.DATABASE_SSL;
|
|
afterEach(() => {
|
|
if (saved === undefined) delete process.env.DATABASE_SSL;
|
|
else process.env.DATABASE_SSL = saved;
|
|
});
|
|
beforeEach(() => {
|
|
delete process.env.DATABASE_SSL;
|
|
});
|
|
|
|
it("defaults to \"require\" when DATABASE_SSL is unset -- unchanged behavior for every real deployment", () => {
|
|
expect(sslMode()).toBe("require");
|
|
});
|
|
|
|
for (const value of ["false", "FALSE", "disable", "off", "0", " false "]) {
|
|
it(`treats DATABASE_SSL=${JSON.stringify(value)} as an explicit opt-out (false)`, () => {
|
|
process.env.DATABASE_SSL = value;
|
|
expect(sslMode()).toBe(false);
|
|
});
|
|
}
|
|
|
|
it("an unrecognized value falls back to the safe default (\"require\"), not an accidental opt-out", () => {
|
|
process.env.DATABASE_SSL = "yes-please";
|
|
expect(sslMode()).toBe("require");
|
|
});
|
|
});
|