fix: enforce production transport policy

Every PostgreSQL connection this repository opened was plaintext, in every
environment: no connection site set `ssl` at all, so credentials, session
tokens, and row data crossed the network in the clear and nothing in
configuration, startup, or `pnpm doctor` said so. The public identity URL
boundary was also looser than it appeared.

`core/src/database/transport.ts` is now the one typed policy. It has exactly two
modes: `verify-full` (TLS required, certificate chain verified, and server
identity verified against the configured host — the production default) and
`disable` (the development/test default, refused outright in production). There
is deliberately no encryption-only `require` mode, no chain-only `verify-ca`,
and no `rejectUnauthorized: false` escape hatch anywhere in the configuration
surface; every loose or aliased spelling is rejected in both environments, so a
typo never quietly becomes a weaker mode. Production has no plaintext exception
at all, not even for a loopback database — a connection string cannot prove the
database is process-local.

Verification is certificate *and* hostname. The policy supplies an explicit
`checkServerIdentity` pinned to the host parsed from DATABASE_URL, because the
pinned driver sets TLS `servername` only for non-IP hosts and Node performs no
identity check when it is unset — so `rejectUnauthorized: true` alone accepts a
certificate from any host the trusted CA ever signed when connecting by IP.
Both halves are proven against a real TLS-enabled PostgreSQL, including that the
same connection without the pinned callback succeeds. Every CA, certificate, and
key is generated at test runtime and deleted afterwards.

A DATABASE_URL may no longer carry its own TLS parameters. The pinned driver
merges parsed connection-string values over explicitly passed options, so a
`?sslmode=disable` in the URL would silently replace the policy's verified `ssl`
object; that now fails with a stable code, reported by both `pnpm doctor` and
the migration CLIs rather than as "failed unexpectedly".

One shared environment reader keeps `process.env` out of Core's reusable
constructors, and every executable that opens a connection resolves the policy
identically: the API (validated before any pool, Better Auth instance, module
runtime, or listener exists), both migration commands, the bootstrap CLI, and
Doctor's own connection. Doctor reports it as a blocking failure, never a
warning, naming only the effective mode.

Separately, the identity base URL and every trusted origin must now be exactly
one canonical origin — the WHATWG origin serialization must equal the supplied
string — so a path, trailing slash, credentials, explicit default port, or
non-canonical case is rejected rather than normalized into something that no
longer matches what a browser sends. Production's loopback rejection now
classifies the address instead of comparing against three literals, covering
`.localhost`, all of 127.0.0.0/8, 0.0.0.0, `::`, expanded and IPv4-mapped
forms. This is a configuration-shape guarantee only: it does not resolve DNS or
prove reachability, and TLS protects the connection, not the exposure.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/tests/doctor.test.ts

@@ -206,6 +206,7 @@ describe("Ekklesia Doctor diagnostics", () => {
       "modules.permissions",
       "schemas.discovery",
       "migrations.discovery",
+      "database.transport",
       "postgresql.connection",
       "postgresql.plan",
       "identity.configuration",
@@ -255,9 +256,15 @@ describe("Ekklesia Doctor diagnostics", () => {
       dependencies({ createMigrationDatabase, planMigrations }),
     );
 
+    // Doctor's own read-only connection carries the same validated transport policy every other
+    // executable uses — it defaults to certificate-verified TLS, exactly like production.
     expect(createMigrationDatabase).toHaveBeenCalledWith(
       "postgresql://not-rendered.invalid/ekklesia",
-      { connectionTimeoutMs: 10_000, operationTimeoutMs: 10_000 },
+      {
+        connectionTimeoutMs: 10_000,
+        operationTimeoutMs: 10_000,
+        transport: { mode: "verify-full" },
+      },
     );
     expect(planMigrations).toHaveBeenCalledOnce();
     expect(check(report, "postgresql.connection")).toMatchObject({
@@ -702,6 +709,57 @@ describe("Ekklesia Doctor diagnostics", () => {
     expect(report.result).toBe("not-ready");
   });
 
+  it("passes database transport by default, reporting verified TLS without revealing any connection detail", async () => {
+    const report = await diagnoseEkklesia(
+      { ...options("postgresql://admin:[email protected]:5432/ekklesia") },
+      dependencies(),
+    );
+
+    const transport = check(report, "database.transport");
+    expect(transport.status).toBe("pass");
+    expect(transport.summary).toBe("Database TLS verified");
+    const rendered = JSON.stringify(transport);
+    expect(rendered).not.toContain("hunter2");
+    expect(rendered).not.toContain("db.internal.example");
+    expect(rendered).not.toContain("postgresql://");
+  });
+
+  it("blocks readiness when a production deployment would reach PostgreSQL without verified TLS", async () => {
+    for (const [label, extra] of [
+      ["explicit production plaintext", { databaseTransport: { mode: "disable" } }],
+      [
+        "connection-string downgrade",
+        { databaseUrl: "postgresql://db.example.test/ekklesia?sslmode=disable" },
+      ],
+      ["malformed mode", { databaseTransport: { mode: "require" } }],
+    ] as const) {
+      const report = await diagnoseEkklesia(
+        { ...options("postgresql://db.example.test/ekklesia"), ...extra },
+        dependencies(),
+      );
+
+      const transport = check(report, "database.transport");
+      expect(transport.status, `expected ${label} to block readiness`).toBe("failure");
+      expect(transport.summary).toBe("Database transport unsafe");
+      expect(report.result).toBe("not-ready");
+      expect(doctorExitCode(report)).toBe(1);
+    }
+  });
+
+  it("passes development plaintext only when development is explicitly selected", async () => {
+    const report = await diagnoseEkklesia(
+      {
+        ...options("postgresql://127.0.0.1:5432/ekklesia"),
+        databaseEnvironment: "development",
+      },
+      dependencies(),
+    );
+
+    const transport = check(report, "database.transport");
+    expect(transport.status).toBe("pass");
+    expect(transport.summary).toContain("disabled");
+  });
+
   it("passes client-address configuration with direct mode when nothing is configured", async () => {
     const report = await diagnoseEkklesia(options(), dependencies());