ekklesiaandClaude Opus 5
6b6b77c105
Every PostgreSQL connection this repository opened was plaintext, in every environment: no connection site set `ssl` at all, so credentials, session tokens, and row data crossed the network in the clear and nothing in configuration, startup, or `pnpm doctor` said so. The public identity URL boundary was also looser than it appeared. `core/src/database/transport.ts` is now the one typed policy. It has exactly two modes: `verify-full` (TLS required, certificate chain verified, and server identity verified against the configured host — the production default) and `disable` (the development/test default, refused outright in production). There is deliberately no encryption-only `require` mode, no chain-only `verify-ca`, and no `rejectUnauthorized: false` escape hatch anywhere in the configuration surface; every loose or aliased spelling is rejected in both environments, so a typo never quietly becomes a weaker mode. Production has no plaintext exception at all, not even for a loopback database — a connection string cannot prove the database is process-local. Verification is certificate *and* hostname. The policy supplies an explicit `checkServerIdentity` pinned to the host parsed from DATABASE_URL, because the pinned driver sets TLS `servername` only for non-IP hosts and Node performs no identity check when it is unset — so `rejectUnauthorized: true` alone accepts a certificate from any host the trusted CA ever signed when connecting by IP. Both halves are proven against a real TLS-enabled PostgreSQL, including that the same connection without the pinned callback succeeds. Every CA, certificate, and key is generated at test runtime and deleted afterwards. A DATABASE_URL may no longer carry its own TLS parameters. The pinned driver merges parsed connection-string values over explicitly passed options, so a `?sslmode=disable` in the URL would silently replace the policy's verified `ssl` object; that now fails with a stable code, reported by both `pnpm doctor` and the migration CLIs rather than as "failed unexpectedly". One shared environment reader keeps `process.env` out of Core's reusable constructors, and every executable that opens a connection resolves the policy identically: the API (validated before any pool, Better Auth instance, module runtime, or listener exists), both migration commands, the bootstrap CLI, and Doctor's own connection. Doctor reports it as a blocking failure, never a warning, naming only the effective mode. Separately, the identity base URL and every trusted origin must now be exactly one canonical origin — the WHATWG origin serialization must equal the supplied string — so a path, trailing slash, credentials, explicit default port, or non-canonical case is rejected rather than normalized into something that no longer matches what a browser sends. Production's loopback rejection now classifies the address instead of comparing against three literals, covering `.localhost`, all of 127.0.0.0/8, 0.0.0.0, `::`, expanded and IPv4-mapped forms. This is a configuration-shape guarantee only: it does not resolve DNS or prove reachability, and TLS protects the connection, not the exposure. Co-Authored-By: Claude Opus 5 <[email protected]>
47 lines
1.7 KiB
TypeScript
47 lines
1.7 KiB
TypeScript
import { DatabaseTransportError } from "../database/transport.js";
|
|
import { MigrationRunnerError, PostgresMigrationDatabaseError } from "../migrations/index.js";
|
|
import { ModuleDiscoveryError, ModuleMigrationDiscoveryError } from "../modules/index.js";
|
|
|
|
export function reportMigrationCommandError(error: unknown): void {
|
|
if (error instanceof DatabaseTransportError) {
|
|
// The message is a fixed string chosen by code; it never carries the connection string, host,
|
|
// port, credentials, CA material, or the offending mode value, so it is safe to print as-is —
|
|
// and an operator who misconfigured TLS needs to know that, not "failed unexpectedly".
|
|
console.error(`[${error.code}] ${error.message}`);
|
|
return;
|
|
}
|
|
|
|
if (error instanceof ModuleDiscoveryError) {
|
|
console.error(error.message);
|
|
for (const issue of error.issues) {
|
|
const issuePath = issue.path ? ` (${issue.path})` : "";
|
|
console.error(`[${issue.code}] ${issue.moduleDirectory}${issuePath}: ${issue.message}`);
|
|
}
|
|
return;
|
|
}
|
|
|
|
if (error instanceof ModuleMigrationDiscoveryError) {
|
|
console.error(error.message);
|
|
for (const issue of error.issues) {
|
|
const issuePath = issue.path ? ` (${issue.path})` : "";
|
|
console.error(`[${issue.code}] ${issue.moduleId}${issuePath}: ${issue.message}`);
|
|
}
|
|
return;
|
|
}
|
|
|
|
if (error instanceof MigrationRunnerError) {
|
|
console.error(`[${error.code}] ${error.message}`);
|
|
return;
|
|
}
|
|
|
|
if (
|
|
error instanceof PostgresMigrationDatabaseError &&
|
|
error.code === "POSTGRES_MIGRATION_CONFIGURATION_INVALID"
|
|
) {
|
|
console.error("[MIGRATION_CONFIGURATION_INVALID] Migration configuration is invalid.");
|
|
return;
|
|
}
|
|
|
|
console.error("Migration command failed unexpectedly.");
|
|
}
|