Allow users to pass certs with PG environment variables

If PGSSLMODE is specified and is either require, verify-ca or verify-full, then the PGSSLROOTCERT, PGSSLCERT, and PGSSLKEY environment variables will be checked for certificate paths and used to connect.
brianc · Jan 5, 2024 · 4fd1c6e · 4fd1c6e
1 parent 6cd0aeb
commit 4fd1c6e
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 11 deletions.
diff --git a/packages/pg/lib/connection-parameters.js b/packages/pg/lib/connection-parameters.js
@@ -1,6 +1,7 @@
 'use strict'
 
 var dns = require('dns')
+var fs = require('fs')
 
 var defaults = require('./defaults')
 
@@ -23,10 +24,15 @@ var readSSLConfigFromEnvironment = function () {
     case 'disable':
       return false
     case 'prefer':
+      return true
     case 'require':
     case 'verify-ca':
     case 'verify-full':
-      return true
+      return {
+        ca: process.env.PGSSLROOTCERT ? fs.readFileSync(process.env.PGSSLROOTCERT).toString() : undefined,
+        key: process.env.PGSSLKEY ? fs.readFileSync(process.env.PGSSLKEY).toString() : undefined,
+        cert: process.env.PGSSLCERT ? fs.readFileSync(process.env.PGSSLCERT).toString() : undefined,
+      }
     case 'no-verify':
       return { rejectUnauthorized: false }
   }

diff --git a/packages/pg/test/integration/connection-pool/tls-tests.js b/packages/pg/test/integration/connection-pool/tls-tests.js
@@ -9,13 +9,9 @@ const suite = new helper.Suite()
 
 if (process.env.PG_CLIENT_CERT_TEST) {
   suite.testAsync('client certificate', async () => {
-    const pool = new pg.Pool({
-      ssl: {
-        ca: fs.readFileSync(process.env.PGSSLROOTCERT),
-        cert: fs.readFileSync(process.env.PGSSLCERT),
-        key: fs.readFileSync(process.env.PGSSLKEY),
-      },
-    })
+    // PGSSLROOTCERT, PGSSLCERT, and PGSSLKEY are all set as environment
+    // variables in .travis.yml
+    const pool = new pg.Pool()
 
     await pool.query('SELECT 1')
     await pool.end()

diff --git a/packages/pg/test/unit/connection-parameters/environment-variable-tests.js b/packages/pg/test/unit/connection-parameters/environment-variable-tests.js
@@ -117,9 +117,9 @@ testVal('', false)
 testVal('disable', false)
 testVal('allow', false)
 testVal('prefer', true)
-testVal('require', true)
-testVal('verify-ca', true)
-testVal('verify-full', true)
+testVal('require', { ca: undefined, cert: undefined, key: undefined })
+testVal('verify-ca', { ca: undefined, cert: undefined, key: undefined })
+testVal('verify-full', { ca: undefined, cert: undefined, key: undefined })
 testVal('no-verify', { rejectUnauthorized: false })
 
 // restore process.env