Skip to content

fix(postgres): use rustls connector in test_connection to support client certs and custom CA - #678

Merged
debba merged 2 commits into
TabularisDB:mainfrom
adisusilayasa:fix/postgres-test-connection-tls
Aug 26, 2026
Merged

fix(postgres): use rustls connector in test_connection to support client certs and custom CA#678
debba merged 2 commits into
TabularisDB:mainfrom
adisusilayasa:fix/postgres-test-connection-tls

Conversation

@adisusilayasa

Copy link
Copy Markdown
Contributor

Summary

Previously, PostgresDriver did not implement test_connection(), falling back to the default DatabaseDriver::test_connection() implementation which constructed a connection URL and connected via sqlx::AnyConnection.

This caused connection tests to fail for PostgreSQL databases requiring:

  1. mTLS client certificates (ssl_cert / ssl_key) — because sqlx connection string did not include client certificates, causing servers to reject with FATAL: connection requires a valid client certificate.
  2. Custom Root CAs (ssl_ca) — because sqlx on macOS uses the system keychain rather than honoring the user-supplied CA bundle in test_connection.

Changes

  • Override test_connection() on PostgresDriver to use tokio-postgres-rustls (build_postgres_configurations and build_postgres_tls_connector), ensuring the test connection path matches the query pool path and properly honors ssl_ca, ssl_cert, and ssl_key.

@kilo-code-bot

kilo-code-bot Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)
  • src-tauri/src/drivers/postgres/mod.rs

Reviewed by glm-5.2 · Input: 29.9K · Output: 5.4K · Cached: 295.9K

@aesslinger

Copy link
Copy Markdown
Contributor

FYI for anyone using the standalone tabularis-postgresql-plugin driver instead of this builtin one: it doesn't have this bug class. Its test_connection (src/client.rs) has always routed through the same get_or_create_poolbuild_poolbuild_tls_connector path used for every real query — there's no separate sqlx/AnyConnection test-connection shortcut to diverge from the rustls connector. ssl_cert/ssl_key (mTLS) and ssl_ca are honored the same way in both the connection test and the query pool.

No corresponding issue needed in that repo for this one.

@debba
debba merged commit cd19d9f into TabularisDB:main Aug 26, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants