feat(graph): add TLS support for PgGraph connections#49
Merged
Conversation
- new graph-pg-tls feature (postgres-native-tls + native-tls deps) - PgGraph::connect_native_tls for system-trust-store TLS in one call - PgGraph::connect_tls / connect_config_tls generic over MakeTlsConnect - closes #48
NoTls is a private-scope import, not resolvable as an intra-doc link target; docs CI failed with rustdoc::broken_intra_doc_links.
- extract parse_config() shared by connect and connect_tls - connect_tls/connect_config_tls no longer require T: Clone (postgres::Config::connect never clones the connector)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #48
Summary
PgGraph::connect()/PgGraph::connect_config()hardcodedpostgres::NoTls, so any Postgres server requiring TLS (sslmode=require+, e.g. RDS withrds.force_ssl) failed immediately withError { kind: Tls, cause: Some(NoTlsError(())) }. This blocked defense-in-depth encryption on internal DB traffic for thegraph-pgfeature.Changes
graph-pg-tls(deps:postgres-native-tls,native-tls), included infull. Does not affect existinggraph-pgconsumers — no new mandatory deps.PgGraph::connect_native_tls(url)— one-call convenience constructor usingnative-tlswith the system trust store (full cert-chain + hostname verification, not weakened). Covers the common RDS/sslmode=requirecase directly.PgGraph::connect_tls<T>/connect_config_tls<T>— generic over anypostgres::tls::MakeTlsConnectimplementor, for custom CAs, client certs, or a caller-vendored rustls adapter.from_clienthelper, reused by all constructors —connect/connect_config(NoTls) behavior is unchanged.connect_native_tls_returns_result_not_panic, gated ongraph-pg-tls, self-skips withoutLLMKERNEL_PG_URL(matches existing live-DB test convention).AGENTS.mdoptional-backend-features table.Spec
Full requirements/AC in
SPEC-20260701T050115Z.md(orbit pipelinePIPELINE-20260701T050115Z).Audit
postgres::Config::connect's own bounds),from_clientrefactor behavior-preserving, API consistent with existingconnect/connect_configpair.native_tls::TlsConnector::new()verifies certs and hostnames by default (nodanger_accept_invalid_*used); no NoTls-path regression; no credential-logging issue introduced.Verification
cargo build --features graph-pg-tls— compilescargo build --features graph-pg— compiles unchanged, no new deps pulled incargo test --all-features— 540 passed, 0 failed, 6 ignoredcargo clippy --all-features -- -D warnings— cleancargo fmt --all -- --check— clean