From 2ae6a6c4417a30d6fdfcb428e35365713a3a4ebb Mon Sep 17 00:00:00 2001 From: Shivam-nagar23 Date: Wed, 8 Jul 2026 10:02:32 +0530 Subject: [PATCH 1/2] Add optional SSL/TLS support for PostgreSQL connection Support DB_SSL_MODE (disable|require|verify-ca|verify-full) and DB_SSL_ROOT_CERT for the notifier's TypeORM/pg connection. Defaults to disable (plaintext) to preserve existing behaviour. Enables connecting to SSL-enforcing Postgres such as AWS RDS with rds.force_ssl=1. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/config/database.ts | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/src/config/database.ts b/src/config/database.ts index f42fa45..6e48509 100644 --- a/src/config/database.ts +++ b/src/config/database.ts @@ -15,6 +15,8 @@ */ import { ConnectionOptions, createConnection } from "typeorm"; +import { ConnectionOptions as TlsConnectionOptions } from "tls"; +import * as fs from "fs"; import { NotificationSettings } from "../entities/notificationSettings"; import { NotifierEventLog } from "../entities/notifierEventLogs"; import { Event } from "../notification/service/notificationService"; @@ -26,6 +28,38 @@ import { Users } from "../entities/users"; import { logger } from "./logger"; import * as process from "process"; +// buildSslOptions maps DB_SSL_MODE (disable|require|verify-ca|verify-full) to the +// node-postgres ssl option, mirroring libpq / AWS RDS semantics. Empty/"disable" returns +// false (plaintext, the pre-existing behaviour). verify-ca/verify-full require +// DB_SSL_ROOT_CERT (for AWS RDS the downloaded global-bundle.pem). +const buildSslOptions = (): boolean | TlsConnectionOptions => { + const sslMode: string = (process.env.DB_SSL_MODE || "").trim().toLowerCase(); + switch (sslMode) { + case "": + case "disable": + return false; + case "require": + // Encrypt the connection but do not validate the server certificate. + return { rejectUnauthorized: false }; + case "verify-ca": + case "verify-full": { + const rootCertPath: string = process.env.DB_SSL_ROOT_CERT; + if (!rootCertPath) { + throw new Error("DB_SSL_ROOT_CERT is required for verify-ca/verify-full ssl modes"); + } + const ca: string = fs.readFileSync(rootCertPath).toString(); + const options: TlsConnectionOptions = { rejectUnauthorized: true, ca }; + if (sslMode === "verify-ca") { + // verify the certificate chain but not the server hostname + options.checkServerIdentity = () => undefined; + } + return options; + } + default: + throw new Error(`unsupported DB_SSL_MODE "${sslMode}" (supported: disable, require, verify-ca, verify-full)`); + } +}; + export const connectToDatabase = async () => { const dbHost: string = process.env.DB_HOST; const dbPort: number = +process.env.DB_PORT; @@ -40,6 +74,7 @@ export const connectToDatabase = async () => { username: user, password: pwd, database: db, + ssl: buildSslOptions(), entities: [ NotificationSettings, NotifierEventLog, From cbb138bdc2d6d587c705326ba94b83a7827206d8 Mon Sep 17 00:00:00 2001 From: Shivam-nagar23 Date: Wed, 8 Jul 2026 12:10:45 +0530 Subject: [PATCH 2/2] Fix notifier build: use TlsOptions for pg ssl option type TypeORM's ConnectionOptions.ssl is typed boolean | TlsOptions. Return TlsOptions from buildSslOptions and set checkServerIdentity via a cast (honoured by tls.connect at runtime but absent from the TlsOptions type), resolving the TS2322 build failure. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/config/database.ts | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/config/database.ts b/src/config/database.ts index 6e48509..1ef3f77 100644 --- a/src/config/database.ts +++ b/src/config/database.ts @@ -15,7 +15,7 @@ */ import { ConnectionOptions, createConnection } from "typeorm"; -import { ConnectionOptions as TlsConnectionOptions } from "tls"; +import { TlsOptions } from "tls"; import * as fs from "fs"; import { NotificationSettings } from "../entities/notificationSettings"; import { NotifierEventLog } from "../entities/notifierEventLogs"; @@ -32,7 +32,7 @@ import * as process from "process"; // node-postgres ssl option, mirroring libpq / AWS RDS semantics. Empty/"disable" returns // false (plaintext, the pre-existing behaviour). verify-ca/verify-full require // DB_SSL_ROOT_CERT (for AWS RDS the downloaded global-bundle.pem). -const buildSslOptions = (): boolean | TlsConnectionOptions => { +const buildSslOptions = (): boolean | TlsOptions => { const sslMode: string = (process.env.DB_SSL_MODE || "").trim().toLowerCase(); switch (sslMode) { case "": @@ -48,10 +48,12 @@ const buildSslOptions = (): boolean | TlsConnectionOptions => { throw new Error("DB_SSL_ROOT_CERT is required for verify-ca/verify-full ssl modes"); } const ca: string = fs.readFileSync(rootCertPath).toString(); - const options: TlsConnectionOptions = { rejectUnauthorized: true, ca }; + const options: TlsOptions = { rejectUnauthorized: true, ca }; if (sslMode === "verify-ca") { - // verify the certificate chain but not the server hostname - options.checkServerIdentity = () => undefined; + // verify the certificate chain but not the server hostname. + // checkServerIdentity is honoured by tls.connect at runtime but is not + // part of the TlsOptions type in @types/node, hence the cast. + (options as any).checkServerIdentity = () => undefined; } return options; }