Uh oh!
There was an error while loading. Please reload this page.
fix(prisma): turn TLS on when DATABASE_URL uses sslmode=no-verify - #910
Conversation
`@prisma/adapter-pg` parses the connection URL via `pg-connection-string`,
which only knows libpq's standard `sslmode` values: `disable`, `allow`,
`prefer`, `require`, `verify-ca`, `verify-full`. The README documents
`sslmode=no-verify` (TLS on, certificate not verified) but `no-verify` is
not one of those, so the parser falls through and `pg.Pool` is built with
no `ssl` config. Servers that require encryption then reject the
connection with `no pg_hba.conf entry ... no encryption`, even though the
operator followed the documented setting.
Detect `sslmode=no-verify` in `DATABASE_URL`, strip it from the URL, and
hand PrismaPg `{ connectionString, ssl: { rejectUnauthorized: false } }`
so node-postgres requires TLS without validating the certificate —
matching what the README already promises. Standard `sslmode` values and
URLs without `sslmode` are passed through unchanged.
Fixes#899
Signed-off-by: Saffron <263493777+itsmiso-ai@users.noreply.github.com>There was a problem hiding this comment.
AI Automated Review
Full PR review.
Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — primary route
PR Review: fix(prisma): turn TLS on when DATABASE_URL uses sslmode=no-verify
Summary
This PR fixes issue PR 899 where sslmode=no-verify in DATABASE_URL fails to enable TLS, resulting in the error no pg_hba.conf entry ... no encryption. The root cause is that pg-connection-string (used by @prisma/adapter-pg) doesn't recognize no-verify as a valid sslmode, causing it to fall through to the default prefer behavior which attempts plaintext.
Changes
src/lib/prisma.ts (+32/-1 lines):
- Added
buildAdapter(url)function that:- Detects
sslmode=no-verifyin the connection URL - Strips the unrecognized
sslmodeparam to prevent pg-connection-string from falling through toprefer - Passes explicit
ssl: { rejectUnauthorized: false }to node-postgres to enable TLS without certificate validation - Falls back to direct
new PrismaPg(url)for standard sslmode values or unparseable URLs
- Detects
- Updated
initClient()to usebuildAdapter(url)instead ofnew PrismaPg(url)
src/lib/prisma.test.ts (+76 lines):
- Added 4 test cases covering:
sslmode=no-verify→ passesssl: { rejectUnauthorized: false }and strips the param from connection string- Standard sslmode values (
require) → URL left untouched - No sslmode → no explicit ssl config added
- Unparseable URL → raw URL passed through
Standards Compliance
The implementation follows repository conventions:
- Uses
error instanceof Errorpattern principles (proper error handling via try/catch for URL parsing) - Validates input before database operations (URL parsing before adapter creation)
- Appropriate test coverage for a bug fix
- Clear inline documentation explaining the root cause and fix rationale
Linked Issue Fit
Issue PR 899 clearly states:
sslmode=no-verifyshould enable TLS without certificate verification (documented in README)- Currently results in
no pg_hba.conf entry ... no encryptionerror sslmode=requireworks but rejects self-signed certificates
This PR directly addresses the issue by ensuring no-verify triggers the same TLS behavior as require but with rejectUnauthorized: false. The fix aligns with the documented semantics in README.md lines 147-148.
Tool Harness Findings
Not applicable — no tool harness output in corpus.
CI Check Results
All CI checks passed:
- Build, Typecheck, Lint: success
- Tests, Coverage: success
- Database migrations, Database integration: success
- Docker Build (MCP), Docker Build, npm audit, smoke: success
Unknowns / Needs Verification
None — the fix is well-documented, has comprehensive test coverage, and all CI checks pass.
Fixes issue #899 by correctly handling
sslmode=no-verifyin the connection URL to enable TLS without certificate verification.Fixes#899
Opened by foreman on review GO (workload wl-misospace-dispatch-899).