fix(prisma): turn TLS on when DATABASE_URL uses sslmode=no-verify

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],

src/lib/prisma.test.ts

@@ -89,3 +89,79 @@ describe("prisma module lazy initialization", () => {
  expect(() => (mod.prisma as any).repository).not.toThrow(/DATABASE_URL/);
  });
 });
+
+describe("prisma DATABASE_URL sslmode handling", () => {
+ let adapterCtor: ReturnType<typeof vi.fn<(...args: unknown[]) => void>>;
+ let PrismaPgMock: any;
+
+ beforeEach(() => {
+ vi.resetModules();
+ adapterCtor = vi.fn((..._args: unknown[]) => undefined);
+ const PrismaPgCtor: any = vi.fn(function (this: any, ...args: any[]) {
+ adapterCtor(...args);
+ this.adapterName = "PrismaPg";
+ this.provider = "postgres";
+ });
+ PrismaPgMock = PrismaPgCtor;
+ vi.doMock("@prisma/adapter-pg", () => ({
+ PrismaPg: PrismaPgMock,
+ }));
+ });
+
+ afterEach(() => {
+ vi.doUnmock("@prisma/adapter-pg");
+ });
+
+ it("passes ssl: { rejectUnauthorized: false } when sslmode=no-verify is set", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=no-verify";
+ const mod = await import("./prisma");
+ // Force the cached client to be rebuilt with the new DATABASE_URL.
+ mod.__resetPrismaClientForTests();
+ // Touch the lazy proxy to force initClient().
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const config = adapterCtor.mock.calls[0][0] as {
+ connectionString: string;
+ ssl: { rejectUnauthorized: boolean };
+ };
+ expect(config.ssl).toEqual({ rejectUnauthorized: false });
+ // The unknown sslmode must be stripped so pg-connection-string does
+ // not fall back to "prefer" and try a plaintext handshake.
+ expect(new URL(config.connectionString).searchParams.has("sslmode")).toBe(false);
+ expect(new URL(config.connectionString).toString()).toBe(
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch",
+ );
+ });
+
+ it("leaves the URL untouched for standard sslmode values like require", async () => {
+ process.env.DATABASE_URL =
+ "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch?sslmode=require";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("does not add explicit ssl config when sslmode is absent", async () => {
+ process.env.DATABASE_URL = "postgresql://dispatch:secret@ai-primary.ai.svc:5432/dispatch";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe(process.env.DATABASE_URL);
+ });
+
+ it("falls back to passing the raw URL when it is not a parseable URL", async () => {
+ process.env.DATABASE_URL = "not-a-valid-url";
+ const mod = await import("./prisma");
+ mod.__resetPrismaClientForTests();
+ void (mod.prisma as any).repository;
+ expect(adapterCtor).toHaveBeenCalledTimes(1);
+ const arg = adapterCtor.mock.calls[0][0];
+ expect(arg).toBe("not-a-valid-url");
+ });
+});

src/lib/prisma.ts

@@ -13,6 +13,37 @@ function databaseUrl(): string | undefined {
  return process.env.DATABASE_URL ?? process.env.DISPATCH_DATABASE_URL;
 }
 
+/**
+ * Build a `PrismaPg` adapter from the connection URL.
+ *
+ * `pg-connection-string` (the parser used by `@prisma/adapter-pg` and
+ * `pg.Pool`) only recognises libpq's standard `sslmode` values:
+ * `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`.
+ * The README documents `sslmode=no-verify` (TLS on, certificate not
+ * verified) but `no-verify` is not one of those, so it falls through and
+ * `pg.Pool` ends up with no `ssl` config — the server then rejects the
+ * connection with `no pg_hba.conf entry ... no encryption`. Detect the
+ * documented alias, strip it from the URL, and hand PrismaPg an explicit
+ * `ssl: { rejectUnauthorized: false }` so node-postgres requires TLS
+ * without validating the certificate.
+ */
+function buildAdapter(url: string): PrismaPg {
+ let parsed: URL;
+ try {
+ parsed = new URL(url);
+ } catch {
+ return new PrismaPg(url);
+ }
+ if (parsed.searchParams.get("sslmode") !== "no-verify") {
+ return new PrismaPg(url);
+ }
+ parsed.searchParams.delete("sslmode");
+ return new PrismaPg({
+ connectionString: parsed.toString(),
+ ssl: { rejectUnauthorized: false },
+ });
+}
+
 function initClient(): PrismaClient {
  if (_client) return _client;
  if (globalForPrisma.prisma) {
@@ -27,7 +58,7 @@ function initClient(): PrismaClient {
  );
  }
 
- const adapter = new PrismaPg(url);
+ const adapter = buildAdapter(url);
  const client = new PrismaClient({
  adapter,
  log: process.env.NODE_ENV === "development" ? ["error", "warn"] : ["error"],