adrianbonpin
3454ce67fe
Connecting to a managed provider (Neon in the report) failed with "connection is insecure (try using `sslmode=require`)" because the TLS mode never reached the backend: - ConnectionFormData carried no ssl_* fields and both submit handlers (NewConnectionScreen.buildPayload, EditConnectionModal save + test) omitted them, so the SSH/SSL tab's mode was silently dropped before IPC. - SslFields wrote ssl_ca_cert / ssl_client_cert / ssl_client_key — names the Rust ConnectionInput ignores (it expects ssl_ca_path / ssl_cert_path / ssl_key_path). - parseConnectionString ignored query params, so a pasted Neon/Supabase URL's ?sslmode=require was discarded. Pasting a URI now fills every setting it can (sslmode / ssl-mode, including MySQL's REQUIRED and VERIFY_IDENTITY spellings) and offers a derived label (database name, else host/file stem) as a placeholder that Test/Save uses when the field is left blank. Managed presets pre-select their TLS mode (Supabase / Neon → Require, PlanetScale → Verify Full). Backend safety net: db::tls::resolve_ssl_mode defaults *.neon.tech / *.supabase.co / *.psdb.cloud to `require` when a connection has no ssl_mode, so connections saved before this fix keep working; an explicit mode (including disable) always wins. Tests: +15 frontend (parser, form payload, SSL field names, edit modal), +4 Rust (resolve_ssl_mode / tls_decision_for).
38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
import type { DbType } from "../../lib/types";
|
|
import type { Environment } from "./EnvironmentSelect";
|
|
import type { SslMode } from "../../lib/connectionString";
|
|
|
|
export interface ConnectionFormData {
|
|
name: string;
|
|
environment: Environment;
|
|
folder_id: string | null;
|
|
tag_ids: string[];
|
|
connection_string: string;
|
|
db_type: DbType;
|
|
host: string;
|
|
port: number | null;
|
|
username: string | null;
|
|
password: string | null;
|
|
database: string | null;
|
|
use_keychain: boolean;
|
|
// SSH tunnel fields (non-secret flat fields are optional; SshFields writes
|
|
// the key path under ssh_private_key, which submit handlers map to
|
|
// ssh_private_key_path on ConnectionInput)
|
|
ssh_host?: string | null;
|
|
ssh_port?: number | null;
|
|
ssh_user?: string | null;
|
|
ssh_auth_method?: "password" | "key" | null;
|
|
ssh_private_key?: string | null;
|
|
ssh_password: string | null;
|
|
ssh_passphrase?: string | null;
|
|
// SSL/TLS fields. These must live on the form data (and survive into the
|
|
// submit payload) or the SSH/SSL tab's selections are silently dropped — the
|
|
// backend then connects with TLS disabled, which managed providers (Neon,
|
|
// Supabase, PlanetScale) reject with "connection is insecure".
|
|
// `null` = unset, which the backend treats as TLS disabled.
|
|
ssl_mode?: SslMode | null;
|
|
ssl_ca_path?: string | null;
|
|
ssl_cert_path?: string | null;
|
|
ssl_key_path?: string | null;
|
|
}
|