panates / postgrejs

98%

master: 89%

Build Type

push

github

Committed by erayhanoglu

Commit Message

feat: TLS on Workers is verified, and channel binding says why it cannot

Measured from `wrangler dev` against a managed PostgreSQL 18 whose
certificate comes from Let's Encrypt:

    ok    socket=WorkerdSocket secure=true  rows={"n":1}   1022ms

and on the same server with `sslmode` dropped:

    FAIL  28000 connection is insecure (try using `sslmode=require`)

The second is what makes the first mean something - that server refuses
unencrypted connections, so a query that answered answered over TLS. The
README row moves to built-in on the strength of it.

`pg_stat_ssl` was tried first and is useless through a provider of this
shape: it reads `ssl=false` even on Node over a real `TLSSocket`, because
the TLS is terminated in front of PostgreSQL and the backend sees a plain
connection. Recorded so nobody reaches for it again.

The run also found a bug this change had introduced. Whether a connection
is encrypted was asked as `this._socket instanceof tls.TLSSocket`, which
a `WorkerdSocket` never is - so `channelBinding: 'require'` over a
perfectly encrypted connection answered "the connection is not using
TLS". Encrypted and bindable are one question on Node and two here:
binding hashes the server's certificate, and this runtime hands out none.
The three cases are now told apart, and the middle one names the runtime
and points at `prefer`, which is the default and which authenticates
without binding - also checked.

Coverage Stats

4198 of 4424 branches covered (94.89%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 1 file covered. (100.0%)

40 existing lines in 1 file now uncovered.

22250 of 22547 relevant lines covered (98.68%)

1856.91 hits per line