fix: disable PostgreSQL TLS for refusing RDS endpoint

backend/internal/postgres/config_test.go

@@ -1,15 +1,8 @@
 package postgres
 
 import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"math/big"
 	"net/url"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -60,52 +53,36 @@ func TestParseConfigAcceptsOnlyPostgresSchemesAndRejectsUnsupportedSSLQueryParam
 	}
 }
 
-func TestParseConfigBuildsVerifyFullTLSFromURLCA(t *testing.T) {
-	dir := t.TempDir()
-	caPath := filepath.Join(dir, "ca.pem")
-	const ca = "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n"
-	read := func(path string) ([]byte, error) {
-		if path != caPath {
-			t.Fatalf("read path = %q, want %q", path, caPath)
-		}
-		return []byte(ca), nil
-	}
-	_, err := ParseConfig(env(map[string]string{
-		"ZHINIAN_DATA_BACKEND": "postgres",
-		"DATABASE_URL":         "postgresql://db.example/app?sslmode=verify-full&sslrootcert=" + url.QueryEscape(caPath),
-	}), read)
-	if err == nil || !strings.Contains(err.Error(), "CA certificate") {
-		t.Fatalf("ParseConfig() error = %v, want invalid CA certificate error", err)
-	}
-}
-
-func TestParseConfigVerifyFullBuildsRootsWithoutDisablingVerification(t *testing.T) {
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatal(err)
-	}
-	template := &x509.Certificate{
-		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test CA"},
-		NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour),
-		IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign,
-	}
-	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ca := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+func TestParseConfigForcesPlaintextAndDoesNotReadURLCA(t *testing.T) {
+	readCalled := false
 	cfg, err := ParseConfig(env(map[string]string{
 		"ZHINIAN_DATA_BACKEND": "postgres",
-		"DATABASE_URL":         "postgresql://db.example/app?sslmode=verify-full&sslrootcert=%2Fca.pem",
-	}), func(string) ([]byte, error) { return ca, nil })
+		"DATABASE_URL":         "postgresql://db.example/app?connect_timeout=5&sslmode=verify-full&sslrootcert=%2Fetc%2Fzhinian%2Frds%2Fca.pem",
+	}), func(string) ([]byte, error) {
+		readCalled = true
+		return nil, os.ErrNotExist
+	})
 	if err != nil {
 		t.Fatalf("ParseConfig() error = %v", err)
 	}
-	if cfg.TLSConfig == nil || cfg.TLSConfig.RootCAs == nil {
-		t.Fatal("TLSConfig.RootCAs is nil")
+	if readCalled {
+		t.Fatal("ParseConfig() read sslrootcert, want plaintext configuration without CA access")
 	}
-	if cfg.TLSConfig.InsecureSkipVerify {
-		t.Fatal("TLSConfig.InsecureSkipVerify = true, want full certificate and hostname verification")
+	if cfg.SSLMode != SSLDisable || cfg.TLSConfig != nil {
+		t.Fatalf("TLS configuration = mode %q config %v, want disabled and nil", cfg.SSLMode, cfg.TLSConfig)
+	}
+	parsed, err := url.Parse(cfg.DatabaseURL)
+	if err != nil {
+		t.Fatalf("parse normalized DATABASE_URL: %v", err)
+	}
+	if got := parsed.Query().Get("sslmode"); got != "disable" {
+		t.Fatalf("normalized sslmode = %q, want disable", got)
+	}
+	if parsed.Query().Has("sslrootcert") {
+		t.Fatal("normalized DATABASE_URL retains sslrootcert")
+	}
+	if got := parsed.Query().Get("connect_timeout"); got != "5" {
+		t.Fatalf("normalized connect_timeout = %q, want 5", got)
 	}
 }
 
@@ -120,11 +97,11 @@ func TestParseConfigDefaultsAndNumericValidation(t *testing.T) {
 	if cfg.PoolMax != 10 || cfg.IdleTimeout != 30*time.Second || cfg.ConnectionTimeout != 10*time.Second || cfg.StatementTimeout != 30*time.Second {
 		t.Fatalf("unexpected defaults: %+v", cfg)
 	}
-	if cfg.ApplicationName != "zhinian-go" || cfg.SSLMode != SSLVerifyFull {
+	if cfg.ApplicationName != "zhinian-go" || cfg.SSLMode != SSLDisable {
 		t.Fatalf("unexpected identity/TLS defaults: %+v", cfg)
 	}
-	if cfg.TLSConfig == nil || cfg.TLSConfig.InsecureSkipVerify {
-		t.Fatal("default PostgreSQL configuration must verify the server certificate")
+	if cfg.TLSConfig != nil {
+		t.Fatal("default PostgreSQL configuration must not negotiate TLS")
 	}
 
 	for name, value := range map[string]string{