fix: disable PostgreSQL TLS for refusing RDS endpoint

backend/internal/postgres/open_test.go

@@ -2,8 +2,12 @@ package postgres
 
 import (
 	"context"
-	"strings"
+	"crypto/tls"
+	"encoding/binary"
+	"io"
+	"net"
 	"testing"
+	"time"
 )
 
 func TestOpenLocalReturnsStoreWithoutPool(t *testing.T) {
@@ -48,13 +52,87 @@ func TestParseConfigIgnoresPostgresTLSSettingsForLocalBackend(t *testing.T) {
 	}
 }
 
-func TestOpenPostgresRejectsInvalidConfiguredTLSMode(t *testing.T) {
-	_, err := Open(context.Background(), Config{
-		Backend:     BackendPostgres,
-		DatabaseURL: "postgresql://app:secret@db.example/app",
-		SSLMode:     SSLMode("prefer"),
+func TestOpenPostgresForcesPlaintextDespiteTLSBearingConfig(t *testing.T) {
+	module, err := Open(context.Background(), Config{
+		Backend:         BackendPostgres,
+		DatabaseURL:     "postgresql://app:secret@127.0.0.1:1/app?sslmode=verify-full&sslrootcert=/missing/ca.pem",
+		SSLMode:         SSLVerifyFull,
+		TLSConfig:       &tls.Config{MinVersion: tls.VersionTLS13},
+		PoolMax:         1,
+		ApplicationName: "zhinian-go-test",
 	})
-	if err == nil || !strings.Contains(err.Error(), "unsupported DATABASE_URL sslmode") {
-		t.Fatalf("Open() error = %v, want DATABASE_URL sslmode error", err)
+	if err != nil {
+		t.Fatalf("Open() error = %v, want TLS settings ignored", err)
+	}
+	module.Close()
+}
+
+func TestOpenPostgresSendsPlaintextStartupMessageWithoutTLSFallback(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("Listen() error = %v", err)
+	}
+	defer listener.Close()
+
+	firstPacket := make(chan [8]byte, 1)
+	serverError := make(chan error, 1)
+	go func() {
+		connection, acceptErr := listener.Accept()
+		if acceptErr != nil {
+			serverError <- acceptErr
+			return
+		}
+		defer connection.Close()
+		var packet [8]byte
+		if _, readErr := io.ReadFull(connection, packet[:]); readErr != nil {
+			serverError <- readErr
+			return
+		}
+		firstPacket <- packet
+	}()
+
+	module, err := Open(context.Background(), Config{
+		Backend:           BackendPostgres,
+		DatabaseURL:       "postgresql://app:secret@" + listener.Addr().String() + "/app?sslmode=verify-full&sslrootcert=/missing/ca.pem",
+		SSLMode:           SSLVerifyFull,
+		TLSConfig:         &tls.Config{MinVersion: tls.VersionTLS13},
+		PoolMax:           1,
+		ConnectionTimeout: time.Second,
+		StatementTimeout:  time.Second,
+		ApplicationName:   "zhinian-go-test",
+	})
+	if err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+	defer module.Close()
+
+	adapter, ok := module.pool.(*pgxPoolAdapter)
+	if !ok {
+		t.Fatalf("pool type = %T, want *pgxPoolAdapter", module.pool)
+	}
+	connectionConfig := adapter.pool.Config().ConnConfig
+	if connectionConfig.TLSConfig != nil {
+		t.Fatal("pgx TLSConfig is not nil")
+	}
+	if len(connectionConfig.Fallbacks) != 0 {
+		t.Fatalf("pgx Fallbacks = %v, want empty", connectionConfig.Fallbacks)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if readinessErr := module.Store.Readiness(ctx); readinessErr == nil {
+		t.Fatal("Readiness() error = nil, want fake server disconnect")
+	}
+
+	select {
+	case packet := <-firstPacket:
+		protocolCode := binary.BigEndian.Uint32(packet[4:8])
+		if protocolCode != 196608 {
+			t.Fatalf("first PostgreSQL protocol code = %d, want plaintext StartupMessage 196608 (SSLRequest is 80877103)", protocolCode)
+		}
+	case serverErr := <-serverError:
+		t.Fatalf("fake PostgreSQL server error = %v", serverErr)
+	case <-time.After(3 * time.Second):
+		t.Fatal("timed out waiting for PostgreSQL startup packet")
 	}
 }