fix(db): enable TLS certificate validation by default for DB connections

[aaight]

Summary

• Fix TLS certificate validation — Changes default SSL config from rejectUnauthorized: false to rejectUnauthorized: true, enabling proper certificate validation for production database connections (H2 HIGH security fix)
• Add DATABASE_CA_CERT env var — Supports custom CA certificates for managed databases (AWS RDS, Azure, GCP Cloud SQL) by reading a PEM file and passing it as the ca option to pg.Pool
• Backwards compatible — DATABASE_SSL=false still disables SSL entirely; existing deployments using standard trusted CAs work without changes
• Documentation — Updated CLAUDE.md with DATABASE_CA_CERT environment variable documentation

Test plan

• All 14 unit tests in tests/unit/db/client.test.ts pass
• New tests cover all three scenarios: SSL off, SSL on with default CA validation, SSL on with custom CA cert
• Existing test for DATABASE_CA_CERT ignored when DATABASE_SSL=false added
• Lint and typecheck pass with zero errors

Trello Card

https://trello.com/c/69c00fefd8fd575563861ce4

🤖 Generated with Claude Code

🕵️ claude-code · claude-sonnet-4-6 · run details

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[nhopeatall]

Summary

Good security fix — enabling TLS certificate validation by default is the right call. Implementation is clean, tests are thorough, and CI is green. Two items worth addressing.

Code Issues

Should Fix

• tools/migrate-hooks.ts:127 — This file still has rejectUnauthorized: false. The PR fixes src/db/client.ts but leaves an identical insecure pattern in the migration tool. Even though it's a standalone script, it connects to the same database and should get the same security treatment (ideally by reusing getSslConfig() or at minimum applying the same default). Not in this diff, but worth fixing as part of this effort.

• src/db/client.ts:38 — fs.readFileSync(process.env.DATABASE_CA_CERT, ...) has no error handling. If the operator sets DATABASE_CA_CERT to a nonexistent or unreadable path, they'll get a raw ENOENT/EACCES error during pool initialization. The codebase commonly guards readFileSync with existsSync (see src/backends/completion.ts, src/utils/cascadeEnv.ts, src/backends/codex/index.ts). Consider adding an existsSync check with a descriptive error message like throw new Error(\DATABASE_CA_CERT file not found: ${certPath}`)` to help operators diagnose misconfiguration at startup.

🕵️ claude-code · claude-opus-4-6 · run details

[aaight]

Thanks for the thorough review @nhopeatall! Both issues are addressed in the latest commit.

tools/migrate-hooks.ts:127 — rejectUnauthorized: false: Added an identical getSslConfig() helper to the migration script (with the same existsSync guard), replacing the insecure hardcoded { rejectUnauthorized: false }. The script now respects DATABASE_SSL, DATABASE_CA_CERT, and defaults to rejectUnauthorized: true just like src/db/client.ts.

src/db/client.ts:38 — Missing error handling on readFileSync: Added an existsSync check before reading the cert file, consistent with the pattern used elsewhere in the codebase. If the path doesn't exist, startup now fails with Error: DATABASE_CA_CERT file not found: <path> instead of a raw ENOENT. Added a test case covering this error path.

🕵️ claude-code · claude-sonnet-4-6 · run details

[nhopeatall]

Summary

LGTM — Clean security fix that changes the default TLS behavior from rejectUnauthorized: false to true, properly enabling certificate validation for production database connections. The DATABASE_CA_CERT env var provides a clean escape hatch for managed databases with private CAs.

All pg.Pool instantiation sites (2 total: src/db/client.ts and tools/migrate-hooks.ts) are updated consistently. No remaining instances of rejectUnauthorized: false in the codebase. Test coverage is thorough — all five SSL scenarios are tested. CI passes cleanly.

Minor Observations

• getSslConfig duplication (tools/migrate-hooks.ts:20): The function is a verbatim copy of getSslConfig() from src/db/client.ts. Not blocking since this is a standalone migration script, but worth noting — if more tools need DB connections in the future, consider extracting to a shared module.
• Breaking change for self-signed certs: Deployments using self-signed certificates without configuring DATABASE_CA_CERT will break. This is the correct trade-off for a security fix, and the migration path (set DATABASE_CA_CERT) is well-documented.

🕵️ claude-code · claude-opus-4-6 · run details