ccn/Packages/Persistence/Tests/Cases/Public/Enumerations/TLSTests.swift

import Logging
import MySQLNIO
import NIOCore
import NIOPosix
import NIOSSL
import Testing

@testable import Persistence

@Suite(
    "TLS enumeration",
    .tags(.enumeration)
)
struct TLSTests {

    // MARK: Properties tests

    @Test
    func `off has no TLS configuration`() {
        #expect(TLS.off.tlsConfiguration == nil)
    }

    @Test(arguments: [
        TLS.prefer,
        TLS.require
    ])
    func `maps to the default client configuration`(
        for tls: TLS
    ) throws {
        let configuration = try #require(tls.tlsConfiguration)

        #expect(configuration.bestEffortEquals(.makeClientConfiguration()))
    }

    @Test
    func `prefer falls back to plaintext when the server offers no TLS`() async throws {
        // The fake server never advertises `CLIENT_SSL`, so this connection can only succeed by downgrading to
        // plaintext — pinning the driver behavior the `prefer` posture relies on.
        let server = try await PlaintextMySQLServer.start()
        let tlsConfiguration = try #require(TLS.prefer.tlsConfiguration)
        let connection = try await MySQLConnection.connect(
            to: .init(ipAddress: "127.0.0.1", port: server.port),
            username: "loud",
            database: "loud",
            tlsConfiguration: tlsConfiguration,
            logger: Logger(label: "test"),
            on: MultiThreadedEventLoopGroup.singleton.any()
        ).get()

        let isConnected = !connection.isClosed

        try await connection.close().get()
        try await server.stop()

        #expect(isConnected)
    }

}