Updated the ConfigReader+Properties extension in the Website service target to fail to the boot in case of unknown database tokens.

Services/Website/Tests/App/ConfigReaderPropertiesTests.swift

@@ -99,6 +99,58 @@ struct ConfigReaderPropertiesTests {
         #expect(!header.contains("immutable"))
     }
 
+    @Test
+    func `driver to default to the in-memory database`() throws {
+        guard case .inMemory = try reader().driver else {
+            Issue.record("Expected the in-memory driver when 'database.driver' is unset.")
+            return
+        }
+    }
+
+    @Test
+    func `driver to select postgres when configured`() throws {
+        guard case .postgres = try reader(values: [.Database.driver: "postgres"]).driver else {
+            Issue.record("Expected the postgres driver when 'database.driver' selects it.")
+            return
+        }
+    }
+
+    @Test
+    func `driver to throw on an unknown token`() {
+        // A silent fallback would run the deployment on the ephemeral database and discard every write on restart.
+        #expect(throws: ConfigError.unknownDatabaseDriver("mariadb")) {
+            _ = try reader(values: [.Database.driver: "mariadb"]).driver
+        }
+    }
+
+    @Test(arguments: [
+        String.Database.tlsOff,
+        String.Database.tlsPrefer,
+        String.Database.tlsRequire
+    ])
+    func `driver to accept a recognized tls token`(token: String) throws {
+        let reader = reader(values: [
+            .Database.driver: .init(stringLiteral: .Database.driverPostgres),
+            .Database.tls: .init(stringLiteral: token)
+        ])
+
+        guard case .postgres = try reader.driver else {
+            Issue.record("Expected the postgres driver for the '\(token)' TLS token.")
+            return
+        }
+    }
+
+    @Test
+    func `driver to throw on an unknown tls token`() {
+        // A silent fallback to `prefer` hands the password over in plaintext when the upgrade is stripped.
+        #expect(throws: ConfigError.unknownDatabaseTLS("required")) {
+            _ = try reader(values: [
+                .Database.driver: .init(stringLiteral: .Database.driverPostgres),
+                .Database.tls: "required"
+            ]).driver
+        }
+    }
+
 }
 
 // MARK: - Helpers