javierandClaude Opus 5.5
911424de24
This commit contains the latest updates from the generic Website template, which move the toolchain to Swift 6.4, gate analytics and structured data behind traits, and rework page routing: - Updated the Swift toolchain for all the package dependencies and the Website service to version 6.4. (345b305) - Adapted all the existing middlewares in the Infrastructure package to Swift 6.4. (26008df) - Moved test resource teardown in the Persistence and the Website library into defer blocks. (27984a9) - Gated analytics behind a trait and reworked structured data in the Infrastructure package. (c7d4769) - Enabled the Analytics trait in the Website service. (f6a6bbd) - Reworked page routing in the Website service. (d1cb2c1) - Gated the structured data features in the Infrastructure package behind a trait. (f0a8791) - Enabled the StructuredData trait of the Infrastructure package in the Website service. (bbfdeb3) - Fixed the asset pin and a build warning in the Dockerfile of the Website service. (6ed0f9b) The root README change in 345b305 was left out, as this project no longer carries that file. From d1cb2c1, the RootController rework was left out, as the prototype serves a session-aware landing page and routes its other pages through their own controllers; the view-event reporter was appended to the prototype's shared script instead. The prototype code was adapted to the stricter Swift 6.4 settings: `String(format:)` was swapped for safe formatting, the NoIndex middleware takes a `@concurrent` next handler, and the tests flagged by warnings-as-errors were tightened. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
101 lines
2.7 KiB
Swift
101 lines
2.7 KiB
Swift
import Logging
|
|
import NIOCore
|
|
import NIOPosix
|
|
import PostgresNIO
|
|
import Testing
|
|
|
|
@testable import Persistence
|
|
|
|
@Suite(
|
|
"TLS enumeration",
|
|
.tags(.enumeration)
|
|
)
|
|
struct TLSTests {
|
|
|
|
// MARK: Methods tests
|
|
|
|
@Test
|
|
func `off connects in plaintext`() async throws {
|
|
// With TLS disabled the client skips the `SSLRequest` and sends its startup message directly,
|
|
// which the fake server answers in plaintext.
|
|
let server = try await PlaintextPostgresServer.start()
|
|
|
|
defer {
|
|
try? await server.stop()
|
|
}
|
|
|
|
let connection = try await connect(to: server, tls: .off)
|
|
|
|
defer {
|
|
try? await connection.close()
|
|
}
|
|
|
|
#expect(!connection.isClosed)
|
|
}
|
|
|
|
@Test
|
|
func `prefer falls back to plaintext when the server offers no TLS`() async throws {
|
|
// The fake server refuses the `SSLRequest`, so this connection can only succeed by downgrading
|
|
// to plaintext — pinning the driver behavior the `prefer` posture relies on.
|
|
let server = try await PlaintextPostgresServer.start()
|
|
|
|
defer {
|
|
try? await server.stop()
|
|
}
|
|
|
|
let connection = try await connect(to: server, tls: .prefer)
|
|
|
|
defer {
|
|
try? await connection.close()
|
|
}
|
|
|
|
#expect(!connection.isClosed)
|
|
}
|
|
|
|
@Test
|
|
func `require refuses the connection when the server offers no TLS`() async throws {
|
|
// The fake server refuses the `SSLRequest`, so the driver must fail the connection instead of
|
|
// downgrading — pinning the refusal the `require` posture promises.
|
|
let server = try await PlaintextPostgresServer.start()
|
|
|
|
let error = await #expect(throws: PSQLError.self) {
|
|
_ = try await connect(to: server, tls: .require)
|
|
}
|
|
|
|
try await server.stop()
|
|
|
|
#expect(error?.code == .sslUnsupported)
|
|
}
|
|
|
|
}
|
|
|
|
// MARK: - Helpers
|
|
|
|
private extension TLSTests {
|
|
|
|
/// Opens a connection to the given fake server with the given TLS posture.
|
|
/// - Parameters:
|
|
/// - server: the fake server to connect to.
|
|
/// - tls: the TLS posture to connect with.
|
|
/// - Returns: the open connection, to be closed by the caller.
|
|
func connect(
|
|
to server: PlaintextPostgresServer,
|
|
tls: TLS
|
|
) async throws -> PostgresConnection {
|
|
try await PostgresConnection.connect(
|
|
on: MultiThreadedEventLoopGroup.singleton.any(),
|
|
configuration: .init(
|
|
host: "127.0.0.1",
|
|
port: server.port,
|
|
username: "loud",
|
|
password: "loud",
|
|
database: "loud",
|
|
tls: tls.postgresTLS()
|
|
),
|
|
id: 1,
|
|
logger: Logger(label: "test")
|
|
)
|
|
}
|
|
|
|
}
|