javier
ea00b94841
This PR contains the work done to do a little bit of housekeeping pass across all packages and the Website service. To provide further details about the work: * Refreshed the READMEs and source documentation to match the current code; * Tagged every test case consistently across the Infrastructure, Localization, Persistence, and Website test targets; * Removed Website middleware tests now covered by Infrastructure's own suite; * Conformed the `PrepareDB` method to Sendable; * Relaxes the production Compose DATABASE_TLS default from require to prefer; * Added Persistence test verifying the prefer posture falls back to plaintext connections. Reviewed-on: rock-n-code/loud-amsterdam#27 Co-authored-by: Javier Cicchelli <javier@rock-n-code.com> Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
42 lines
1.6 KiB
Swift
42 lines
1.6 KiB
Swift
import NIOSSL
|
|
|
|
/// The TLS posture used when connecting to the database.
|
|
///
|
|
/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the MySQL driver
|
|
/// receives the resulting `TLSConfiguration` through ``tlsConfiguration``.
|
|
public enum TLS: Sendable {
|
|
|
|
/// Connect without TLS, in plaintext.
|
|
case off
|
|
|
|
/// Connect over TLS when the server offers it, falling back to plaintext otherwise.
|
|
case prefer
|
|
|
|
/// Connect only over TLS, refusing the connection when the server offers none.
|
|
///
|
|
/// - Important: the refusal is not yet enforced — until it is, `require` behaves like ``prefer`` and silently falls back to plaintext when the
|
|
/// server offers no TLS.
|
|
case require
|
|
|
|
}
|
|
|
|
// MARK: - Properties
|
|
|
|
extension TLS {
|
|
|
|
/// The NIO TLS configuration passed to the MySQL driver for this posture.
|
|
///
|
|
/// Returns `nil` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``.
|
|
///
|
|
/// - Note: the driver gives a supplied configuration ``prefer`` semantics natively — it upgrades to TLS only when the server advertises support,
|
|
/// and continues in plaintext otherwise — so `prefer` is fully enforced. `require` maps to the same configuration and therefore currently
|
|
/// behaves like ``prefer``: the refusal when the server offers no TLS is not yet enforced.
|
|
var tlsConfiguration: TLSConfiguration? {
|
|
switch self {
|
|
case .off: nil
|
|
default: .makeClientConfiguration()
|
|
}
|
|
}
|
|
|
|
}
|