fix(postgres): support client certificate authentication (mTLS)

[adisusilayasa]

Description

Fixes PostgreSQL TLS connections when client certificates (ssl_cert) and private keys (ssl_key) are provided.

Previously, build_postgres_tls_connector in src-tauri/src/pool_manager.rs hardcoded .with_no_client_auth() across all SSL modes, causing PostgreSQL servers requiring client-side certificate authentication (e.g. Google Cloud SQL with mTLS enabled) to reject connections with connection requires a valid client certificate.

Changes

• Added load_client_auth_from_pem to parse client certificates and private keys from PEM files using rustls_pemfile.
• Updated build_postgres_tls_connector to attach client credentials via .with_client_auth_cert(...) when ssl_cert and ssl_key are supplied.
• Included ssl_cert and ssl_key in build_connection_key for PostgreSQL connection pool keying.
• Added unit tests covering client certificate loading, connector configuration, and pool key changes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (35 files)

Rust (backend)

• src-tauri/src/connection_migrations.rs — new path-based migration module (GUI + --mcp)
• src-tauri/src/connection_migrations_tests.rs
• src-tauri/src/commands.rs — thinned to wrapper delegating to shared core
• src-tauri/src/persistence.rs — split out parse_connections_file
• src-tauri/src/mcp/mod.rs — runs SSL-mode migration on MCP startup
• src-tauri/src/pool_manager.rs — skip client auth + pool key cert/key when SSL disabled
• src-tauri/src/pool_manager_tests.rs
• src-tauri/src/config.rs — safety_confirmation_delay_enabled setting
• src-tauri/src/lib.rs

TypeScript / React (frontend)

• src/hooks/useQueryGuards.ts — new composed production-first guard
• src/hooks/useDangerousQueryGuard.ts — enabled flag
• src/utils/queryGuard.ts — guard pipeline
• src/utils/environment.ts — isProductionConnection
• src/contexts/ProductionGuardContext.tsx — 5s countdown on production confirm
• src/contexts/SettingsContext.ts
• src/components/settings/GeneralTab.tsx
• src/components/notebook/NotebookView.tsx
• src/pages/Editor.tsx

i18n locales (12)

• de, en, es, fr, it, ja, ko, pt-BR, ru, tl, zh

Tests

• tests/contexts/ProductionGuardContext.test.tsx
• tests/contexts/SettingsProvider.test.tsx
• tests/hooks/useDangerousQueryGuard.test.ts
• tests/hooks/useQueryGuards.test.ts
• tests/utils/environment.test.ts
• tests/utils/queryGuard.test.ts

Previous Review Summary (commit 6bb4e9b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 6bb4e9b)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• src-tauri/Cargo.lock
• src-tauri/src/pool_manager.rs
• src-tauri/src/pool_manager_tests.rs

---

_{Reviewed by glm-5.2 · Input: 96.9K · Output: 19.3K · Cached: 918.1K}

[debba]

Hi @adisusilayasa

Tested this locally against a Postgres 16 container with clientcert=verify-full in pg_hba.conf, which reproduces the Cloud SQL failure mode from the description. The fix works: without a client cert the server rejects with "connection requires a valid client certificate", with cert and key it connects and queries fine, and a cert signed by a different CA gets rejected as expected. All 66 pool_manager tests pass on the branch, including the new ones.

One edge case worth addressing before merge: build_postgres_tls_connector runs unconditionally, so with ssl_mode=disable the new code still reads and validates the cert/key files even though TLS is never negotiated (the pg config maps disable to PgSslMode::Disable). The connection modal hides the cert fields when SSL is disabled but doesn't clear them, so a connection that once had a client cert configured and was later switched to disable will now fail to connect if the PEM files were moved or deleted, or if only one of the two fields is set. Before this change those fields were simply ignored for postgres, so this is a small behavior regression. Skipping client auth loading when the mode is disable would restore the old behavior there:

let client_auth = if ssl_mode == "disable" {
    None
} else {
    match (user_cert, user_key) {
        // ...
    }
};

Small nit on test_load_client_auth_from_pem_valid: it writes fixed filenames into env::temp_dir(), so two test runs on the same machine can collide, and the cleanup lines never run if an assertion fails earlier. Using the tempfile crate would handle both.

Nothing else blocking from my side, the rest looks good.

[adisusilayasa]

Thanks @debba! Updated:

• Skipped client certificate & key loading when ssl_mode == "disable" (and ignored cert/key in the connection pool key when SSL is disabled).
• Updated test_load_client_auth_from_pem_valid to use tempfile::tempdir() for test isolation and auto-cleanup.
• Added tests verifying disabled SSL mode ignores client cert/key parameters and connection pool keys.

[debba]

@adisusilayasa Thank you for addressing the requested changes! Everything looks good now, so I’ll proceed with the merge.

You’re more than welcome to keep contributing to Tabularis. If you’d like, you can also join us on Discord — we’d be happy to have you there!