@malloy-publisher/server 0.0.218 → 0.0.219

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.0.218",
+   "version": "0.0.219",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"

package/src/service/connection.spec.ts

@@ -1,10 +1,12 @@
 import { DuckDBConnection } from "@malloydata/db-duckdb";
 import { afterEach, beforeEach, describe, expect, it } from "bun:test";
 import fs from "fs/promises";
+import os from "os";
 import path from "path";
 import sinon from "sinon";
 import { components } from "../api";
 import {
+   buildProxiedSslQuery,
    createEnvironmentConnections,
    testConnectionConfig,
 } from "./connection";
@@ -1846,3 +1848,71 @@ describe("connection integration tests", () => {
       );
    });
 });
+
+describe("buildProxiedSslQuery", () => {
+   const ORIG_CA = process.env.NODE_EXTRA_CA_CERTS;
+   afterEach(() => {
+      if (ORIG_CA === undefined) delete process.env.NODE_EXTRA_CA_CERTS;
+      else process.env.NODE_EXTRA_CA_CERTS = ORIG_CA;
+   });
+
+   it("defaults to no-verify when sslmode is unset (force-SSL target isn't rejected for plaintext)", () => {
+      expect(buildProxiedSslQuery("conn")).toBe("?sslmode=no-verify");
+   });
+
+   it("returns no-verify for explicit no-verify", () => {
+      expect(buildProxiedSslQuery("conn", "no-verify")).toBe(
+         "?sslmode=no-verify",
+      );
+   });
+
+   it("emits an explicit sslmode=disable, never an empty query", () => {
+      // Regression: an empty query lets pg fall back to the deployment's PGSSLMODE
+      // env, which would verify and fail the 127.0.0.1 hostname check.
+      expect(buildProxiedSslQuery("conn", "disable")).toBe("?sslmode=disable");
+   });
+
+   it("builds a chain-verifying, hostname-skipped query for verify-ca", () => {
+      process.env.NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/rds bundle.pem";
+      const q = buildProxiedSslQuery("conn", "verify-ca");
+      expect(q).toContain("uselibpqcompat=true");
+      expect(q).toContain("sslmode=verify-ca");
+      expect(q).toContain(
+         `sslrootcert=${encodeURIComponent("/etc/ssl/certs/rds bundle.pem")}`,
+      );
+   });
+
+   it("throws for verify-ca when no CA bundle is available", () => {
+      delete process.env.NODE_EXTRA_CA_CERTS;
+      expect(() => buildProxiedSslQuery("conn", "verify-ca")).toThrow(
+         /no trusted CA bundle/i,
+      );
+   });
+
+   it("throws for an unsupported sslmode", () => {
+      expect(() => buildProxiedSslQuery("conn", "require")).toThrow(
+         /unsupported sslmode/i,
+      );
+   });
+
+   it("verify-ca connectionString parses to an ssl config (pg-connection-string version guard)", async () => {
+      // uselibpqcompat=true (pg-connection-string >= 2.7) is what turns verify-ca
+      // into "verify chain, skip hostname". If pg is ever downgraded below that
+      // floor, sslmode would be ignored — this guard fails loudly instead.
+      const caPath = path.join(os.tmpdir(), `proxy-ca-${process.pid}.pem`);
+      await fs.writeFile(
+         caPath,
+         "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n",
+      );
+      process.env.NODE_EXTRA_CA_CERTS = caPath;
+      try {
+         const q = buildProxiedSslQuery("conn", "verify-ca");
+         const { parse } = await import("pg-connection-string");
+         const parsed = parse(`postgresql://127.0.0.1:5432/db${q}`);
+         expect(parsed.ssl).toBeTruthy();
+         expect(typeof parsed.ssl).toBe("object");
+      } finally {
+         await fs.rm(caPath, { force: true });
+      }
+   });
+});

package/src/service/connection.ts

@@ -925,6 +925,44 @@ function buildSnowflakePrivateKeyConnection(
    });
 }
 
+// TLS mode for a proxied postgres connection, as `pg` connectionString query
+// params. @malloydata/db-postgres exposes no ssl config, but it forwards a
+// connectionString straight to pg — which parses sslmode. The tunnel terminates
+// at 127.0.0.1, so pg's hostname check can't apply: `verify-ca` validates the
+// cert chain against the trusted CA bundle (NODE_EXTRA_CA_CERTS, e.g. the baked
+// Amazon RDS roots) WITHOUT the hostname; `no-verify` encrypts without checking;
+// `disable` uses no TLS. Full verify-full through a tunnel needs a servername
+// override (a raw ssl object) — awaits an upstream passthrough (malloydata/malloy#2960).
+export function buildProxiedSslQuery(name: string, sslmode?: string): string {
+   const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+   // Default: encrypt (no-verify) so a force-SSL target (the common RDS case)
+   // isn't rejected for plaintext. Operators opt up to verify-ca when the
+   // target's CA is in the trust bundle, or down to disable for non-TLS DBs.
+   const mode = sslmode ?? "no-verify";
+   switch (mode) {
+      case "disable":
+         // Explicit: with no sslmode in the connectionString, pg falls back to
+         // the PGSSLMODE env (set on the non-proxied path), which would verify
+         // and fail the 127.0.0.1 hostname check. Force plaintext explicitly.
+         return "?sslmode=disable";
+      case "no-verify":
+         return "?sslmode=no-verify";
+      case "verify-ca":
+         // Env-set backstop; validateConnectionShape does the readable-file check
+         // at config load (so a bad bundle fails fast instead of at connect time).
+         if (!caBundle) {
+            throw new Error(
+               `Connection proxy on '${name}' uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset). Add the CA bundle to the image or use sslmode 'no-verify'.`,
+            );
+         }
+         return `?uselibpqcompat=true&sslmode=verify-ca&sslrootcert=${encodeURIComponent(caBundle)}`;
+      default:
+         throw new Error(
+            `Connection proxy on '${name}' has unsupported sslmode '${mode}' (expected disable | no-verify | verify-ca).`,
+         );
+   }
+}
+
 function buildProxiedPostgresConnection(
    metadata: EnvironmentConnectionMetadata,
    endpoint: ProxyEndpoint,
@@ -936,13 +974,20 @@ function buildProxiedPostgresConnection(
          `Proxied connection '${name}' has type 'postgres' but no postgresConnection config.`,
       );
    }
+   // Build a connectionString to the LOCAL tunnel endpoint carrying the TLS mode.
+   // This is NOT the tenant's connectionString (rejected in validateConnectionShape
+   // because it can't be tunneled) — we construct it ourselves and it targets
+   // 127.0.0.1:<localport>, so there's no ambiguity about where it connects.
+   const enc = encodeURIComponent;
+   const auth = pg.userName
+      ? `${enc(pg.userName)}${pg.password ? `:${enc(pg.password)}` : ""}@`
+      : "";
+   const db = pg.databaseName ? `/${enc(pg.databaseName)}` : "";
+   const ssl = buildProxiedSslQuery(name, pg.sslmode);
+   const connectionString = `postgresql://${auth}${endpoint.host}:${endpoint.port}${db}${ssl}`;
    return new PooledPostgresConnection({
       name,
-      host: endpoint.host,
-      port: endpoint.port,
-      username: pg.userName,
-      password: pg.password,
-      databaseName: pg.databaseName,
+      connectionString,
       // Pool sizing mirrors buildSnowflakePrivateKeyConnection.
       poolMin: 1,
       poolMax: 20,

package/src/service/connection_config.spec.ts

@@ -464,4 +464,142 @@ describe("SSH proxy validation", () => {
          "requires explicit host and port",
       );
    });
+
+   it("accepts a multi-line hostKey and sslmode=no-verify", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         postgresConnection: {
+            ...validSshProxy.postgresConnection!,
+            sslmode: "no-verify",
+         },
+         proxy: {
+            type: "ssh",
+            ssh: {
+               ...validSshProxy.proxy!.ssh!,
+               hostKey:
+                  "bastion ssh-ed25519 AAAAdecoy\nbastion ssh-rsa AAAAreal",
+            },
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).not.toThrow();
+   });
+
+   it("rejects a hostKey that parses to zero keys (comment/blank only) — fail-closed at config load", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         proxy: {
+            type: "ssh",
+            ssh: {
+               ...validSshProxy.proxy!.ssh!,
+               hostKey: "# ssh-keyscan bastion timed out\n   \n",
+            },
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "no usable host-key line",
+      );
+   });
+
+   it("rejects a whitespace-only hostKey (must not silently connect unpinned)", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         proxy: {
+            type: "ssh",
+            ssh: {
+               ...validSshProxy.proxy!.ssh!,
+               hostKey: "   ",
+            },
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "no usable host-key line",
+      );
+   });
+
+   it("treats an empty-string hostKey as unpinned (omission-equivalent)", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         proxy: {
+            type: "ssh",
+            ssh: { ...validSshProxy.proxy!.ssh!, hostKey: "" },
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).not.toThrow();
+   });
+
+   it("rejects an unsupported sslmode", () => {
+      const conn = {
+         ...validSshProxy,
+         postgresConnection: {
+            ...validSshProxy.postgresConnection!,
+            sslmode: "require",
+         },
+      } as unknown as ApiConnection;
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "unsupported sslmode 'require'",
+      );
+   });
+
+   it("rejects an empty-string sslmode at config load (not deferred to connect)", () => {
+      const conn = {
+         ...validSshProxy,
+         postgresConnection: {
+            ...validSshProxy.postgresConnection!,
+            sslmode: "",
+         },
+      } as unknown as ApiConnection;
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "unsupported sslmode",
+      );
+   });
+
+   it("rejects sslmode=verify-ca when no CA bundle is available", () => {
+      const prior = process.env.NODE_EXTRA_CA_CERTS;
+      delete process.env.NODE_EXTRA_CA_CERTS;
+      try {
+         const conn: ApiConnection = {
+            ...validSshProxy,
+            postgresConnection: {
+               ...validSshProxy.postgresConnection!,
+               sslmode: "verify-ca",
+            },
+         };
+         expect(() => assembleEnvironmentConnections([conn])).toThrow(
+            "verify-ca",
+         );
+      } finally {
+         if (prior !== undefined) process.env.NODE_EXTRA_CA_CERTS = prior;
+      }
+   });
+
+   it("rejects sslmode set on a non-proxied connection (silent-ignore footgun)", () => {
+      const conn: ApiConnection = {
+         name: "pg-direct",
+         type: "postgres",
+         postgresConnection: {
+            host: "db.example.com",
+            port: 5432,
+            databaseName: "mydb",
+            userName: "user",
+            password: "pass",
+            sslmode: "verify-ca",
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "only supported for proxied connections",
+      );
+   });
+
+   it("rejects a proxied database name with URI-reserved characters", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         postgresConnection: {
+            ...validSshProxy.postgresConnection!,
+            databaseName: "sales@prod",
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "URI-reserved characters",
+      );
+   });
 });

package/src/service/connection_config.ts

@@ -1,10 +1,18 @@
 import { createPrivateKey } from "crypto";
+import { existsSync } from "fs";
 import path from "path";
 import { components } from "../api";
+import { parseHostKeys } from "./proxy";
 
 type ApiConnection = components["schemas"]["Connection"];
 type AttachedDatabase = components["schemas"]["AttachedDatabase"];
 
+// TLS modes accepted on a proxied postgres connection. Canonical here (rather
+// than in connection.ts, which imports this module) so both the config-load
+// validator and the connect-time builder derive from one list. Mirrors the
+// `sslmode` enum in api-doc.yaml.
+export const PROXIED_SSLMODES = ["disable", "no-verify", "verify-ca"] as const;
+
 export type CoreConnectionEntry = {
    is: string;
    [key: string]: unknown;
@@ -265,8 +273,11 @@ function validateConnectionShape(connection: ApiConnection): void {
       // authorized by whoever configures the connection — deliberately NOT gated
       // by an env flag, and kept separate from the `publisher` HTTP multi-hop
       // type's PUBLISHER_ALLOW_PROXY_CONNECTIONS gate below (that flag is about
-      // publisher-to-publisher proxying, a distinct operator decision). Host-key
-      // pinning is fail-closed at connect time (see openProxy).
+      // publisher-to-publisher proxying, a distinct operator decision). Optional
+      // host-key pinning is fail-closed at connect time when configured (see
+      // openProxy); the proxy-specific fields are validated up front below so a
+      // permanent misconfig fails at config load, not by repeatedly dialing the
+      // tenant's bastion at query time.
       if (connection.proxy.type !== "ssh") {
          throw new Error(
             `Connection '${connection.name}' has an unsupported proxy type '${connection.proxy.type}'. Only 'ssh' is supported.`,
@@ -303,6 +314,74 @@ function validateConnectionShape(connection: ApiConnection): void {
                `postgres connection; the connectionString form is not supported with a proxy.`,
          );
       }
+
+      // hostKey is optional (omitted or empty string => connect unpinned), but a
+      // non-empty hostKey that parses to zero keys — only blank lines, whitespace,
+      // or `#` comments, e.g. a paste that grabbed just ssh-keyscan's
+      // `# host:port ...` header — is a misconfigured pin, not a licence to
+      // connect unverified. Reject it here so the operator gets a config error
+      // instead of a silently unpinned tunnel. (Truthiness, not trim(): "" is the
+      // unpinned signal; "   " is a non-empty value that must yield a key.)
+      const hostKey = connection.proxy.ssh?.hostKey;
+      if (hostKey && parseHostKeys(hostKey).size === 0) {
+         throw new Error(
+            `Connection proxy on '${connection.name}' has a hostKey with no usable host-key line ` +
+               `(only blanks/comments). Provide an OpenSSH known_hosts line or base64 blob, or omit ` +
+               `hostKey to connect unpinned.`,
+         );
+      }
+
+      // Validate the proxied TLS mode up front. The tunnel is dialed lazily on
+      // first lookup and a failed build is retried on every subsequent query, so
+      // a permanent sslmode misconfig left to throw at connect time would re-dial
+      // the tenant's bastion indefinitely. Fail at config load instead.
+      // `!= null` (not truthiness) so a present-but-empty sslmode ("") is caught
+      // here as unsupported rather than slipping through to fail at tunnel-build;
+      // null/undefined mean unset (server applies the default).
+      const sslmode = connection.postgresConnection?.sslmode;
+      if (sslmode != null) {
+         if (!(PROXIED_SSLMODES as readonly string[]).includes(sslmode)) {
+            throw new Error(
+               `Connection proxy on '${connection.name}' has unsupported sslmode '${sslmode}' ` +
+                  `(expected ${PROXIED_SSLMODES.join(" | ")}).`,
+            );
+         }
+         if (sslmode === "verify-ca") {
+            const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+            if (!caBundle || !existsSync(caBundle)) {
+               throw new Error(
+                  `Connection proxy on '${connection.name}' uses sslmode 'verify-ca' but no readable ` +
+                     `CA bundle is available (NODE_EXTRA_CA_CERTS is unset or points at a missing file). ` +
+                     `Add the CA bundle to the image or use sslmode 'no-verify'.`,
+               );
+            }
+         }
+      }
+
+      // The proxied path builds a connectionString to the local tunnel endpoint;
+      // pg decodes the database path with decodeURI, which leaves URI-reserved
+      // characters percent-encoded — so a db name containing them would resolve
+      // to the wrong database. Reject it clearly rather than failing later with a
+      // confusing "database does not exist". (user/password use decodeURIComponent
+      // on parse and round-trip fine.)
+      const dbName = connection.postgresConnection?.databaseName;
+      if (dbName && decodeURI(encodeURIComponent(dbName)) !== dbName) {
+         throw new Error(
+            `Connection proxy on '${connection.name}' has a database name with characters that can't ` +
+               `be carried over a proxied connection (${JSON.stringify(dbName)}). Use a database name ` +
+               `without URI-reserved characters (; , / ? : @ & = + $ #).`,
+         );
+      }
+   }
+
+   // sslmode is only honored on the proxied path (the direct path builds TLS from
+   // the deployment PGSSLMODE). Reject it on a non-proxied connection so a tenant
+   // who sets it doesn't silently get a different TLS posture than they asked for.
+   if (!connection.proxy && connection.postgresConnection?.sslmode) {
+      throw new Error(
+         `Connection '${connection.name}' sets postgresConnection.sslmode but has no proxy; sslmode is ` +
+            `only supported for proxied connections (direct connections use the deployment PGSSLMODE).`,
+      );
    }
 
    switch (connection.type) {

package/src/service/proxy.spec.ts

@@ -300,39 +300,69 @@ describe("openProxy — SSH tunnel", () => {
             },
             { host: "127.0.0.1", port: echoServer.port },
          ),
-      ).rejects.toThrow(/host-key mismatch/i);
+      ).rejects.toThrow(/host-key verification failed/i);
    });
 
-   it("rejects when hostKey is absent and opt-out env is not set", async () => {
-      const orig = process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY;
-      delete process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY;
-
+   it("connects when hostKey is absent — unpinned self-service default", async () => {
+      // No hostKey → connect without host-key verification (the SSH transport is
+      // still encrypted). Matches mainstream BI tools' SSH-tunnel default.
+      const ep = await openProxy(
+         {
+            type: "ssh",
+            ssh: {
+               host: "127.0.0.1",
+               port: sshServer.port,
+               username: "testuser",
+               privateKey: clientPrivatePem,
+            },
+         },
+         { host: "127.0.0.1", port: echoServer.port },
+      );
       try {
-         await expect(
-            openProxy(
-               {
-                  type: "ssh",
-                  ssh: {
-                     host: "127.0.0.1",
-                     port: sshServer.port,
-                     username: "testuser",
-                     privateKey: clientPrivatePem,
-                  },
-               },
-               { host: "127.0.0.1", port: echoServer.port },
-            ),
-         ).rejects.toThrow(/no hostKey provided/i);
+         const reply = await connectAndSend(ep.port, "unpinned");
+         expect(reply).toContain("unpinned");
       } finally {
-         if (orig !== undefined) {
-            process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY = orig;
-         }
+         await closeQuietly(() => ep.close());
       }
    });
 
-   it("connects when hostKey is absent and opt-out env is set", async () => {
-      process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY = "true";
+   it("accepts a multi-line hostKey listing several keys — matches any (LB bastion)", async () => {
+      // A load-balanced bastion presents a different host key per backend, so the
+      // pin lists every backend's key and any match is accepted.
+      const decoy = Buffer.alloc(32, 0xff).toString("base64");
+      const multiKey = [
+         `bastion.example.com ssh-ed25519 ${decoy}`,
+         `bastion.example.com ssh-rsa ${sshServer.hostKeyBase64}`,
+      ].join("\n");
+      const ep = await openProxy(
+         {
+            type: "ssh",
+            ssh: {
+               host: "127.0.0.1",
+               port: sshServer.port,
+               username: "testuser",
+               privateKey: clientPrivatePem,
+               hostKey: multiKey,
+            },
+         },
+         { host: "127.0.0.1", port: echoServer.port },
+      );
       try {
-         const ep = await openProxy(
+         const reply = await connectAndSend(ep.port, "multi-key");
+         expect(reply).toContain("multi-key");
+      } finally {
+         await closeQuietly(() => ep.close());
+      }
+   });
+
+   it("fails closed when hostKey is set but parses to zero keys (comment/blank only)", async () => {
+      // A set-but-degenerate pin must NOT fall through to the unpinned branch —
+      // the security boundary is gated on hostKey being configured, not on it
+      // parsing to >=1 key. (Config load rejects this earlier; this guards the
+      // boundary itself.)
+      const commentOnly = "# ssh-keyscan bastion.example.com timed out\n   \n";
+      await expect(
+         openProxy(
             {
                type: "ssh",
                ssh: {
@@ -340,19 +370,36 @@ describe("openProxy — SSH tunnel", () => {
                   port: sshServer.port,
                   username: "testuser",
                   privateKey: clientPrivatePem,
+                  hostKey: commentOnly,
                },
             },
             { host: "127.0.0.1", port: echoServer.port },
-         );
-         try {
-            const reply = await connectAndSend(ep.port, "allow-unknown");
-            expect(reply).toContain("allow-unknown");
-         } finally {
-            await closeQuietly(() => ep.close());
-         }
-      } finally {
-         delete process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY;
-      }
+         ),
+      ).rejects.toThrow(/host-key verification failed/i);
+   });
+
+   it("rejects a multi-line hostKey when none of the listed keys match", async () => {
+      const decoy1 = Buffer.alloc(32, 0xff).toString("base64");
+      const decoy2 = Buffer.alloc(32, 0xaa).toString("base64");
+      const multiKey = [
+         `bastion.example.com ssh-ed25519 ${decoy1}`,
+         `bastion.example.com ssh-rsa ${decoy2}`,
+      ].join("\n");
+      await expect(
+         openProxy(
+            {
+               type: "ssh",
+               ssh: {
+                  host: "127.0.0.1",
+                  port: sshServer.port,
+                  username: "testuser",
+                  privateKey: clientPrivatePem,
+                  hostKey: multiKey,
+               },
+            },
+            { host: "127.0.0.1", port: echoServer.port },
+         ),
+      ).rejects.toThrow(/host-key verification failed/i);
    });
 
    it("rejects for unsupported proxy type", async () => {