@superblocksteam/shared 0.9598.1 → 0.9599.0

package/src/database-lifecycle/index.test.ts

@@ -3,10 +3,14 @@ import { describe, expect, test } from 'vitest';
 import {
   computeBindingKey,
   computeDesiredSpecHash,
+  computeNativeDbApplicationToken,
+  computeNativeDbDatabaseName,
   computeRequirementKey,
   containsCredentialMaterial,
   isSecretKey,
   isTerminalLifecycleState,
+  nativeDbIamSessionPolicy,
+  parseNativeDbIamDescriptor,
   redactLifecycleSecrets
 } from './index.js';
 
@@ -26,24 +30,25 @@ describe('database lifecycle contracts', () => {
     expect(computeRequirementKey(requirement)).toBe('orders-db~Orders%20DB:postgres');
     expect(computeRequirementKey({ logicalName: 'orders/db', engine: 'postgres' })).toBe('orders-db~orders%2Fdb:postgres');
     expect(computeRequirementKey({ logicalName: 'orders-db', engine: 'postgres' })).toBe('orders-db~orders-db:postgres');
+    // binding_key excludes the logical name on purpose: one database per
+    // (organization, application, environment, profile). Two different logical
+    // names under the same profile resolve to the same binding_key.
     expect(
       computeBindingKey({
         organizationId: 'org-1',
         applicationId: 'app-1',
         environment: 'edit',
-        profile: 'Staging EU',
-        requirementKey: 'orders-db~Orders%20DB:postgres'
+        profile: 'Staging EU'
       })
-    ).toBe('org-1:app-1:edit:staging-eu~Staging%20EU:orders-db~Orders%20DB:postgres');
+    ).toBe('org-1:app-1:edit:staging-eu~Staging%20EU');
     expect(
       computeBindingKey({
         organizationId: 'org-1',
         applicationId: 'app-1',
         environment: 'edit',
-        profile: 'staging',
-        requirementKey: 'orders-db~Orders%20DB:postgres'
+        profile: 'staging'
       })
-    ).toBe('org-1:app-1:edit:staging~staging:orders-db~Orders%20DB:postgres');
+    ).toBe('org-1:app-1:edit:staging~staging');
 
     await expect(computeDesiredSpecHash(requirement)).resolves.toBe(
       await computeDesiredSpecHash({ ...requirement, extensions: ['uuid-ossp', 'pgcrypto'] })
@@ -51,6 +56,25 @@ describe('database lifecycle contracts', () => {
     await expect(computeDesiredSpecHash(requirement)).resolves.toBe('QsCl6RVzJVEwf4Nuk0D27rRtycYe2vQZMxcXLt9WUkQ=');
   });
 
+  test('ignores migrationDirectory when hashing the desired spec', async () => {
+    const infrastructureSpec = {
+      logicalName: 'Orders DB',
+      engine: 'postgres',
+      version: '16',
+      sizing: { storageGb: 20, tier: 'shared' },
+      extensions: ['pgcrypto', 'uuid-ossp']
+    } as const;
+
+    const withoutDirectory = await computeDesiredSpecHash(infrastructureSpec);
+    const withDirectory = await computeDesiredSpecHash({ ...infrastructureSpec, migrationDirectory: 'db/migrations' });
+    const withOtherDirectory = await computeDesiredSpecHash({ ...infrastructureSpec, migrationDirectory: 'db/other-migrations' });
+
+    // migrationDirectory only says where the SQL files live, not what
+    // infrastructure to provision, so changing it must not look like drift.
+    expect(withDirectory).toBe(withoutDirectory);
+    expect(withOtherDirectory).toBe(withoutDirectory);
+  });
+
   test('hashes desired specs with locale-invariant ordering', async () => {
     const first = await computeDesiredSpecHash({
       logicalName: 'Éclair DB',
@@ -129,4 +153,81 @@ describe('database lifecycle contracts', () => {
     expect(containsCredentialMaterial('host=db.internal port=5432')).toBe(false);
     expect(containsCredentialMaterial('arn:aws:secretsmanager:us-east-1:123:secret:orders')).toBe(false);
   });
+
+  test('builds a canonical session policy from a valid managed Postgres IAM descriptor', () => {
+    const descriptor = parseNativeDbIamDescriptor({
+      application_id: 'application-id',
+      auth_descriptor_version: 1,
+      auth_mode: 'aws_iam_role',
+      aws_account_id: '123456789012',
+      binding_id: 'binding-id',
+      cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
+      connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
+      database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+      host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
+      port: 5432,
+      region: 'us-west-2',
+      username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
+    });
+
+    expect(descriptor).toBeDefined();
+    if (!descriptor) {
+      throw new Error('Expected a valid IAM descriptor');
+    }
+    expect(nativeDbIamSessionPolicy(descriptor)).toBe(
+      '{"Version":"2012-10-17","Statement":[{"Sid":"ConnectToThisNativeDatabaseUser","Effect":"Allow","Action":"rds-db:connect","Resource":"arn:aws:rds-db:us-west-2:123456789012:dbuser:cluster-ABC123DEF456EXAMPLE/sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime"}]}'
+    );
+  });
+
+  test('rejects malformed or non-commercial managed Postgres IAM descriptors', () => {
+    const descriptor = {
+      application_id: 'application-id',
+      auth_descriptor_version: 1,
+      auth_mode: 'aws_iam_role',
+      aws_account_id: '123456789012',
+      binding_id: 'binding-id',
+      cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
+      connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
+      database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+      host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
+      port: 5432,
+      region: 'us-west-2',
+      username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
+    };
+
+    expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 2 })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, cluster_resource_id: 'not-an-rds-resource' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, connector_role_arn: 'arn:aws:iam::210987654321:role/other' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, database: 'orders' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, host: descriptor.host.toUpperCase() })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, host: 'native-db.cluster-example.us-east-1.rds.amazonaws.com' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, port: 0 })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'cn-north-1' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'us-gov-west-1' })).toBeUndefined();
+    expect(parseNativeDbIamDescriptor({ ...descriptor, username: 'sbndb_000000000000_7bfeae1170db923274f1943f_runtime' })).toBeUndefined();
+  });
+
+  test('accepts standalone RDS IAM resource IDs', () => {
+    expect(
+      parseNativeDbIamDescriptor({
+        application_id: 'application-id',
+        auth_descriptor_version: 1,
+        auth_mode: 'aws_iam_role',
+        aws_account_id: '123456789012',
+        binding_id: 'binding-id',
+        cluster_resource_id: 'db-ABCDEF0123456789-1',
+        connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
+        database: 'sbndb_abcdef123456_0123456789abcdef01234567',
+        host: 'native-db.example.us-west-2.rds.amazonaws.com',
+        port: 5432,
+        region: 'us-west-2',
+        username: 'sbndb_abcdef123456_7bfeae1170db923274f1943f_runtime'
+      })
+    ).toBeDefined();
+  });
+
+  test('derives canonical IAM database and runtime-user identity tokens', async () => {
+    await expect(computeNativeDbApplicationToken('application-id')).resolves.toBe('7bfeae1170db923274f1943f');
+    await expect(computeNativeDbDatabaseName('abcdef123456', 'database-id')).resolves.toBe('sbndb_abcdef123456_dad72612f7a80580b028178f');
+  });
 });

package/src/database-lifecycle/index.ts

@@ -16,6 +16,11 @@ export const LIFECYCLE_OPERATIONS = ['ensure_database', 'migrate_schema', 'retir
 export const LIFECYCLE_ENVIRONMENTS = ['edit', 'preview', 'deployed'] as const;
 export const DATABASE_ENGINES = ['postgres', 'snowflake', 'snowflake_postgres', 'lakebase'] as const;
 export const DATABASE_LIFECYCLE_MANAGED_BY = 'database_lifecycle';
+export const NATIVE_DB_AUTH_DESCRIPTOR_VERSION = 1 as const;
+export const NATIVE_DB_CONNECTOR_ROLE_NAME_PREFIX = 'superblocks-native-db-connector';
+export const NATIVE_DB_IAM_AUTH_MODE = 'aws_iam_role' as const;
+export const NATIVE_DB_IDENTIFIER_HASH_DOMAIN = 'superblocks-native-db:v1';
+export const DATABASE_LIFECYCLE_CAPABILITY_MANAGED_IAM_V1 = 'managed-IAM-v1';
 
 // Agent capability tag keys. A lifecycle worker publishes these in the
 // `tags` map of its agent registration (merged into — never replacing — the
@@ -28,6 +33,7 @@ export const DATABASE_LIFECYCLE_MANAGED_BY = 'database_lifecycle';
 export const DATABASE_LIFECYCLE_TAG_OPERATIONS = 'databaseLifecycle:operations';
 export const DATABASE_LIFECYCLE_TAG_ENGINES = 'databaseLifecycle:engines';
 export const DATABASE_LIFECYCLE_TAG_ENVIRONMENT_PROFILES = 'databaseLifecycle:environmentProfiles';
+export const DATABASE_LIFECYCLE_TAG_CAPABILITIES = 'databaseLifecycle:capabilities';
 
 export type LifecycleEnvironment = (typeof LIFECYCLE_ENVIRONMENTS)[number];
 export type DatabaseEngine = (typeof DATABASE_ENGINES)[number];
@@ -60,6 +66,21 @@ export type CredentialRef = {
   field?: string;
 };
 
+export type NativeDbIamDescriptor = {
+  application_id: string;
+  auth_descriptor_version: typeof NATIVE_DB_AUTH_DESCRIPTOR_VERSION;
+  auth_mode: typeof NATIVE_DB_IAM_AUTH_MODE;
+  aws_account_id: string;
+  binding_id: string;
+  cluster_resource_id: string;
+  connector_role_arn: string;
+  database: string;
+  host: string;
+  port: number;
+  region: string;
+  username: string;
+};
+
 export type DatabaseRequirement = {
   logicalName: string;
   engine: DatabaseEngine;
@@ -177,6 +198,8 @@ export type LifecycleDispatchContinuation = {
 // worker's `MigrationState` at the default "pending"; an empty slice means
 // "vacuous truth, mark migrated"; a non-empty slice triggers the runner.
 export type LifecycleDispatchPayload = {
+  applicationId: string;
+  bindingId: string;
   bindingKey: string;
   connectionMetadata?: Record<string, string | number | boolean>;
   continuation?: LifecycleDispatchContinuation;
@@ -196,12 +219,18 @@ export function computeRequirementKey(requirement: Pick<DatabaseRequirement, 'lo
   return `${slugify(requirement.logicalName)}~${encodeURIComponent(requirement.logicalName)}:${requirement.engine}`;
 }
 
+// binding_key is the product identity of a database in the control plane, and
+// is deliberately scoped to (organization, application, environment, profile)
+// only — NOT the logical name. This is what makes "one database per profile"
+// enforceable by the plain UNIQUE (binding_key) constraint: asking for another
+// database under a different logical name resolves to the same binding_key
+// instead of minting a new one. The logical name still lives on the binding row
+// and in resource_key (physical identity); it just doesn't grant a second slot.
 export function computeBindingKey(input: {
   organizationId: string;
   applicationId: string;
   environment: LifecycleEnvironment;
   profile: string;
-  requirementKey: string;
 }): string {
   return [input.organizationId, ...bindingKeySegments(input)].join(':');
 }
@@ -210,22 +239,114 @@ export function computeLegacyBindingKeyWithoutOrganization(input: {
   applicationId: string;
   environment: LifecycleEnvironment;
   profile: string;
-  requirementKey: string;
 }): string {
   return bindingKeySegments(input).join(':');
 }
 
-function bindingKeySegments(input: {
-  applicationId: string;
-  environment: LifecycleEnvironment;
-  profile: string;
-  requirementKey: string;
-}): string[] {
-  return [input.applicationId, input.environment, `${slugify(input.profile)}~${encodeURIComponent(input.profile)}`, input.requirementKey];
+function bindingKeySegments(input: { applicationId: string; environment: LifecycleEnvironment; profile: string }): string[] {
+  return [input.applicationId, input.environment, `${slugify(input.profile)}~${encodeURIComponent(input.profile)}`];
 }
 
+// Hashes only the infrastructure spec. migrationDirectory is deliberately
+// excluded: it says where the SQL files live, not what database to provision,
+// so changing it must not make a ready binding look drifted and re-dispatch
+// ensure_database. Callers that persist the requirement must still rewrite
+// desiredSpec when migrationDirectory changes (same hash is not "no-op").
+// Specs without a migrationDirectory keep their existing hash.
 export async function computeDesiredSpecHash(requirement: DatabaseRequirement): Promise<string> {
-  return await sha256Base64(JSON.stringify(canonicalize(requirement)));
+  const infrastructureSpec = { ...requirement };
+  delete infrastructureSpec.migrationDirectory;
+  return await sha256Base64(JSON.stringify(canonicalize(infrastructureSpec)));
+}
+
+export function nativeDbIamSessionPolicy(descriptor: NativeDbIamDescriptor): string {
+  return JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Sid: 'ConnectToThisNativeDatabaseUser',
+        Effect: 'Allow',
+        Action: 'rds-db:connect',
+        Resource: `arn:aws:rds-db:${descriptor.region}:${descriptor.aws_account_id}:dbuser:${descriptor.cluster_resource_id}/${descriptor.username}`
+      }
+    ]
+  });
+}
+
+export function parseNativeDbIamDescriptor(value: unknown): NativeDbIamDescriptor | undefined {
+  if (!isUnknownRecord(value)) {
+    return undefined;
+  }
+
+  const databaseIdentifier = typeof value.database === 'string' ? /^sbndb_([0-9a-f]{12})_([0-9a-f]{24})$/.exec(value.database) : null;
+  const usernameIdentifier =
+    typeof value.username === 'string' ? /^sbndb_([0-9a-f]{12})_([0-9a-f]{24})_runtime$/.exec(value.username) : null;
+  const connectorRoleArn =
+    typeof value.connector_role_arn === 'string'
+      ? /^arn:aws:iam::(\d{12}):role\/(?:[\w+=,.@-]+\/)*[\w+=,.@-]+$/.exec(value.connector_role_arn)
+      : null;
+  if (
+    !isNonEmptyString(value.application_id) ||
+    value.auth_descriptor_version !== NATIVE_DB_AUTH_DESCRIPTOR_VERSION ||
+    value.auth_mode !== NATIVE_DB_IAM_AUTH_MODE ||
+    !isNonEmptyString(value.aws_account_id) ||
+    !/^\d{12}$/.test(value.aws_account_id) ||
+    !isNonEmptyString(value.binding_id) ||
+    !isNonEmptyString(value.cluster_resource_id) ||
+    !/^(cluster|db)-[A-Za-z0-9-]+$/.test(value.cluster_resource_id) ||
+    !connectorRoleArn ||
+    connectorRoleArn[1] !== value.aws_account_id ||
+    !databaseIdentifier ||
+    !usernameIdentifier ||
+    databaseIdentifier[1] !== usernameIdentifier[1] ||
+    !isValidNativeDbRdsHostname(value.host, value.region) ||
+    typeof value.port !== 'number' ||
+    !Number.isInteger(value.port) ||
+    value.port < 1 ||
+    value.port > 65535 ||
+    !isCommercialAwsRegion(value.region)
+  ) {
+    return undefined;
+  }
+
+  return {
+    application_id: value.application_id,
+    auth_descriptor_version: NATIVE_DB_AUTH_DESCRIPTOR_VERSION,
+    auth_mode: NATIVE_DB_IAM_AUTH_MODE,
+    aws_account_id: value.aws_account_id,
+    binding_id: value.binding_id,
+    cluster_resource_id: value.cluster_resource_id,
+    connector_role_arn: connectorRoleArn[0],
+    database: databaseIdentifier[0],
+    host: value.host,
+    port: value.port,
+    region: value.region,
+    username: usernameIdentifier[0]
+  };
+}
+
+export async function computeNativeDbApplicationToken(trustedApplicationId: string): Promise<string> {
+  return (await computeNativeDbIdentifierToken('application', trustedApplicationId)).slice(0, 24);
+}
+
+export async function computeNativeDbDatabaseName(deploymentToken: string, trustedDatabaseId: string): Promise<string> {
+  if (!/^[0-9a-f]{12}$/.test(deploymentToken)) {
+    throw new Error('Native database deployment token must be 12 lowercase hexadecimal characters');
+  }
+  return `sbndb_${deploymentToken}_${(await computeNativeDbIdentifierToken('database', trustedDatabaseId)).slice(0, 24)}`;
+}
+
+async function computeNativeDbIdentifierToken(kind: 'application' | 'database', trustedId: string): Promise<string> {
+  if (!isNonEmptyString(trustedId)) {
+    throw new Error(`Trusted native database ${kind} ID must be a non-empty string`);
+  }
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(`${NATIVE_DB_IDENTIFIER_HASH_DOMAIN}:${kind}:${trustedId}`)
+  );
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('');
 }
 
 // resource_key identifies the physical resource a binding maps to in
@@ -292,6 +413,28 @@ function codepointCompare(left: string, right: string): number {
   return 0;
 }
 
+function isCommercialAwsRegion(value: unknown): value is string {
+  return typeof value === 'string' && /^[a-z]{2}-[a-z]+-[0-9]+$/.test(value) && !value.startsWith('cn-') && !value.startsWith('us-gov-');
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function isUnknownRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function isValidNativeDbRdsHostname(host: unknown, region: unknown): host is string {
+  if (typeof host !== 'string' || typeof region !== 'string') {
+    return false;
+  }
+  const suffix = `.${region}.rds.amazonaws.com`;
+  const prefix = host.endsWith(suffix) ? host.slice(0, -suffix.length) : '';
+  const validLabel = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+  return host.length <= 253 && host === host.toLowerCase() && prefix !== '' && host.split('.').every((label) => validLabel.test(label));
+}
+
 function redact(value: unknown, preserveCredentialRefs = false): unknown {
   if (Array.isArray(value)) {
     return value.map((entry) => redact(entry, preserveCredentialRefs));

package/src/plugins/templates/postgres.test.ts

@@ -0,0 +1,231 @@
+import { describe, expect, it } from 'vitest';
+
+import { FormComponentType, getRowItemsFromSectionItem } from '../../types/index.js';
+import { PostgresPlugin } from './postgres.js';
+
+const datasourceItems = PostgresPlugin.datasourceTemplate?.sections.flatMap((section) => section.items.flatMap(getRowItemsFromSectionItem));
+
+const findDatasourceItems = (name: string) => datasourceItems?.filter((item) => item.name === name) ?? [];
+
+describe('Postgres datasource template', () => {
+  it('gates IAM fields only by Postgres plugin version 0.0.13', () => {
+    const iamFieldNames = [
+      'authentication.authType',
+      'authentication.custom.databaseName.value',
+      'authentication.custom.iamRoleArn.value',
+      'authentication.custom.region.value',
+      'authentication.custom.sessionPolicy.value',
+      'authentication.username',
+      'connection.useSsl'
+    ];
+
+    for (const fieldName of iamFieldNames) {
+      const versionThirteenItems = findDatasourceItems(fieldName).filter((item) => item.startVersion === '0.0.13');
+      expect(versionThirteenItems.length).toBeGreaterThan(0);
+      expect(versionThirteenItems.every((item) => item.ldFlag === undefined)).toBe(true);
+    }
+  });
+
+  it('adds the version 0.0.13 authentication method and IAM role fields', () => {
+    expect(findDatasourceItems('authentication.authType')).toEqual([
+      expect.objectContaining({
+        componentType: FormComponentType.DROPDOWN,
+        display: {
+          show: {
+            connectionType: ['fields']
+          }
+        },
+        initialValue: 'password',
+        options: [
+          {
+            displayName: 'Username & password',
+            key: 'password',
+            value: 'password'
+          },
+          {
+            displayName: 'AWS IAM Role',
+            key: 'aws_iam_role',
+            value: 'aws_iam_role'
+          }
+        ],
+        startVersion: '0.0.13'
+      })
+    ]);
+
+    expect(findDatasourceItems('authentication.custom.iamRoleArn.value')).toEqual([
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['aws_iam_role'],
+            connectionType: ['fields']
+          }
+        },
+        rules: [{ message: 'Role ARN is required', required: true }],
+        startVersion: '0.0.13'
+      })
+    ]);
+    expect(findDatasourceItems('authentication.custom.region.value')).toEqual([
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['aws_iam_role'],
+            connectionType: ['fields']
+          }
+        },
+        rules: [{ message: 'Region is required', required: true }],
+        startVersion: '0.0.13'
+      })
+    ]);
+    expect(findDatasourceItems('authentication.custom.sessionPolicy.value')).toEqual([
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['aws_iam_role'],
+            connectionType: ['fields']
+          }
+        },
+        rules: [{ required: false }],
+        startVersion: '0.0.13'
+      })
+    ]);
+  });
+
+  it('keeps username visible and password compatible with legacy configurations', () => {
+    expect(findDatasourceItems('authentication.username')).toEqual([
+      expect.objectContaining({
+        endVersion: '0.0.10',
+        startVersion: '0.0.1'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            connectionType: ['fields']
+          }
+        },
+        endVersion: '0.0.12',
+        startVersion: '0.0.11'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['', 'undefined', 'password'],
+            connectionType: ['fields']
+          }
+        },
+        startVersion: '0.0.13'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['aws_iam_role'],
+            connectionType: ['fields']
+          }
+        },
+        rules: [{ message: 'Database username is required', required: true }],
+        startVersion: '0.0.13'
+      })
+    ]);
+    expect(findDatasourceItems('authentication.password')).toEqual([
+      expect.objectContaining({
+        endVersion: '0.0.10',
+        startVersion: '0.0.1'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            connectionType: ['fields']
+          }
+        },
+        endVersion: '0.0.12',
+        startVersion: '0.0.11'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['', 'undefined', 'password'],
+            connectionType: ['fields']
+          }
+        },
+        startVersion: '0.0.13'
+      })
+    ]);
+  });
+
+  it('requires a database name only for IAM role authentication', () => {
+    expect(findDatasourceItems('authentication.custom.databaseName.value')).toEqual([
+      expect.objectContaining({
+        endVersion: '0.0.10',
+        startVersion: '0.0.1'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            connectionType: ['fields']
+          }
+        },
+        endVersion: '0.0.12',
+        startVersion: '0.0.11'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['', 'undefined', 'password'],
+            connectionType: ['fields']
+          }
+        },
+        startVersion: '0.0.13'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            'authentication.authType': ['aws_iam_role'],
+            connectionType: ['fields']
+          }
+        },
+        rules: [{ message: 'Database name is required', required: true }],
+        startVersion: '0.0.13'
+      })
+    ]);
+  });
+
+  it('requires TLS for IAM role authentication without changing password mode', () => {
+    expect(findDatasourceItems('connection.useSsl')).toEqual([
+      expect.objectContaining({
+        endVersion: '0.0.10',
+        startVersion: '0.0.1'
+      }),
+      expect.objectContaining({
+        display: {
+          show: {
+            connectionType: ['fields']
+          }
+        },
+        endVersion: '0.0.12',
+        startVersion: '0.0.11'
+      }),
+      expect.objectContaining({
+        disabled: false,
+        display: {
+          show: {
+            'authentication.authType': ['', 'undefined', 'password'],
+            connectionType: ['fields']
+          }
+        },
+        initialValue: true,
+        startVersion: '0.0.13'
+      }),
+      expect.objectContaining({
+        disabled: true,
+        display: {
+          show: {
+            'authentication.authType': ['aws_iam_role'],
+            connectionType: ['fields']
+          }
+        },
+        initialValue: true,
+        rules: [{ enum: [true], message: 'SSL is required for AWS IAM role authentication' }],
+        startVersion: '0.0.13'
+      })
+    ]);
+  });
+});