declapract-typescript-ehmpathy 0.49.14 → 0.50.0

package/dist/.test/assets/git/declarations/practices/persist-with-rds/config-validates-schema.declapract.integration.test.ts

@@ -0,0 +1,332 @@
+import { realpathSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
+import { getModuleExportsFromTsSource } from '../../utils/getModuleExportsFromTsSource';
+
+/**
+ * .what = clamps that the config/{test,prep,prod}.json a lambda-service-with-rds apply writes
+ *         parse under the config.schema.ts that same apply writes — for a fresh repo, and for a
+ *         repo that holds its own hand-set values.
+ * .why  = the templates once wrote `tunnel.bastion` / `tunnel.cluster` as strings while the schema
+ *         demands `{ exid }` / `{ name }`, wrote the logical db name where the rds cluster name
+ *         belongs, and the fix swapped the whole `database` subtree so a repo's own keys vanished
+ *         (#638, #523, #562, #539). prep's passwords accept the `__CHANG3_ME__` placeholder its
+ *         provision creates users with (#683). prep and prod tunnel on distinct local ports (#519).
+ * .teeth = restore the string-form bastion/cluster in config/prep.json, or the shallow-spread fix
+ *          in config/prep.json.declapract.ts, and the safeParse and extras-survive cases redden.
+ * .note = the schema is transpiled and run against the zod declapract itself installs (zod is not
+ *         a root dep of this repo); the parse reads what the emitted source returns.
+ */
+
+const ENVS = ['test', 'prep', 'prod'] as const;
+const SCHEMA_PATH = 'src/utils/config/config.schema.ts';
+
+// mount the real practices under `declarations/`, so the apply writes into the temp repo's own src
+const DECLARATIONS_SYMLINKS = [
+  { at: 'declarations/practices', to: 'src/practices' },
+  { at: 'declarations/useCases.yml', to: 'src/useCases.yml' },
+];
+
+// zod, as declapract installs it
+const requireFromDeclapract = createRequire(
+  realpathSync(path.join(process.cwd(), 'node_modules/declapract/package.json')),
+);
+
+type SchemaFound = {
+  apply: { safeParse: (value: unknown) => { success: boolean; error?: unknown } };
+};
+
+/**
+ * .what = transpile an emitted config.schema.ts and return its `schema` export
+ */
+const asSchemaFromSource = (input: { src: string }): SchemaFound => {
+  const requireStub = (id: string): unknown => {
+    if (id === 'zod') return requireFromDeclapract('zod');
+    throw new Error(`unexpected require in config.schema.ts: ${id}`);
+  };
+  const { schema } = getModuleExportsFromTsSource<{ schema: SchemaFound }>({
+    source: input.src,
+    requireStub,
+  });
+  return schema!;
+};
+
+/**
+ * .what = apply one file with each of its two declarers, in declapract's own order (config, then
+ *         persist-with-rds)
+ * .why  = a whole-usecase evaluation per file costs minutes; neither declarer branches on
+ *         `projectPractices`, so a per-practice scope applies the same declarations
+ */
+const applyFile = async (input: { tempDir: string; file: string }) => {
+  for (const practice of ['config', 'persist-with-rds'])
+    await executeApply({
+      config: path.join(input.tempDir, 'declapract.use.yml'),
+      practice,
+      file: input.file,
+    });
+};
+
+/**
+ * .what = apply the three config files and the schema, in that order
+ */
+const applyConfigAndSchema = async (input: { tempDir: string }) => {
+  for (const env of ENVS)
+    await applyFile({ tempDir: input.tempDir, file: `config/${env}.json` });
+  await applyFile({ tempDir: input.tempDir, file: SCHEMA_PATH });
+};
+
+/**
+ * .what = read every config file + the schema off disk
+ */
+const readAll = async (input: {
+  tempDir: string;
+}): Promise<{ configs: Record<string, string>; schemaSrc: string }> => {
+  const configs: Record<string, string> = {};
+  for (const env of ENVS)
+    configs[env] = await fs.readFile(
+      path.join(input.tempDir, `config/${env}.json`),
+      'utf-8',
+    );
+  const schemaSrc = await fs.readFile(
+    path.join(input.tempDir, SCHEMA_PATH),
+    'utf-8',
+  );
+  return { configs, schemaSrc };
+};
+
+/**
+ * .what = the parse outcome of each config under schema.apply
+ */
+const getAllParseOutcomes = (input: {
+  configs: Record<string, string>;
+  schemaSrc: string;
+}) => {
+  const schema = asSchemaFromSource({ src: input.schemaSrc });
+  return ENVS.map((env) => {
+    const result = schema.apply.safeParse(JSON.parse(input.configs[env]!));
+    return { env, success: result.success, error: result.error };
+  });
+};
+
+// whole-usecase evaluation per file runs tens of seconds
+jest.setTimeout(600_000);
+
+describe('persist-with-rds config validates against config.schema.ts (#638, #683, #519)', () => {
+  given('[case1] a fresh repo', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-persist-with-rds-config-schema-fresh',
+      clone: './src/practices/persist-with-rds/.test/assets/demo-repo-config-schema',
+      symlink: DECLARATIONS_SYMLINKS,
+    });
+
+    when('[t0] the configs and the schema are applied, then applied again', () => {
+      const scene = useBeforeAll(async () => {
+        await applyConfigAndSchema({ tempDir });
+        const once = await readAll({ tempDir });
+        await applyConfigAndSchema({ tempDir });
+        const twice = await readAll({ tempDir });
+        return { once, twice };
+      });
+
+      then('each config parses under schema.apply', () => {
+        expect(getAllParseOutcomes(scene.once)).toEqual(
+          ENVS.map((env) => ({ env, success: true, error: undefined })),
+        );
+      });
+
+      then('the tunnel cluster name is the rds cluster, not the db name', () => {
+        for (const env of ['prep', 'prod'] as const) {
+          const config = JSON.parse(scene.once.configs[env]!);
+          expect(config.database.tunnel.cluster).toEqual({ name: 'awesomesdb' });
+          expect(config.database.tunnel.bastion).toEqual({
+            exid: 'vpc-main-bastion',
+          });
+        }
+      });
+
+      then('prep and prod tunnel on distinct local ports, test on localhost (#519)', () => {
+        const portOf = (env: string) =>
+          JSON.parse(scene.once.configs[env]!).database.tunnel.local.port;
+        expect(portOf('prep')).not.toEqual(portOf('prod'));
+        expect(
+          JSON.parse(scene.once.configs.test!).database.tunnel.local.host,
+        ).toEqual('localhost');
+      });
+
+      then('a second apply changes no byte', () => {
+        expect(scene.twice).toEqual(scene.once);
+      });
+
+      then('the configs match snapshot', () => {
+        for (const env of ENVS)
+          expect(scene.once.configs[env]).toMatchSnapshot(
+            `config/${env}.json — after`,
+          );
+      });
+    });
+  });
+
+  given('[case2] a repo with hand-set values and legacy string tunnel fields', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-persist-with-rds-config-schema-handset',
+      clone: './src/practices/persist-with-rds/.test/assets/demo-repo-config-schema',
+      symlink: DECLARATIONS_SYMLINKS,
+    });
+
+    const BEFORE: Record<string, unknown> = {
+      test: {
+        organization: 'test-org',
+        project: 'test-project',
+        environment: { access: 'test' },
+        aws: { account: '111111111111', namespace: 'testns' },
+        featureFlags: { surfReport: true },
+        database: {
+          target: { database: 'testdb', schema: 'testdb' },
+          pool: { max: 3 },
+          role: {
+            cicd: {
+              'for-plan': { username: 'cicd_user', password: '__CHANG3_ME__' },
+              'for-apply': { username: 'cicd_user', password: '__CHANG3_ME__' },
+            },
+            crud: { username: 'service_user', password: '__CHANG3_ME__' },
+          },
+          tunnel: {
+            bastion: 'vpc-main-bastion',
+            cluster: 'testdb',
+            local: { host: 'localhost', port: 7821 },
+            lambda: null,
+          },
+        },
+      },
+      prep: {
+        organization: 'test-org',
+        project: 'test-project',
+        environment: { access: 'prep' },
+        aws: { account: '111111111111', namespace: 'testns' },
+        featureFlags: { surfReport: true },
+        database: {
+          target: { database: 'testdb', schema: 'testdb' },
+          pool: { max: 3 },
+          role: {
+            cicd: {
+              'for-plan': {
+                username: 'cicd_user',
+                password: '$.at(aws::param/test-org/test-project/prep/legacy.plan)',
+              },
+              'for-apply': {
+                username: 'cicd_user',
+                password: '$.at(aws::param)',
+              },
+            },
+            crud: { username: 'service_user', password: '__CHANG3_ME__' },
+          },
+          tunnel: {
+            bastion: { exid: 'vpc-main-bastion' },
+            cluster: { name: 'hand-set-cluster' },
+            local: { host: 'localhost', port: 15432 },
+            lambda: { host: 'cluster.prep.example.com', port: 5432 },
+          },
+        },
+      },
+      prod: {
+        organization: 'test-org',
+        project: 'test-project',
+        environment: { access: 'prod' },
+        aws: { account: '222222222222', namespace: 'testns' },
+        featureFlags: { surfReport: true },
+        database: {
+          target: { database: 'testdb', schema: 'testdb' },
+          pool: { max: 3 },
+          role: {
+            cicd: {
+              'for-plan': { username: 'cicd_user', password: '$.at(aws::param)' },
+              'for-apply': { username: 'cicd_user', password: '$.at(aws::param)' },
+            },
+            crud: { username: 'service_user', password: '$.at(aws::param)' },
+          },
+          tunnel: {
+            bastion: 'vpc-main-bastion',
+            cluster: 'testdb',
+            local: { host: 'localhost', port: 15433 },
+            lambda: { host: 'cluster.prod.example.com', port: 5432 },
+          },
+        },
+      },
+    };
+
+    when('[t0] the configs and the schema are applied, then applied again', () => {
+      const scene = useBeforeAll(async () => {
+        await fs.mkdir(path.join(tempDir, 'config'), { recursive: true });
+        for (const env of ENVS)
+          await fs.writeFile(
+            path.join(tempDir, `config/${env}.json`),
+            `${JSON.stringify(BEFORE[env], null, 2)}\n`,
+          );
+        const beforeConfigs: Record<string, string> = {};
+        for (const env of ENVS)
+          beforeConfigs[env] = await fs.readFile(
+            path.join(tempDir, `config/${env}.json`),
+            'utf-8',
+          );
+        await applyConfigAndSchema({ tempDir });
+        const once = await readAll({ tempDir });
+        await applyConfigAndSchema({ tempDir });
+        const twice = await readAll({ tempDir });
+        return { before: beforeConfigs, once, twice };
+      });
+
+      then('each config parses under schema.apply', () => {
+        expect(getAllParseOutcomes(scene.once)).toEqual(
+          ENVS.map((env) => ({ env, success: true, error: undefined })),
+        );
+      });
+
+      then('the repo own keys and hand-set values survive', () => {
+        const test = JSON.parse(scene.once.configs.test!);
+        const prep = JSON.parse(scene.once.configs.prep!);
+        expect(test.featureFlags).toEqual({ surfReport: true });
+        expect(prep.database.pool).toEqual({ max: 3 });
+        expect(prep.database.tunnel.cluster).toEqual({ name: 'hand-set-cluster' });
+        expect(prep.database.role.cicd['for-plan'].password).toEqual(
+          '$.at(aws::param/test-org/test-project/prep/legacy.plan)',
+        );
+        expect(prep.database.role.crud.password).toEqual('__CHANG3_ME__');
+      });
+
+      then('the legacy string tunnel fields are replaced', () => {
+        const test = JSON.parse(scene.once.configs.test!);
+        const prod = JSON.parse(scene.once.configs.prod!);
+        for (const config of [test, prod]) {
+          expect(config.database.tunnel.bastion).toEqual({
+            exid: 'vpc-main-bastion',
+          });
+          expect(config.database.tunnel.cluster).toEqual({ name: 'awesomesdb' });
+        }
+      });
+
+      then('each config carries the unmigrated-param-paths marker, paths kept (#544)', () => {
+        for (const env of ENVS)
+          expect(
+            JSON.parse(scene.once.configs[env]!)['@declapract:review'],
+          ).toContain('#544');
+      });
+
+      then('a second apply changes no byte', () => {
+        expect(scene.twice).toEqual(scene.once);
+      });
+
+      then('before and after match snapshot', () => {
+        for (const env of ENVS) {
+          expect(scene.before[env]).toMatchSnapshot(`config/${env}.json — before`);
+          expect(scene.once.configs[env]).toMatchSnapshot(
+            `config/${env}.json — after`,
+          );
+        }
+      });
+    });
+  });
+});

package/dist/.test/assets/git/declarations/practices/persist-with-rds/database-client.declapract.integration.test.ts

@@ -0,0 +1,291 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+import ts from 'typescript';
+
+import { isPgClientWithoutSsl } from '../../utils/withPgClientSslDeclared';
+import { asDatabaseClientSsl } from './best-practice/src/utils/database/asDatabaseClientSsl';
+
+/**
+ * .what = proves the pg client the persist-with-rds templates build: every client verifies tls
+ *         (#652), carries the connect and query bounds (#664), and the factory takes a `mode`
+ *         whose readonly path reads the plan grant and the for-plan role (#673)
+ * .why = a postgres 17 cluster forces ssl, so a plaintext client stops to connect the moment the
+ *        cluster upgrades; a client with no bounds hangs a lambda on a cluster that accepts the
+ *        socket and never answers; a plan job that connects as the crud role reads a secret its
+ *        oidc grant is denied. all three live in bytes no adopter may edit, so they are caught here
+ * .teeth = drop `ssl:` or `...databaseClientTimeouts` from getOneDatabaseConnection.ts and case1
+ *          reddens; drop the `mode` input and case2 reddens with TS2554; read `role.crud` under the
+ *          plan grant and case2 reddens with TS2322 (a password that may be absent)
+ * .note = `pg`, `helpful-errors`, `iso-time`, config, and environment are stubbed in memory, so the
+ *         check needs none of them installed. INTEGRATION by `rule.forbid.unit.remote-boundaries`:
+ *         it reads the shipped templates off the filesystem
+ */
+
+const BEST_PRACTICE_DIR = join(__dirname, 'best-practice');
+const TEMPLATE_DIR = join(BEST_PRACTICE_DIR, 'src/utils/database');
+const FIXTURE_ROOT = '/fixture';
+
+/**
+ * .what = every `.ts` template under a dir, as a path relative to the best-practice root
+ */
+const getAllTemplates = (input: { dir: string }): string[] =>
+  readdirSync(input.dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(input.dir, entry.name);
+    if (entry.isDirectory()) return getAllTemplates({ dir: path });
+    if (!entry.name.endsWith('.ts') || entry.name.includes('.declapract.'))
+      return [];
+    return [relative(BEST_PRACTICE_DIR, path)];
+  });
+
+// the strictest options the typescript-node practice emits, over an in-memory fixture root
+const COMPILER_OPTIONS: ts.CompilerOptions = {
+  strict: true,
+  noUncheckedIndexedAccess: true,
+  noImplicitReturns: true,
+  noFallthroughCasesInSwitch: true,
+  allowUnreachableCode: false,
+  exactOptionalPropertyTypes: false,
+  esModuleInterop: true,
+  target: ts.ScriptTarget.ES2020,
+  lib: ['lib.es2020.d.ts'],
+  module: ts.ModuleKind.CommonJS,
+  moduleResolution: ts.ModuleResolutionKind.Node10,
+  baseUrl: FIXTURE_ROOT,
+  paths: { '@src/*': ['src/*'] },
+  types: ['node'],
+  typeRoots: [join(__dirname, '../../../node_modules/@types')],
+  noEmit: true,
+};
+
+/**
+ * .what = the in-memory stand-ins for the packages and app modules the factory imports
+ * .why = each declares only the shape the factory reads, so a wrong read reddens the check
+ */
+const STUBS: Record<string, string> = {
+  'node_modules/pg/index.d.ts': `
+import type { ConnectionOptions } from 'node:tls';
+export interface QueryResultRow { [column: string]: any }
+export interface QueryResult<R extends QueryResultRow = any> { rows: R[] }
+export interface ClientConfig {
+  host?: string; port?: number; user?: string; password?: string; database?: string;
+  ssl?: boolean | ConnectionOptions; connectionTimeoutMillis?: number; query_timeout?: number;
+}
+export declare class Client {
+  constructor(config: ClientConfig);
+  connect(): Promise<void>;
+  query<R extends QueryResultRow = any>(sql: string, values?: unknown[]): Promise<QueryResult<R>>;
+  end(): Promise<void>;
+}
+declare const pg: { types: { setTypeParser: (oid: number, parse: (value: string) => unknown) => void } };
+export default pg;
+`,
+  'node_modules/helpful-errors/index.d.ts': `
+export declare class HelpfulError extends Error { constructor(message: string, metadata?: Record<string, unknown>); }
+export declare class UnexpectedCodePathError extends HelpfulError {}
+export declare class ConstraintError extends HelpfulError {}
+`,
+  'node_modules/iso-time/index.d.ts': `
+export declare const toMilliseconds: (input: { seconds?: number; minutes?: number }) => number;
+`,
+  'src/utils/environment.ts': `
+export declare const getEnvironment: () => Promise<{
+  access: 'test' | 'prep' | 'prod';
+  server: 'cloud@aws.lambda' | 'local@node';
+}>;
+`,
+  'src/utils/config/getConfig.ts': `
+type Grant = 'plan' | 'apply';
+type Secret<TGrant extends Grant> = TGrant extends 'plan' ? string | undefined : string;
+export type Config<TGrant extends Grant = 'apply'> = {
+  database: {
+    target: { database: string; schema: string };
+    role: {
+      cicd: {
+        'for-plan': { username: string; password: string };
+        'for-apply': { username: string; password: Secret<TGrant> };
+      };
+      crud: { username: string; password: Secret<TGrant> };
+    };
+    tunnel: {
+      local: { host: string; port: number };
+      lambda: { host: string; port: number } | null;
+    };
+  };
+};
+export declare const getConfig: <TGrant extends Grant = 'apply'>(
+  input?: { grant: TGrant | null },
+) => Promise<Config<TGrant>>;
+`,
+};
+
+/**
+ * .what = the calls an adopter makes on the factory
+ * .why = the bare call must keep its sense, and a mode outside the two must not compile
+ */
+const CALLERS = `
+import { getOneDatabaseConnection } from './getOneDatabaseConnection';
+
+export const connections = async () => [
+  await getOneDatabaseConnection(),
+  await getOneDatabaseConnection({ mode: 'readwrite' }),
+  await getOneDatabaseConnection({ mode: 'readonly' }),
+];
+
+// @ts-expect-error: only readwrite and readonly are modes
+export const forbidden = () => getOneDatabaseConnection({ mode: 'admin' });
+`;
+
+/**
+ * .what = type-check an in-memory fixture and return each diagnostic as one line
+ */
+const getDiagnostics = (input: { files: Record<string, string> }): string[] => {
+  const files = Object.fromEntries(
+    Object.entries(input.files).map(([path, source]) => [
+      `${FIXTURE_ROOT}/${path}`,
+      source,
+    ]),
+  );
+  const host = ts.createCompilerHost(COMPILER_OPTIONS);
+  const readFileBase = host.readFile.bind(host);
+  const getSourceFileBase = host.getSourceFile.bind(host);
+  const fileExistsBase = host.fileExists.bind(host);
+  host.fileExists = (fileName) => fileName in files || fileExistsBase(fileName);
+  host.directoryExists = (directoryName) =>
+    Object.keys(files).some((path) => path.startsWith(`${directoryName}/`)) ||
+    ts.sys.directoryExists(directoryName);
+  host.readFile = (fileName) => files[fileName] ?? readFileBase(fileName);
+  host.getSourceFile = (fileName, languageVersion, ...rest) => {
+    const fixture = files[fileName];
+    if (fixture !== undefined)
+      return ts.createSourceFile(fileName, fixture, languageVersion, true);
+    return getSourceFileBase(fileName, languageVersion, ...rest);
+  };
+  const program = ts.createProgram({
+    rootNames: Object.keys(files),
+    options: COMPILER_OPTIONS,
+    host,
+  });
+  return ts.getPreEmitDiagnostics(program).map((diagnostic) => {
+    const where = diagnostic.file
+      ? `${diagnostic.file.fileName.replace(`${FIXTURE_ROOT}/`, '')}:${
+          diagnostic.file.getLineAndCharacterOfPosition(diagnostic.start ?? 0)
+            .line + 1
+        }`
+      : '(global)';
+    return `${where} TS${diagnostic.code}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, ' ')}`;
+  });
+};
+
+describe('persist-with-rds pg client (#652, #664, #673)', () => {
+  const readTemplate = (name: string) =>
+    readFileSync(join(TEMPLATE_DIR, name), 'utf8');
+
+  given('[case1] every template that builds a pg Client', () => {
+    const clients = getAllTemplates({ dir: BEST_PRACTICE_DIR })
+      .map((path) => ({
+        path,
+        source: readFileSync(join(BEST_PRACTICE_DIR, path), 'utf8'),
+      }))
+      .filter(({ source }) => /new (pg\.)?Client\(/.test(source));
+
+    then('at least one is found, so the clamp is not vacuous', () => {
+      expect(clients.map(({ path }) => path)).toContain(
+        'src/utils/database/getOneDatabaseConnection.ts',
+      );
+    });
+
+    then('each declares verified tls', () => {
+      expect(
+        clients
+          .filter(({ source }) => isPgClientWithoutSsl({ source }))
+          .map(({ path }) => path),
+      ).toEqual([]);
+    });
+
+    then('each carries the connect and query bounds', () => {
+      expect(
+        clients
+          .filter(({ source }) => !source.includes('...databaseClientTimeouts'))
+          .map(({ path }) => path),
+      ).toEqual([]);
+    });
+  });
+
+  given('[case2] the factory, its tls, and its bounds, where they land', () => {
+    when('[t0] tsc runs over them and the calls an adopter makes', () => {
+      const diagnostics = useBeforeAll(async () => ({
+        lines: getDiagnostics({
+          files: {
+            ...STUBS,
+            'src/utils/database/getOneDatabaseConnection.ts': readTemplate(
+              'getOneDatabaseConnection.ts',
+            ),
+            'src/utils/database/asDatabaseClientSsl.ts': readTemplate(
+              'asDatabaseClientSsl.ts',
+            ),
+            'src/utils/database/rdsCaBundleUsEast1.ts': readTemplate(
+              'rdsCaBundleUsEast1.ts',
+            ),
+            'src/utils/database/databaseClientTimeouts.ts': readTemplate(
+              'databaseClientTimeouts.ts',
+            ),
+            'src/utils/database/getOneDatabasePort.ts': readTemplate(
+              'getOneDatabasePort.ts',
+            ),
+            'src/utils/database/callers.ts': CALLERS,
+          },
+        }),
+      }));
+
+      then('no diagnostic points into the factory or its callers', () => {
+        expect(diagnostics.lines).toEqual([]);
+      });
+    });
+  });
+
+  given('[case3] the readonly mode of the factory', () => {
+    const factory = readTemplate('getOneDatabaseConnection.ts');
+
+    then('the bare call stays readwrite', () => {
+      expect(factory).toContain(
+        "input: { mode: 'readwrite' | 'readonly' } = { mode: 'readwrite' }",
+      );
+    });
+
+    then('readonly reads the plan grant and connects as the for-plan role', () => {
+      expect(factory).toContain("await getConfig({ grant: 'plan' })");
+      expect(factory).toContain("config.database.role.cicd['for-plan']");
+    });
+
+    then('readonly marks the session read only, and says it is a guard, not a boundary', () => {
+      expect(factory).toContain(
+        "await client.query('SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY;')",
+      );
+      expect(factory).toContain('not a security boundary');
+    });
+  });
+
+  given('[case4] the ssl options for each kind of endpoint', () => {
+    then('a null endpoint (the local testdb) connects plain', () => {
+      expect(asDatabaseClientSsl({ clusterEndpoint: null })).toEqual(false);
+    });
+
+    then('a us-east-1 endpoint verifies against the rds roots', () => {
+      const ssl = asDatabaseClientSsl({
+        clusterEndpoint: 'surfdb.cluster-abc123.us-east-1.rds.amazonaws.com',
+      });
+      expect(ssl && ssl.rejectUnauthorized).toEqual(true);
+      expect(ssl && String(ssl.ca)).toContain('-----BEGIN CERTIFICATE-----');
+    });
+
+    then('an endpoint in another region fails loud, with a hint', () => {
+      expect(() =>
+        asDatabaseClientSsl({
+          clusterEndpoint: 'surfdb.cluster-abc123.eu-west-2.rds.amazonaws.com',
+        }),
+      ).toThrow('not in us-east-1');
+    });
+  });
+});