A non-selectable database name (anything other than ducklake/empty) is rejected with 3D000 — the database param is now catalog selection, not an org/identity routing key.
(t *testing.T)
| 272 | resolvePostgresConnection: func(startupDatabase, sniPrefix string, useManagedSNI bool, username, password string) configstore.PostgresConnectionResolution { |
| 273 | if startupDatabase != "requested_db" || sniPrefix != "other-org" || !useManagedSNI || username != "root" || password != "secret" { |
| 274 | t.Fatalf("unexpected ResolvePostgresConnection args: db=%q sni=%q use=%v user=%q pass=%q", |
| 275 | startupDatabase, sniPrefix, useManagedSNI, username, password) |
| 276 | } |
| 277 | return configstore.PostgresConnectionResolution{ |
| 278 | OrgID: "other-org", |
| 279 | SNIOrgID: "other-org", |
| 280 | SNIResolved: true, |
| 281 | CatalogValid: false, // "requested_db" is not ducklake |
| 282 | Valid: true, |
| 283 | } |
| 284 | }, |
| 285 | } |
| 286 | cp := newSNIControlPlane(store) |
| 287 | cp.cfg.SNIRoutingMode = SNIRoutingEnforce |
| 288 | cp.tlsConfig = testControlPlaneTLSConfig(t) |
| 289 | |
| 290 | cfg, err := pgconn.ParseConfig("postgres://root:secret@127.0.0.1/requested_db?sslmode=require") |
| 291 | if err != nil { |
| 292 | t.Fatalf("ParseConfig: %v", err) |
| 293 | } |
| 294 | cfg.TLSConfig = &tls.Config{ |
| 295 | ServerName: "other-org.dw.us.postwh.com", |
| 296 | InsecureSkipVerify: true, // test self-signed cert |
| 297 | } |
| 298 | cfg.DialFunc = func(context.Context, string, string) (net.Conn, error) { |
| 299 | client, serverConn := net.Pipe() |
| 300 | go cp.handleConnection(serverConn) |
| 301 | return client, nil |
| 302 | } |
| 303 | |
| 304 | conn, err := pgconn.ConnectConfig(context.Background(), cfg) |
| 305 | if err == nil { |
| 306 | _ = conn.Close(context.Background()) |
| 307 | t.Fatal("expected invalid catalog to reject connection") |
| 308 | } |
| 309 | var pgErr *pgconn.PgError |
| 310 | if !errors.As(err, &pgErr) { |
| 311 | t.Fatalf("expected pg error; got: %T %v", err, err) |
| 312 | } |
| 313 | if pgErr.Code != "3D000" { |
| 314 | t.Fatalf("SQLSTATE = %q, want 3D000", pgErr.Code) |
| 315 | } |
| 316 | } |
| 317 | |
| 318 | func testControlPlaneTLSConfig(t *testing.T) *tls.Config { |
| 319 | t.Helper() |
| 320 | dir := t.TempDir() |
| 321 | certFile := filepath.Join(dir, "server.crt") |
| 322 | keyFile := filepath.Join(dir, "server.key") |
| 323 | if err := server.EnsureCertificates(certFile, keyFile); err != nil { |
nothing calls this directly
no test coverage detected