Normalize pg SSL mode handling

[chloeilabs]

Summary

• normalize legacy pg sslmode values to verify-full at the connection boundary
• apply the same normalization in the thread and market migration scripts
• add focused tests for the connection-string normalization helper

Verification

• pnpm exec vitest run src/lib/server/tests/postgres.test.ts
• pnpm threads:migrate
• pnpm markets:migrate
• pnpm auth:migrate
• pnpm build

Summary by CodeRabbit

• New Features

  • Database connections now automatically use modern SSL/TLS verification standards, improving security across all database operations.

• Tests

  • Added test coverage for the connection security improvements.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
finance	Ready	Preview, Comment	Apr 19, 2026 3:27am

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0896efc1-3dce-4412-938d-458222f638c6

📥 Commits

Reviewing files that changed from the base of the PR and between 1d03e19 and 2d5a753.

📒 Files selected for processing (4)

• markets-migrate.mjs
• src/lib/server/__tests__/postgres.test.ts
• src/lib/server/postgres.ts
• threads-migrate.mjs

---

📝 Walkthrough

Walkthrough

A normalization function for PostgreSQL connection strings was introduced to convert legacy SSL modes (prefer, require, verify-ca) to the modern verify-full standard. The function is applied across migration scripts and the database connection library, with corresponding test coverage.

Changes

Cohort / File(s)	Summary
Migration scripts with SSL mode normalization markets-migrate.mjs, threads-migrate.mjs	Added normalizeDatabaseConnectionString() function that parses connection URLs and rewrites legacy sslmode values to verify-full, applied to pg Client instantiation.
PostgreSQL connection library src/lib/server/postgres.ts	Exported normalizeDatabaseConnectionString() helper function with identical logic; updated createPool() to apply normalization to all database connection strings.
Test coverage src/lib/server/__tests__/postgres.test.ts	Added Vitest test suite with four cases covering legacy mode upgrades, uselibpqcompat=true preservation, non-legacy mode retention, and missing sslmode handling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A hop through SSL modes so grand,
Legacy values transformed across the land,
verify-full now shines so bright,
Database connections secure and right! 🔐

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/normalize-pg-ssl-mode

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}