db.js

// Turning velixir's DATABASE_URL into node-postgres settings that actually connect.
//
// velixir injects DATABASE_URL as postgres://user:pass@host:5432/db?sslmode=require. The
// database speaks TLS with a certificate issued by velixir's own CA, so what the URL means is
// the libpq definition of "require": encrypt the connection, but do not check the certificate
// against the public CAs your machine trusts.
//
// node-postgres reads it differently, in two ways that stack:
//
//   1. It treats sslmode=require as verify-full, so the handshake checks the certificate
//      against public CAs and fails with "self-signed certificate".
//   2. Settings parsed from the URL override the options object. Passing
//      ssl: { rejectUnauthorized: false } next to a URL that says sslmode=require does nothing.
//
// So the mode is taken out of the URL and said explicitly. The connection is still encrypted.
// A URL that asks for sslmode=verify-ca or verify-full (a database whose CA you hold, passed
// as the ca option) is left untouched.

function pgConfig(databaseUrl) {
  const url = new URL(databaseUrl);
  const mode = (url.searchParams.get('sslmode') || '').toLowerCase();

  // The verifying modes mean what they say in node-postgres too. Leave them alone.
  if (mode === 'verify-ca' || mode === 'verify-full') {
    return { connectionString: databaseUrl };
  }

  url.searchParams.delete('sslmode');
  const ssl = mode === '' || mode === 'disable' ? false : { rejectUnauthorized: false };
  return { connectionString: url.toString(), ssl };
}

module.exports = { pgConfig };