feat: support sslmode=verify-ca and sslmode=verify-full with sslrootcert for PostgreSQL

[Elrendio]

Summary

• Support sslmode=verify-ca and sslmode=verify-full in the PostgreSQL DSN parser, with optional sslrootcert parameter to specify a CA certificate bundle
• Extend TOML config to accept the new SSL modes and sslrootcert field, with validation that restricts verify-ca/verify-full to PostgreSQL sources only
• verify-ca/verify-full without sslrootcert uses the system CA store (same as native libpq behavior)

Closes #293

Motivation

When connecting to managed PostgreSQL services like AWS RDS, sslmode=require encrypts traffic but does not verify the server certificate (rejectUnauthorized: false). For production databases, certificate verification against a known CA bundle is needed to prevent MITM attacks. This aligns DBHub with PostgreSQL's standard sslmode values.

Changes

File	Change
src/connectors/postgres/index.ts	Handle verify-ca/verify-full sslmode values; read CA cert from sslrootcert path with ~/ expansion and clear error on missing file
src/types/config.ts	Extend sslmode union type; add sslrootcert?: string to ConnectionParams
src/config/toml-loader.ts	Accept new SSL modes; restrict verify-ca/verify-full to PostgreSQL; validate sslrootcert coherence and file existence; include sslrootcert in built DSNs
src/connectors/__tests__/dsn-parser.test.ts	10 new tests: verify-ca/verify-full with and without sslrootcert, ~/ expansion, nonexistent file error, ignored sslrootcert for disable/require
src/config/__tests__/toml-loader.test.ts	10 new tests: accept verify-ca/verify-full for PostgreSQL, reject for MySQL/MariaDB/SQL Server, sslrootcert coherence and file existence checks, DSN build output
dbhub.toml.example	Add AWS RDS verify-ca example; update Quick Reference with all four SSL modes and sslrootcert

Usage

postgres://user:pass@host:5432/db?sslmode=verify-ca&sslrootcert=/path/to/ca-bundle.pem

[[sources]]
id = "rds_pg"
type = "postgres"
host = "mydb.abc123.eu-west-1.rds.amazonaws.com"
port = 5432
database = "myapp"
user = "app_user"
password = "secure_password"
sslmode = "verify-ca"
sslrootcert = "~/.ssl/rds-combined-ca-bundle.pem"

[Copilot]

Pull request overview

Adds support for PostgreSQL TLS certificate verification modes (sslmode=verify-ca / sslmode=verify-full) and optional CA bundle configuration (sslrootcert) across DSN parsing and TOML configuration, to enable secure connections to managed Postgres services (e.g., AWS RDS).

Changes:

• Extend config types and TOML validation to allow verify-ca/verify-full (PostgreSQL-only) plus sslrootcert with file existence checks and ~/ expansion.
• Update PostgreSQL DSN parsing to recognize the new SSL modes and load CA bundle contents from sslrootcert when provided.
• Add test coverage for the new TOML validation + DSN parsing behavior, and update dbhub.toml.example with usage guidance.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/types/config.ts	Extends sslmode union and adds sslrootcert to connection params.
src/connectors/postgres/index.ts	Implements verify-ca / verify-full handling and optional CA bundle loading from sslrootcert.
src/connectors/tests/dsn-parser.test.ts	Adds tests for PostgreSQL SSL modes and sslrootcert parsing/expansion/error behavior.
src/config/toml-loader.ts	Adds TOML validation + DSN building support for new SSL modes and sslrootcert.
src/config/tests/toml-loader.test.ts	Adds TOML validation tests for new SSL modes and sslrootcert, plus DSN build assertions.
dbhub.toml.example	Documents the new SSL modes and shows an AWS RDS verify-ca example.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

[tianzhou]

Thanks for the contribution. This is a good feature to be added. Please take a look at the review comments

[Elrendio]

I've taken into accounts the comments 😊

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[Elrendio]

I've taken into accounts the comments 😊

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

[tianzhou]

LGTM. Thanks for the contribution