MySQL Factory with CA

[rosanemelo]

T-2: MySQL Factory with CA

Description

Implement custom CA usage in MySQL factory via RegisterTLSConfig. When CA is provided, register TLS config with unique name and use it in connection string.

Delivered Value

Users can connect to MySQL with corporate CA. Without CA, behavior remains identical to current.

Files to Modify

File	Action	Description
pkg/datasource/datasource_factory.go	Modify	newDataSourceConfigMySQL with CA support

Implementation

func newDataSourceConfigMySQL(ctx context.Context, conn *model.Connection, ...) (*DataSourceConfig, error) {
    // ... decrypt password (existente) ...

    sslMode := "false"
    if conn.SSL != nil && conn.SSL.Mode != "" {
        sslMode = conn.SSL.Mode
    }

    if err := sslmode.ValidateMySQLMode(sslMode); err != nil {
        return nil, err
    }

    // NOVO: Se CA fornecido, registrar custom TLS config
    if conn.SSL != nil && conn.SSL.CA != "" && sslMode != "false" {
        tlsCfg, err := tlsutil.BuildTLSConfig(conn.SSL.CA, conn.Host, derefString(conn.SSL.Cert), derefString(conn.SSL.Key))
        if err != nil {
            return nil, fmt.Errorf("failed to build MySQL TLS config: %w", err)
        }

        // Nome unico por conexao para evitar colisao global
        tlsKeyName := fmt.Sprintf("fetcher-%s", conn.ID.String())
        if err := mysql.RegisterTLSConfig(tlsKeyName, tlsCfg); err != nil {
            return nil, fmt.Errorf("failed to register MySQL TLS config: %w", err)
        }

        sslMode = tlsKeyName // Usar nome registrado em vez de modo generico
    }

    connectionString := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?tls=%s",
        conn.Username,
        url.QueryEscape(password),
        conn.Host,
        conn.Port,
        conn.DatabaseName,
        sslMode,
    )

    // ... restante da funcao (existente) ...
}

Dependencies

• Task 1 (buildTLSConfig)

Estimate

• Size: S (small)
• Complexity: Medium

Acceptance Criteria

• With CA: RegisterTLSConfig called with unique name
• With CA: connection string uses tls=<nome-registrado>
• Without CA: behavior identical to current (tls=<mode>)
• Invalid PEM returns descriptive error
• Factory unit tests cover: with CA, without CA, invalid CA

Test Strategy

• Unit tests for factory with RegisterTLSConfig mock
• Integration test with MySQL SSL container (Task 6)

---

---

Task gerada pelo Floki

---

Jira: FET-145
Link: https://lerian.atlassian.net/browse/FET-145

[lerian-studio]

This issue has had no activity for 30 days and is now marked stale. It will be closed in 7 days unless updated. Add the no-stale label to keep it open indefinitely.

Learn more about the routine and exempt labels: https://github.com/LerianStudio/github-actions-shared-workflows/blob/main/instructions/repository-routines.md