SQL Server Factory with CA

[rosanemelo]

T-3: SQL Server Factory with CA

Description

Implement custom CA usage in SQL Server factory via msdsn.Config.TLSConfig. When CA is provided, use connector with custom TLS instead of plain connection string.

Delivered Value

Users can use strict mode with corporate CA. true mode with CA actually validates certificate.

Files to Modify

File	Action	Description
pkg/datasource/datasource_factory.go	Modify	newDataSourceConfigSQLServer with CA support
pkg/sqlserver/sqlserver.go	Modify	Accept pre-built *sql.DB

Implementation

datasource_factory.go (SQL Server section):

func newDataSourceConfigSQLServer(ctx context.Context, conn *model.Connection, ...) (*DataSourceConfig, error) {
    // ... decrypt password, validate mode (existente) ...
    // ... build connectionString (existente) ...

    var db *sql.DB

    // NOVO: Se CA fornecido, usar connector com custom TLS
    if conn.SSL != nil && conn.SSL.CA != "" && sslMode != "false" && sslMode != "disable" {
        tlsCfg, err := tlsutil.BuildTLSConfig(conn.SSL.CA, conn.Host, derefString(conn.SSL.Cert), derefString(conn.SSL.Key))
        if err != nil {
            return nil, fmt.Errorf("failed to build SQL Server TLS config: %w", err)
        }

        config, err := msdsn.Parse(connectionString)
        if err != nil {
            return nil, fmt.Errorf("failed to parse SQL Server DSN: %w", err)
        }

        config.TLSConfig = tlsCfg
        // Com CA fornecido, nao usar TrustServerCertificate
        // (o usuario quer validacao real)
        connector := mssql.NewConnectorConfig(config)
        db = sql.OpenDB(connector)
    }

    // Passar db pre-construido para Connection (nil = comportamento atual)
    sqlserverConn := &sqlserver.Connection{
        ConnectionString: connectionString,
        DB:               db, // NOVO: campo opcional
        // ...
    }
    // ...
}

pkg/sqlserver/sqlserver.go:

type Connection struct {
    ConnectionString string
    DBName           string
    ConnectionDB     *sql.DB
    DB               *sql.DB // Pre-construido pela factory (opcional)
    Logger           logger.Logger
}

func (c *Connection) Connect() error {
    if c.DB != nil {
        // DB ja construido pela factory com custom TLS
        c.ConnectionDB = c.DB
    } else {
        // Comportamento atual
        db, err := sql.Open("sqlserver", c.ConnectionString)
        if err != nil {
            return fmt.Errorf("failed to open SQL Server connection: %w", err)
        }
        c.ConnectionDB = db
    }
    // ... ping, pool settings (existente) ...
}

Dependencies

• Task 1 (buildTLSConfig)

Estimate

• Size: M (medium)
• Complexity: Medium

Acceptance Criteria

• With CA + true mode: validates cert against CA (without TrustServerCertificate)
• With CA + strict mode: validates against provided CA
• Without CA + true mode: keeps TrustServerCertificate=true (current)
• Without CA + strict mode: maintains current behavior (system CA store)
• Existing connections don't break

Test Strategy

• Unit tests for factory with/without CA
• Integration test with SQL Server SSL container (Task 7)

---

---

Task gerada pelo Floki

---

Jira: FET-146
Link: https://lerian.atlassian.net/browse/FET-146