Factory Oracle SSL params + CA

[rosanemelo]

T-4: Factory Oracle SSL params + CA

Description

Fix two gaps: (1) add SSL parameters to Oracle URL, (2) implement custom CA via WithTLSConfig. Currently, the Oracle factory completely ignores SSL.

Delivered Value

Oracle connections use SSL when configured. Users can provide custom CA.

Files to Modify

File	Action	Description
pkg/datasource/datasource_factory.go	Modify	newDataSourceConfigOracle with SSL params + CA
pkg/oracle/oracle.go	Modify	Accept pre-built *sql.DB

Implementation

datasource_factory.go (Oracle section):

func newDataSourceConfigOracle(ctx context.Context, conn *model.Connection, ...) (*DataSourceConfig, error) {
    // ... decrypt password, extract serviceName (existente) ...
    // ... validate SSL mode (existente) ...

    // NOVO Gap 1: Adicionar parametros SSL na URL
    connectionString := fmt.Sprintf("oracle://%s:%s@%s:%d/%s",
        conn.Username,
        url.QueryEscape(password),
        conn.Host,
        conn.Port,
        serviceName,
    )

    sslParams := buildOracleSSLParams(conn)
    if sslParams != "" {
        connectionString += "?" + sslParams
    }

    var db *sql.DB

    // NOVO Gap 2: Se CA fornecido, usar connector com custom TLS
    if conn.SSL != nil && conn.SSL.CA != "" && isOracleSSLEnabled(conn.SSL.Mode) {
        tlsCfg, err := tlsutil.BuildTLSConfig(conn.SSL.CA, conn.Host, derefString(conn.SSL.Cert), derefString(conn.SSL.Key))
        if err != nil {
            return nil, fmt.Errorf("failed to build Oracle TLS config: %w", err)
        }

        connector := go_ora.NewConnector(connectionString)
        connector.WithTLSConfig(tlsCfg)
        db = sql.OpenDB(connector)
    }

    oracleConn := &oracle.Connection{
        ConnectionString: connectionString,
        DB:               db, // NOVO: campo opcional
        // ...
    }
    // ...
}

// buildOracleSSLParams retorna parametros SSL para URL Oracle
func buildOracleSSLParams(conn *model.Connection) string {
    if conn.SSL == nil || conn.SSL.Mode == "" {
        return ""
    }

    switch conn.SSL.Mode {
    case "true", "enable":
        return "ssl=enable"
    case "verify":
        return "ssl=enable&ssl verify=true"
    case "skip-verify":
        return "ssl=enable&ssl verify=false"
    default: // "disable", "false"
        return ""
    }
}

func isOracleSSLEnabled(mode string) bool {
    return mode != "" && mode != "disable" && mode != "false"
}

Dependencies

• Task 1 (buildTLSConfig)

Estimate

• Size: M (medium)
• Complexity: High (two gaps + Oracle is complex)

Acceptance Criteria

• Gap 1: true/enable modes add ssl=enable to URL
• Gap 1: verify mode adds ssl=enable&ssl verify=true
• Gap 1: skip-verify mode adds ssl=enable&ssl verify=false
• Gap 1: disable/false modes don't add SSL parameters
• Gap 2: With CA + verify mode: validates cert against provided CA
• Gap 2: Without CA: uses driver default
• Existing connections don't break
• serviceName continues to be extracted from Metadata

Test Strategy

• Unit tests for buildOracleSSLParams
• Unit tests for isOracleSSLEnabled
• Unit tests for factory with/without CA
• Integration test with Oracle SSL container (Task 8)

---

Phase 3 - Test Setup

---

Task gerada pelo Floki

---

Jira: FET-147
Link: https://lerian.atlassian.net/browse/FET-147