Skip to content

[dev] [Marfuen] mariano/secure-rds-tls#2762

Merged
Marfuen merged 16 commits into
mainfrom
mariano/secure-rds-tls
May 6, 2026
Merged

[dev] [Marfuen] mariano/secure-rds-tls#2762
Marfuen merged 16 commits into
mainfrom
mariano/secure-rds-tls

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot commented May 6, 2026 •
edited by cubic-dev-ai Bot
Loading

This is an automated pull request to merge mariano/secure-rds-tls into dev.
It was created by the [Auto Pull Request] action.

Summary by cubic

Secure Postgres TLS across apps and workers using the AWS RDS CA bundle, with strict Prisma TLS gating and lazy client initialization to avoid build-time crashes.

  • New Features

    • Bundles the RDS CA cert at packages/db/certs/rds-global-bundle.pem and sets NODE_EXTRA_CA_CERTS for verified TLS.
    • Trigger.dev: adds caBundleExtension to copy the cert and set the env var at runtime.
    • Vercel: includes the cert in functions via outputFileTracingIncludes in Next.js configs (app + portal).
    • Enforces Prisma TLS: local DBs skip TLS; remote DBs require verified TLS or PRISMA_ALLOW_INSECURE_TLS=1. Hostname check is skipped when the CA bundle is present (NLB → RDS Proxy), while chain verification remains.
    • Lazily initializes Prisma clients (api, app, portal, framework-editor) to defer TLS checks to first use.
    • Temporary /api/_debug-tls route to verify cert path at runtime.

  • Migration

    • Vercel (app + portal): set NODE_EXTRA_CA_CERTS to /var/task/packages/db/certs/rds-global-bundle.pem (or /vercel/path0/... if needed).
    • Trigger.dev (api + app): deploy with the new caBundleExtension, then remove PRISMA_ALLOW_INSECURE_TLS.
    • API Docker: no action needed (image already sets NODE_EXTRA_CA_CERTS).
    • Verify with /api/_debug-tls on a preview deploy, then remove the route once confirmed.

Written for commit 975d029. Summary will update on new commits.

Marfuen and others added 15 commits May 6, 2026 13:18
@Marfuen
chore(db): commit AWS RDS global CA bundle for verified TLS
e577b94
@Marfuen @claude
feat(db): strict TLS gating in shared prisma client
dabc3cc 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
refactor(db): extract resolveSslConfig and use bun:test for consistency
ad1e07f 
Move SSL-resolution logic into a pure ssl-config.ts module so it can be
tested with bun:test (matching strip-ssl-mode.test.ts's pattern) without
importing the module-level Prisma client. Drop vitest devDependency.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
feat(app): strict TLS gating in app prisma client
4259bc3 
Extracts SSL config logic into apps/app/prisma/ssl-config.ts and
updates the Prisma client to throw at boot when connecting to a
non-local database without a verified CA bundle or explicit
PRISMA_ALLOW_INSECURE_TLS=1 opt-in.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
refactor(db): expose resolveSslConfig via subpath export; dedupe in a…
641fc4b 
…pps/app

Add `./ssl-config` subpath export to @trycompai/db so apps/app (and
upcoming portal/framework-editor) can import the single source of truth
instead of maintaining their own copy. Widen the `env` parameter type
from `NodeJS.ProcessEnv` to `Partial<NodeJS.ProcessEnv>` (strictly more
permissive) to satisfy apps/app's strict TS config. Delete the duplicate
apps/app/prisma/ssl-config.ts and its redundant test file.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
feat(portal): strict TLS gating in prisma client
4c5d75b 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
feat(framework-editor): strict TLS gating in prisma client
6db369c 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
feat(trigger): add caBundleExtension for verified-TLS Postgres
1a8557d 
Ships the RDS CA bundle (packages/db/certs/rds-global-bundle.pem) into
Trigger.dev task images at /app/certs/rds-global-bundle.pem and sets
NODE_EXTRA_CA_CERTS via the deploy.env layer so Node TLS initialization
picks it up before any Prisma connection attempt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
fix(prisma): inline TLS gating in app clients to avoid published-pack…
23db526 
…age dependency

Drop `import { resolveSslConfig } from '@trycompai/db/ssl-config'` from
apps/app, apps/portal, and apps/framework-editor and inline the full
localhost/CA-bundle/PRISMA_ALLOW_INSECURE_TLS logic directly.
Trigger.dev pins @trycompai/db@^2.0.0 from npm which lacks the
./ssl-config subpath, causing indexer crashes at deploy time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
fix(prisma): skip hostname check when CA bundle is set (NLB compatibi…
ca3b0f5 
…lity)

AWS NLB → RDS Proxy connections fail TLS hostname verification because the
NLB hostname (*.elb.amazonaws.com) isn't in the RDS Proxy cert's SAN list.
Cert chain verification is preserved — an attacker still cannot present a
forged or wrong-CA cert. Only the hostname-string check is relaxed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
feat(vercel): bundle RDS CA cert with Next.js apps for verified TLS
7558777 
Add outputFileTracingIncludes to apps/app and apps/portal next.config.ts
so the rds-global-bundle.pem is included in Vercel's traced file output
for each deployed function.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen @claude
docs: deploy checklist for verified-TLS env vars
00e0a3f 
Documents the NODE_EXTRA_CA_CERTS values to set in Vercel (both candidate
paths), the Trigger.dev PRISMA_ALLOW_INSECURE_TLS removal commands, and
notes that API Docker needs no action.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Marfuen
fix(prisma): lazy-init client to prevent TLS throw during Next.js build
55dd766 
next build imports every route handler to analyze it, which previously
triggered our strict-TLS throw at module load even though no queries run.
Wrap the client in a Proxy that constructs the real PrismaClient on first
property access. The strict check still fires — just at first use, not at
import.
@Marfuen
fix(db): point ssl-config types at dist (src/ is not published)
60a4452 
cubic flagged: the subpath export's types entry pointed at ./src/ssl-config.ts,
but the published package's files array only includes dist/. Downstream npm
consumers would get broken type resolution. Workspace consumers were unaffected
because @trycompai/db resolves to source via workspace:*.
@Marfuen
chore: temporary debug endpoint to verify Vercel cert path
31f8e1a 
Hit /api/_debug-tls on the deployed preview. Reports process.cwd(),
NODE_EXTRA_CA_CERTS value, and existence/size for the env-var path plus
common candidate paths. Delete this commit once the path is confirmed.
@vercel
Copy link
Copy Markdown

vercel Bot commented May 6, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
comp-framework-editor Ready Ready Preview, Comment May 6, 2026 0:49am
2 Skipped Deployments
Project Deployment Actions Updated (UTC)
app Skipped Skipped May 6, 2026 0:49am
portal Skipped Skipped May 6, 2026 0:49am

Request Review

@vercel vercel Bot temporarily deployed to Preview – app May 6, 2026 12:47 Inactive
@vercel vercel Bot temporarily deployed to Preview – portal May 6, 2026 12:47 Inactive
@Marfuen Marfuen merged commit 9d5e2c2 into main May 6, 2026
8 of 10 checks passed
@Marfuen Marfuen deleted the mariano/secure-rds-tls branch May 6, 2026 12:47
This was referenced May 6, 2026
Merged
Closed
Marfuen added a commit that referenced this pull request May 6, 2026
@Marfuen
feat(db): ship CA bundle with @trycompai/db, clean up debug routes (#…
84da90c 
…2767)

After the verified-TLS PR (#2761) merged, two follow-ups didn't make it in:

1. Add 'certs' to packages/db/package.json files array so the RDS CA bundle
   ships with the published @trycompai/db package. Downstream consumers (e.g.
   comp-private/apps/enterprise-api) can then reference the cert at
   node_modules/@trycompai/db/certs/rds-global-bundle.pem instead of
   committing their own copy.
2. Delete the debug-tls routes (apps/app/src/app/api/_debug-tls and
   apps/app/src/app/api/debug-tls) that were merged in via auto-PRs #2762
   and #2763 but never cleaned up. They were temporary verification
   endpoints, since used to confirm the Vercel cert path.
3. Update the deploy checklist with verified-staging notes and the
   downstream consumer pattern.
claudfuen pushed a commit that referenced this pull request May 6, 2026
@semantic-release-bot
chore(release): 3.44.0 [skip ci]
5889f63 
# [3.44.0](v3.43.1...v3.44.0) (2026-05-06)

### Bug Fixes

* **api:** correct the total number of active members from overview scores ([ed9561f](ed9561f))
* **api:** make submission endpoints accessible as an employee ([3c96a1d](3c96a1d))
* **billing:** surface wallet credits to pentest + bg-check UIs ([05d87d4](05d87d4))
* **treatment-plan:** cap linked-work lists and treatment plan body height ([8a1c46f](8a1c46f)), closes [#36](#36) [#37](#37)
* **treatment-plan:** cap linked-work lists and treatment plan body height ([46d7e83](46d7e83)), closes [#36](#36) [#37](#37)
* **upgrade:** keep self-hosted check on the page to avoid OSS regression ([e42e6ef](e42e6ef))

### Features

* **db:** ship CA bundle with @trycompai/db, clean up debug routes ([#2767](#2767)) ([84da90c](84da90c)), closes [#2761](#2761) [#2762](#2762) [#2763](#2763)
* **integration-platform:** remove code-based jumpcloud, route via DIP ([2ab5b78](2ab5b78))
* **risks:** treatment plan as first-class + vendor AI widening + matrix polish ([1a97746](1a97746)), closes [hi#confidence](https://github.com/hi/issues/confidence) [#2671](#2671) [#2](https://github.com/trycompai/comp/issues/2) [#3](#3) [#9](#9) [#4](#4) [#5](#5) [#7](#7) [#26](#26) [#6](#6) [#1](https://github.com/trycompai/comp/issues/1) [#10](#10) [#36](#36) [#35](#35) [#39](#39) [#37](#37) [#32](#32) [#33](#33) [#34](#34) [#17](#17) [#18](#18) [#19](#19) [#20](#20) [#21](#21) [#22](#22) [#30](#30) [#31](#31) [#29](#29) [#23](#23) [#40](#40) [#28](#28) [#27](#27) [#38](#38) [#24](#24) [#2671](#2671)
* **vendors:** refine inherent risk score after research lands posture data ([#2760](#2760)) ([e999c72](e999c72))
* verified-TLS to RDS from every runtime ([#2761](#2761)) ([2bde7ad](2bde7ad))
@claudfuen
Copy link
Copy Markdown
Contributor

claudfuen commented May 6, 2026

🎉 This PR is included in version 3.44.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated-pr released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@claudfuen @Marfuen