fix: inherit postgres sslmode from project db url (#2191)

internal/db/runtime-store.test.ts

@@ -223,6 +223,24 @@ test("postgres pool config makes HWLAB_CLOUD_DB_SSL_MODE authoritative over URL
   assert.equal(new URL(required.connectionString).searchParams.get("uselibpqcompat"), "true");
 });
 
+test("postgres pool config inherits URL sslmode when env override is absent", () => {
+  const disabled = buildPostgresPoolConfig({
+    dbUrl: "postgres://hwlab_user:fixture-pass@db.example.test:5432/hwlab?sslmode=disable&application_name=hwlab"
+  });
+
+  assert.equal(disabled.ssl, false);
+  const disabledUrl = new URL(disabled.connectionString);
+  assert.equal(disabledUrl.searchParams.get("sslmode"), null);
+  assert.equal(disabledUrl.searchParams.get("application_name"), "hwlab");
+
+  const required = buildPostgresPoolConfig({
+    dbUrl: "postgres://hwlab_user:fixture-pass@db.example.test:5432/hwlab?sslmode=require"
+  });
+
+  assert.deepEqual(required.ssl, { rejectUnauthorized: false });
+  assert.equal(new URL(required.connectionString).searchParams.get("sslmode"), "require");
+});
+
 test("configured postgres runtime passes normalized pool config to pg", async () => {
   const pools = [];
   const store = createConfiguredCloudRuntimeStore({

internal/db/runtime-store.ts

@@ -120,8 +120,8 @@ export function createConfiguredCloudRuntimeStore(options = {}) {
   return createCloudRuntimeStore(options);
 }
 
-export function buildPostgresPoolConfig({ dbUrl, sslMode = "require", timeoutMs, poolMax, queryTimeoutMs } = {}) {
-  const normalizedSslMode = normalizePostgresSslMode(sslMode);
+export function buildPostgresPoolConfig({ dbUrl, sslMode, timeoutMs, poolMax, queryTimeoutMs } = {}) {
+  const normalizedSslMode = normalizePostgresSslMode(sslMode ?? postgresSslModeFromConnectionString(dbUrl));
   const normalizedPoolMax = normalizeRuntimePoolMax(poolMax);
   const normalizedQueryTimeoutMs = queryTimeoutMs === undefined || queryTimeoutMs === null || String(queryTimeoutMs).trim() === ""
     ? null
@@ -2999,6 +2999,17 @@ function normalizePostgresSslMode(value) {
   return "require";
 }
 
+function postgresSslModeFromConnectionString(dbUrl) {
+  if (typeof dbUrl !== "string" || dbUrl.trim() === "") return undefined;
+  try {
+    const url = new URL(dbUrl);
+    if (!["postgres:", "postgresql:"].includes(url.protocol)) return undefined;
+    return url.searchParams.get("sslmode") ?? url.searchParams.get("ssl") ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function postgresSslOption(sslMode) {
   return sslMode === "disable" ? false : { rejectUnauthorized: false };
 }