fix(postgres): update TLS 1.3 handling in protocol mapping and error messaging

Author: arab971

quaint/src/connector/postgres/native/mod.rs

@@ -901,10 +901,9 @@ fn protocol_order(p: native_tls::Protocol) -> u8 {
         native_tls::Protocol::Tlsv10 => 2,
         native_tls::Protocol::Tlsv11 => 3,
         native_tls::Protocol::Tlsv12 => 4,
-        // TLS 1.3 is supported as a format string for future compatibility, but native-tls
-        // only ships Tlsv12 as the maximum, so we rank it after Tlsv12 for validation purposes.
-        // The non-exhaustive enum means we need a catch-all; future variants will get a
-        // higher rank automatically.
+        // TLS 1.3 is reserved for future compatibility at the protocol-mapping layer, so we
+        // rank it after Tlsv12 for validation purposes. The non-exhaustive enum means we need
+        // a catch-all; unmatched and future variants receive the same fallback rank as TLS 1.3.
         _ => 5,
     }
 }
@@ -914,14 +913,19 @@ fn protocol_order(p: native_tls::Protocol) -> u8 {
 /// Supported formats: "TLSv1.0", "TLSv1.1", "TLSv1.2", "TLS1.0", "TLS1.1", "TLS1.2"
 /// (case-insensitive, with or without the 'v' in "TLS"). Returns an error for unrecognized
 /// or unsupported values.
+///
+/// Note: TLS 1.3 (`"TLSv1.3"` / `"TLS1.3"`) is reserved for future support by this connector
+/// build and is rejected through the protocol-mapping layer.
 fn string_to_protocol(s: &str) -> Result<native_tls::Protocol, String> {
     let normalized = s.to_uppercase();
     // Accept both documented forms: "TLSV1.2" and "TLS1.2"
     match normalized.as_str() {
         "TLSV1.0" | "TLS1.0" => Ok(native_tls::Protocol::Tlsv10),
         "TLSV1.1" | "TLS1.1" => Ok(native_tls::Protocol::Tlsv11),
         "TLSV1.2" | "TLS1.2" => Ok(native_tls::Protocol::Tlsv12),
-        "TLSV1.3" | "TLS1.3" => Err("TLS 1.3 is not yet supported by the native-tls library".to_string()),
+        "TLSV1.3" | "TLS1.3" => {
+            Err("TLS 1.3 is not supported by this connector build".to_string())
+        }
         _ => Err(format!(
             "Unsupported TLS version: '{}'. Supported versions are: TLSv1.0, TLSv1.1, TLSv1.2",
             s
@@ -1083,6 +1087,12 @@ mod tests {
     use crate::tests::test_api::postgres::CONN_STR;
     use url::Url;
 
+    #[test]
+    fn rejects_tls13_with_neutral_error_message() {
+        let err = string_to_protocol("TLS1.3").unwrap_err();
+        assert_eq!(err, "TLS 1.3 is not supported by this connector build");
+    }
+
     #[tokio::test]
     async fn test_custom_search_path_pg() {
         async fn test_path(schema_name: &str) -> Option<String> {