fix(postgres): improve error messaging for unsupported TLS versions and add validation tests for TLS version bounds

Author: arab971

quaint/src/connector/postgres/native/mod.rs

@@ -924,7 +924,7 @@ fn string_to_protocol(s: &str) -> Result<native_tls::Protocol, String> {
         "TLSV1.1" | "TLS1.1" => Ok(native_tls::Protocol::Tlsv11),
         "TLSV1.2" | "TLS1.2" => Ok(native_tls::Protocol::Tlsv12),
         "TLSV1.3" | "TLS1.3" => {
-            Err("TLS 1.3 is not supported by this connector build".to_string())
+            Err("TLS 1.3 is not yet supported in this build (native-tls version constraint)".to_string())
         }
         _ => Err(format!(
             "Unsupported TLS version: '{}'. Supported versions are: TLSv1.0, TLSv1.1, TLSv1.2",
@@ -1090,7 +1090,126 @@ mod tests {
     #[test]
     fn rejects_tls13_with_neutral_error_message() {
         let err = string_to_protocol("TLS1.3").unwrap_err();
-        assert_eq!(err, "TLS 1.3 is not supported by this connector build");
+        assert_eq!(err, "TLS 1.3 is not yet supported in this build (native-tls version constraint)");
+    }
+
+    // --- TLS version bound validation (unit tests via get_connector) ---
+
+    /// Build a PostgresNativeUrl with the given tls_min_version / tls_max_version query params.
+    fn make_tls_with_bounds(min: Option<&str>, max: Option<&str>) -> PostgresNativeUrl {
+        let mut url = Url::parse("postgresql://localhost:5432/test").unwrap();
+        {
+            let mut pairs = url.query_pairs_mut();
+            if let Some(v) = min {
+                pairs.append_pair("tls_min_version", v);
+            }
+            if let Some(v) = max {
+                pairs.append_pair("tls_max_version", v);
+            }
+        }
+        PostgresNativeUrl::new(url).unwrap()
+    }
+
+    /// Helper: call get_connector and return the error message string if it fails.
+    async fn get_connector_err(url: PostgresNativeUrl) -> String {
+        let mgr = MakeTlsConnectorManager::new(url);
+        match mgr.get_connector().await {
+            Ok(_) => panic!("expected get_connector to fail"),
+            Err(e) => e.to_string(),
+        }
+    }
+
+    #[tokio::test]
+    async fn tls_min_version_greater_than_max_is_rejected() {
+        let url = make_tls_with_bounds(Some("TLSv1.2"), Some("TLSv1.1"));
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("tls_min_version cannot be greater than tls_max_version"),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn tls_invalid_min_version_is_rejected() {
+        let url = make_tls_with_bounds(Some("TLSv9.9"), None);
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("Invalid tls_min_version"),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn tls_invalid_max_version_is_rejected() {
+        let url = make_tls_with_bounds(None, Some("TLSv9.9"));
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("Invalid tls_max_version"),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn tls13_in_min_version_is_rejected() {
+        let url = make_tls_with_bounds(Some("TLSv1.3"), None);
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("Invalid tls_min_version") && 
+            err.contains("TLS 1.3 is not yet supported in this build"),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn tls13_in_max_version_is_rejected() {
+        let url = make_tls_with_bounds(None, Some("TLSv1.3"));
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("Invalid tls_max_version") && 
+            err.contains("TLS 1.3 is not yet supported in this build"),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn tls_valid_bounds_pass_validation() {
+        let url = make_tls_with_bounds(Some("TLSv1.0"), Some("TLSv1.2"));
+        let err = get_connector_err(url).await;
+        // Valid bounds pass the validation layer; the call fails later at
+        // tls_builder.build() because there is no real TLS backend in unit tests.
+        assert!(
+            !err.contains("tls_min_version")
+                && !err.contains("tls_max_version")
+                && !err.contains("Invalid TLS configuration"),
+            "unexpected validation error: {err}"
+        );
+    }
+
+    #[tokio::test]
+    #[cfg(target_os = "macos")]
+    async fn macos_tls12_floor_enforced() {
+        // On macOS, setting tls_min_version=TLSv1.0 should still result in
+        // TLSv1.2 as the effective minimum. Setting tls_max_version=TLSv1.0
+        // should then fail because the floor (1.2) > max (1.0).
+        let url = make_tls_with_bounds(Some("TLSv1.0"), Some("TLSv1.0"));
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("tls_max_version") && err.contains("effective minimum"),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    #[cfg(not(target_os = "macos"))]
+    async fn non_macos_default_min_is_tls12() {
+        // On non-macOS, the default minimum is TLSv1.2. Setting
+        // tls_max_version=TLSv1.0 should fail because effective min (1.2) > max (1.0).
+        let url = make_tls_with_bounds(None, Some("TLSv1.0"));
+        let err = get_connector_err(url).await;
+        assert!(
+            err.contains("tls_min_version cannot be greater than tls_max_version"),
+            "unexpected error: {err:?}"
+        );
     }
 
     #[tokio::test]
@@ -1396,4 +1515,4 @@ mod tests {
             assert!(!is_safe_identifier(ident));
         }
     }
-}
+}