Update CI workflows and URL parsing for TLS params

Author: arab971

.github/workflows/build-engines-apple-intel-template.yml

@@ -39,7 +39,7 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - run: |
-          cargo build --release -p schema-engine-cli -p prisma-fmt
+          cargo build --release -p schema-engine-cli -p prisma-fmt --features vendored-openssl
 
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/build-engines-apple-silicon-template.yml

@@ -38,7 +38,7 @@ jobs:
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - run: |
-          cargo build --target=aarch64-apple-darwin --release -p schema-engine-cli -p prisma-fmt
+          cargo build --target=aarch64-apple-darwin --release -p schema-engine-cli -p prisma-fmt --features vendored-openssl
 
       - uses: actions/upload-artifact@v4
         with:

quaint/src/connector/postgres/url.rs

@@ -10,6 +10,9 @@ use crate::error::{Error, ErrorKind};
 #[cfg(feature = "postgresql-native")]
 use tokio_postgres::config::{ChannelBinding, SslMode};
 
+#[cfg(feature = "postgresql-native")]
+use native_tls::Protocol;
+
 #[derive(Clone)]
 pub(crate) struct Hidden<T>(pub(crate) T);
 
@@ -31,6 +34,10 @@ pub struct SslParams {
     pub(crate) identity_file: Option<String>,
     pub(crate) identity_password: Hidden<Option<String>>,
     pub(crate) ssl_accept_mode: SslAcceptMode,
+    #[cfg(feature = "postgresql-native")]
+    pub(crate) tls_min_version: Option<native_tls::Protocol>,
+    #[cfg(feature = "postgresql-native")]
+    pub(crate) tls_max_version: Option<native_tls::Protocol>,
 }
 
 #[derive(Debug, Clone, Copy)]
@@ -290,6 +297,17 @@ impl PostgresNativeUrl {
         self.flavour = flavour;
     }
 
+    #[cfg(feature = "postgresql-native")]
+    fn parse_tls_protocol(v: &str) -> Result<Protocol, Error> {
+        match v.to_lowercase().as_str() {
+            "tlsv1" | "tls1" | "tls1.0" => Ok(Protocol::Tlsv10),
+            "tlsv1.1" | "tls1.1" => Ok(Protocol::Tlsv11),
+            "tlsv1.2" | "tls1.2" => Ok(Protocol::Tlsv12),
+            _ => Err(Error::builder(ErrorKind::InvalidConnectionArguments)
+                .build()),
+        }
+    }
+
     fn parse_query_params(url: &Url) -> Result<PostgresUrlQueryParams, Error> {
         #[cfg(feature = "postgresql-native")]
         let mut ssl_mode = SslMode::Prefer;
@@ -313,6 +331,10 @@ impl PostgresNativeUrl {
         let mut max_idle_connection_lifetime = Some(Duration::from_secs(300));
         let mut options = None;
         let mut single_use_connections = false;
+        #[cfg(feature = "postgresql-native")]
+        let mut tls_min_version: Option<Protocol> = None;
+        #[cfg(feature = "postgresql-native")]
+        let mut tls_max_version: Option<Protocol> = None;
 
         for (k, v) in url.query_pairs() {
             match k.as_ref() {
@@ -451,6 +473,14 @@ impl PostgresNativeUrl {
                 "options" => {
                     options = Some(v.to_string());
                 }
+                #[cfg(feature = "postgresql-native")]
+                "tls_min_version" => {
+                    tls_min_version = Some(Self::parse_tls_protocol(&v)?);
+                }
+                #[cfg(feature = "postgresql-native")]
+                "tls_max_version" => {
+                    tls_max_version = Some(Self::parse_tls_protocol(&v)?);
+                }
                 "single_use_connections" => {
                     single_use_connections = v
                         .parse()
@@ -468,6 +498,10 @@ impl PostgresNativeUrl {
                 identity_file,
                 ssl_accept_mode,
                 identity_password: Hidden(identity_password),
+                #[cfg(feature = "postgresql-native")]
+                tls_min_version,
+                #[cfg(feature = "postgresql-native")]
+                tls_max_version,
             },
             connection_limit,
             schema,