@cubejs-backend/postgres-driver - npm Package Compare versions

Comparing version 0.19.0 to 0.19.1

CHANGELOG.md

@@ -6,2 +6,13 @@ # Change Log
 
+## [0.19.1](https://github.com/cube-js/cube.js/compare/v0.19.0...v0.19.1) (2020-04-11)
+
+
+### Features
+
+* **postgres-driver:** Allow usage of CUBEJS_DB_SSL_CA parameter in postgres Driver. ([#582](https://github.com/cube-js/cube.js/issues/582)) Thanks to [@gauravlanjekar](https://github.com/gauravlanjekar)! ([158bd10](https://github.com/cube-js/cube.js/commit/158bd10))
+
+
+
+
+
 # [0.19.0](https://github.com/cube-js/cube.js/compare/v0.18.32...v0.19.0) (2020-04-09)
@@ -8,0 +19,0 @@

driver/PostgresDriver.js

@@ -27,2 +27,29 @@ const pg = require('pg');
     this.config = config || {};
+    let ssl;
+
+    const sslOptions = [
+      { name: 'ca', value: 'CUBEJS_DB_SSL_CA' },
+      { name: 'cert', value: 'CUBEJS_DB_SSL_CERT' },
+      { name: 'ciphers', value: 'CUBEJS_DB_SSL_CIPHERS' },
+      { name: 'passphrase', value: 'CUBEJS_DB_SSL_PASSPHRASE' },
+    ];
+
+    if (
+      process.env.CUBEJS_DB_SSL ||
+      process.env.CUBEJS_DB_SSL_REJECT_UNAUTHORIZED ||
+      sslOptions.find(o => !!process.env[o.value])
+    ) {
+      ssl = sslOptions.reduce(
+        (agg, { name, value }) => ({
+          ...agg,
+          ...(process.env[value] ? { [name]: process.env[value] } : {}),
+        }),
+        {}
+      );
+      if (process.env.CUBEJS_DB_SSL_REJECT_UNAUTHORIZED) {
+        ssl.rejectUnauthorized =
+          process.env.CUBEJS_DB_SSL_REJECT_UNAUTHORIZED.toLowerCase() === 'true';
+      }
+    }
+
     this.pool = new Pool({
@@ -36,3 +63,3 @@ max: process.env.CUBEJS_DB_MAX_POOL && parseInt(process.env.CUBEJS_DB_MAX_POOL, 10) || 8,
       password: process.env.CUBEJS_DB_PASS,
-      ssl: (process.env.CUBEJS_DB_SSL || 'false').toLowerCase() === 'true' ? { rejectUnauthorized: true } : undefined,
+      ssl,
       ...config
@@ -39,0 +66,0 @@ });

package.json

@@ -5,3 +5,3 @@ {
   "author": "Statsbot, Inc.",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "repository": {
@@ -33,3 +33,3 @@ "type": "git",
   },
-  "gitHead": "ae0584d2f0c3bda6208597911e135f5bd639ee4f"
+  "gitHead": "2253f316d1676c1032c777e1560433b4c307df7b"
 }

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Improved metrics

Total package byte prevSize

32828

increased by3.4%

Lines of code

143

increased by20.17%

Worsened metrics

Number of low supply chain risk alerts

14

increased by75%

No dependency changes