MSSQL: pool config builder (encrypt on, certificate setting, timeout) #324

New issue

Closed

opened 2026-11-10 08:20:35 +00:00 by david · 2 comments

david commented

2026-11-10 08:20:35 +00:00

Owner

Summary

Build the mssql pool configuration object: encrypt always on, trustServerCertificate from the setting, and the query timeout applied.

Background

Design: encrypt is always on with no setting to turn it off; MSSQL_TRUST_SERVER_CERT=true accepts self-signed certificates and skips the server identity check ([SECURITY RISK]); the default verifies the certificate. The query timeout comes from MSSQL_QUERY_TIMEOUT_MS. The driver is the mssql npm package (built on tedious). Blocked until the Stage 1 gate (#318) passes. TDD. Never hardcode credentials; values come from the parsed env.

Depends on: #321

Documentation Required

docs/reference/mssql/ — https://raw.githubusercontent.com/tediousjs/node-mssql/master/README.md : node-mssql README: config object (server, port, database, user, password, options.encrypt, options.trustServerCertificate, requestTimeout) and pool options. Vendored on main; fetch the URL if absent on your branch.

Implementation Details

Create extensions/mssql/pool-config.ts exporting buildPoolConfig(conn: ConnInfo, settings: { trustServerCert: boolean, queryTimeoutMs: number }) returning the mssql config: server, port, database, user, password, requestTimeout: queryTimeoutMs, options: { encrypt: true, trustServerCertificate: settings.trustServerCert }. Check the README for the exact option names in the installed driver version and use them. encrypt must be the literal true regardless of input. Pure function, no I/O, no connection created here.

Acceptance Criteria

options.encrypt is true in every case.
options.trustServerCertificate is false by default and true only when the setting is true.
The query timeout appears as the driver's request timeout option.
Host, port, database, user and password map from ConnInfo.
A test asserts there is no code path that sets encrypt to false.

Test Plan

node --test extensions/mssql/pool-config.test.ts: a config object for each certificate setting (true and false), assert encrypt: true, the timeout value, and the connection fields.

## Summary Build the `mssql` pool configuration object: `encrypt` always on, `trustServerCertificate` from the setting, and the query timeout applied. ## Background Design: `encrypt` is always on with no setting to turn it off; `MSSQL_TRUST_SERVER_CERT=true` accepts self-signed certificates and skips the server identity check ([SECURITY RISK]); the default verifies the certificate. The query timeout comes from `MSSQL_QUERY_TIMEOUT_MS`. The driver is the `mssql` npm package (built on `tedious`). **Blocked until the Stage 1 gate (#318) passes.** TDD. Never hardcode credentials; values come from the parsed env. **Depends on:** #321 ## Documentation Required - `docs/reference/mssql/` — https://raw.githubusercontent.com/tediousjs/node-mssql/master/README.md : node-mssql README: config object (`server`, `port`, `database`, `user`, `password`, `options.encrypt`, `options.trustServerCertificate`, `requestTimeout`) and pool options. Vendored on `main`; fetch the URL if absent on your branch. ## Implementation Details Create `extensions/mssql/pool-config.ts` exporting `buildPoolConfig(conn: ConnInfo, settings: { trustServerCert: boolean, queryTimeoutMs: number })` returning the `mssql` config: `server`, `port`, `database`, `user`, `password`, `requestTimeout: queryTimeoutMs`, `options: { encrypt: true, trustServerCertificate: settings.trustServerCert }`. Check the README for the exact option names in the installed driver version and use them. `encrypt` must be the literal `true` regardless of input. Pure function, no I/O, no connection created here. ## Acceptance Criteria - [ ] `options.encrypt` is `true` in every case. - [ ] `options.trustServerCertificate` is `false` by default and `true` only when the setting is true. - [ ] The query timeout appears as the driver's request timeout option. - [ ] Host, port, database, user and password map from `ConnInfo`. - [ ] A test asserts there is no code path that sets `encrypt` to `false`. ## Test Plan `node --test extensions/mssql/pool-config.test.ts`: a config object for each certificate setting (true and false), assert `encrypt: true`, the timeout value, and the connection fields.

david added this to the MSSQL: M6 - Runner milestone

2026-11-10 08:20:35 +00:00

david added the

feature

label

2026-11-10 08:20:35 +00:00

david referenced this issue

2026-11-10 08:20:49 +00:00

MSSQL: stream runner with row cap, cancel and timeout #325

david referenced this issue

2026-11-10 08:21:50 +00:00

MSSQL: index.ts wiring (load env, refuse on invalid limits, pool, shutdown) #329

david referenced this issue

2026-11-10 23:43:27 +00:00

MSSQL: write-access check and startup warning (never blocks) #342

david commented

2026-11-10 23:44:17 +00:00

Author

Owner

Update: the "Blocked until the Stage 1 gate (#318) passes" note is superseded. The gate resolved as STOP, and docs/adr/0002-mssql-read-only-credentials-with-minimal-guard.md replaced the parser design. Stage 2 is unblocked. Scope is unchanged. Note that the new write-access check (#342) depends on this issue.

Update: the "Blocked until the Stage 1 gate (#318) passes" note is superseded. The gate resolved as STOP, and `docs/adr/0002-mssql-read-only-credentials-with-minimal-guard.md` replaced the parser design. Stage 2 is unblocked. Scope is unchanged. Note that the new write-access check (#342) depends on this issue.

david referenced this issue

2026-11-10 23:46:59 +00:00

MSSQL spike: write RESULT.md, apply the gate, open the Stage 1 PR #318

david referenced this issue

2026-11-11 00:12:22 +00:00

324: MSSQL: pool config builder (encrypt on, certificate setting, timeout) #348

david closed this issue

2026-11-11 00:12:24 +00:00

david commented

2026-11-11 00:12:24 +00:00

Author

Owner