feat(pg-connection-string): support the sslpassword parameter

docs/pages/features/ssl.mdx

@@ -37,7 +37,7 @@ await pool.end()
 
 ## Usage with `connectionString`
 
-If you plan to use a combination of a database connection string from the environment and SSL settings in the config object directly, then you must avoid including any of `sslcert`, `sslkey`, `sslrootcert`, or `sslmode` in the connection string. If any of these options are used then the `ssl` object is replaced and any additional options provided there will be lost.
+If you plan to use a combination of a database connection string from the environment and SSL settings in the config object directly, then you must avoid including any of `sslcert`, `sslkey`, `sslrootcert`, `sslpassword`, or `sslmode` in the connection string. If any of these options are used then the `ssl` object is replaced and any additional options provided there will be lost.
 
 ```js
 const config = {

packages/pg-connection-string/README.md

@@ -98,6 +98,7 @@ Query parameters follow a `?` character, including the following special query p
  * `sslcert=<filename>` - reads data from the given file and includes the result as `ssl.cert`
  * `sslkey=<filename>` - reads data from the given file and includes the result as `ssl.key`
  * `sslrootcert=<filename>` - reads data from the given file and includes the result as `ssl.ca`
+ * `sslpassword=<password>` - sets `ssl.passphrase`, used to decrypt an encrypted `ssl.key`
 
 A bare relative URL, such as `salesdata`, will indicate a database name while leaving other properties empty.
 

packages/pg-connection-string/index.d.ts

@@ -11,6 +11,7 @@ interface SSLConfig {
   ca?: string
   cert?: string | null
   key?: string
+  passphrase?: string
   rejectUnauthorized?: boolean
 }
 

packages/pg-connection-string/index.js

@@ -74,7 +74,7 @@ function parse(str, options = {}) {
     config.ssl = false
   }
 
-  if (config.sslcert || config.sslkey || config.sslrootcert || config.sslmode) {
+  if (config.sslcert || config.sslkey || config.sslrootcert || config.sslmode || config.sslpassword) {
     config.ssl = {}
   }
 
@@ -99,6 +99,11 @@ function parse(str, options = {}) {
     config.ssl.ca = fs.readFileSync(config.sslrootcert).toString()
   }
 
+  // sslpassword is a literal value rather than a path, so it is not read from disk.
+  if (config.sslpassword) {
+    config.ssl.passphrase = config.sslpassword
+  }
+
   if (options.useLibpqCompat && config.uselibpqcompat) {
     throw new Error('Both useLibpqCompat and uselibpqcompat are set. Please use only one of them.')
   }

packages/pg-connection-string/test/parse.ts

@@ -268,6 +268,31 @@ describe('parse', function () {
     })
   })
 
+  it('configuration parameter sslpassword=password', function () {
+    const connectionString = 'pg:///?sslpassword=MySecretPass'
+    const subject = parse(connectionString)
+    subject.ssl?.should.eql({
+      passphrase: 'MySecretPass',
+    })
+  })
+
+  it('configuration parameter sslpassword alongside sslkey', function () {
+    const connectionString = 'pg:///?sslkey=' + __dirname + '/example.key&sslpassword=MySecretPass'
+    const subject = parse(connectionString)
+    subject.ssl?.should.eql({
+      key: 'example key\n',
+      passphrase: 'MySecretPass',
+    })
+  })
+
+  it('configuration parameter sslpassword is url-decoded', function () {
+    const connectionString = 'pg:///?sslpassword=' + encodeURIComponent('pa ss/word?&=')
+    const subject = parse(connectionString)
+    subject.ssl?.should.eql({
+      passphrase: 'pa ss/word?&=',
+    })
+  })
+
   it('configuration parameter sslmode=no-verify', function () {
     const connectionString = 'pg:///?sslmode=no-verify'
     const subject = parse(connectionString)