fix(db): add more options for SSL connection, add envvar for base64 db cert

[waleedlatif1]

Summary

add more options for SSL connection, add envvar for base64 db cert. for users who don't set anything, nothing changes but for those who set DATABASE_SSL to non-nil value, we respect their option

Type of Change

• New feature

Testing

Manually.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
sim	Ready	Preview	Comment	Oct 2, 2025 10:38pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Oct 2, 2025 10:38pm

[greptile-apps]

Greptile Overview

Summary

This PR significantly enhances PostgreSQL SSL connection configuration across the entire database layer. The key change transforms the binary `DATABASE_SSL` boolean environment variable into a comprehensive enum supporting PostgreSQL's standard SSL modes: `'disable'`, `'prefer'`, `'require'`, `'verify-ca'`, and `'verify-full'`. Additionally, a new `DATABASE_SSL_CA` environment variable is introduced to support base64-encoded CA certificates for SSL verification.

The implementation spans multiple files including the main database configuration (packages/db/index.ts), socket server operations (apps/sim/socket-server/database/operations.ts), migration scripts, and administrative tools. Each file implements a consistent getSSLConfig() function that handles the different SSL modes appropriately:

• 'disable' returns false (no SSL)
• 'prefer' returns 'prefer' string (attempt SSL, fallback to no SSL)
• 'require' sets rejectUnauthorized = false (encrypted but doesn't verify certificates)
• 'verify-ca' and 'verify-full' set rejectUnauthorized = true with optional CA certificate support

The changes maintain strict backward compatibility - users without DATABASE_SSL configured will experience no behavioral changes, while those who set it gain granular control over SSL security levels. The base64 encoding approach for CA certificates enables easy deployment in containerized environments where certificate files are difficult to mount.

Additionally, the PR includes some unrelated UI improvements: preloading data on navigation hover in the settings modal and refactoring the billing notifications toggle to use centralized state management via useGeneralStore.

Important Files Changed

Changed Files

Filename	Score	Overview
apps/sim/lib/env.ts	5/5	Enhanced DATABASE_SSL from boolean to enum with proper PostgreSQL SSL modes and added DATABASE_SSL_CA validation
packages/db/index.ts	3/5	Implemented SSL configuration with getSSLConfig function but uses 'any' type which bypasses TypeScript safety
packages/db/scripts/migrate-deployment-versions.ts	4/5	Added comprehensive SSL configuration support with proper error handling and backward compatibility
apps/sim/socket-server/database/operations.ts	4/5	Consistent SSL configuration implementation replacing isTruthy function with proper mode handling
apps/sim/socket-server/rooms/manager.ts	3/5	SSL configuration added but 'require' mode sets rejectUnauthorized=false which may be insecure
packages/db/scripts/register-sso-provider.ts	4/5	Proper SSL configuration implementation with comprehensive mode support and error handling
packages/db/scripts/deregister-sso-provider.ts	4/5	New script with consistent SSL configuration patterns and both targeted and bulk deletion capabilities
apps/sim/.env.example	4/5	Updated documentation with clear SSL mode options and base64 certificate generation instructions
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/settings-navigation/settings-navigation.tsx	3/5	Added data preloading on hover but seems unrelated to SSL database changes
apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-modal/components/subscription/subscription.tsx	4/5	Refactored to use centralized state management with proper loading states and error handling

Confidence score: 4/5

• This PR is generally safe to merge with some minor concerns around type safety and security configuration
• Score reflects comprehensive SSL implementation but points deducted for any type usage and potentially insecure 'require' mode configuration
• Pay close attention to packages/db/index.ts and socket-server files for type safety and SSL security configurations

_{10 files reviewed, 9 comments}

_{Edit Code Review Agent Settings | Greptile}