feat: add tls session resumption (#1195)

Signed-off-by: ferhat elmas <elmas.ferhat@gmail.com>

Author: ferhatelmas

src/config.ts

@@ -108,6 +108,7 @@ type StorageConfigType = {
   databasePoolURL?: string
   databaseMaxConnections: number
   databaseFreePoolAfterInactivity: number
+  databaseTlsSessionResumption: boolean
   databasePoolDrainTimeout: number
   databaseConnectionTimeout: number
   databaseEnableQueryCancellation: boolean
@@ -491,6 +492,8 @@ export function getConfig(options?: { reload?: boolean }): StorageConfigType {
       getOptionalConfigFromEnv('DATABASE_FREE_POOL_AFTER_INACTIVITY') || (1000 * 60).toString(),
       10
     ),
+    databaseTlsSessionResumption:
+      getOptionalConfigFromEnv('DATABASE_TLS_SESSION_RESUMPTION') === 'true',
     databasePoolDrainTimeout: envPositiveInteger(
       getOptionalConfigFromEnv('DATABASE_POOL_DRAIN_TIMEOUT'),
       30_000

src/internal/database/pg-connection.test.ts

@@ -166,6 +166,24 @@ async function waitForDrainCheck(): Promise<void> {
   await new Promise((resolve) => setImmediate(resolve))
 }
 
+async function loadPgConnectionModuleWithConfig(configOverrides: Record<string, unknown>) {
+  vi.resetModules()
+
+  const configModule = await import('../../config')
+  configModule.getConfig({ reload: true })
+  configModule.mergeConfig({
+    databaseApplicationName: 'storage-test',
+    databaseConnectionTimeout: 3000,
+    databaseFreePoolAfterInactivity: 1000,
+    databaseMaxConnections: 20,
+    databaseSSLRootCert: undefined,
+    databaseTlsSessionResumption: false,
+    ...configOverrides,
+  } as Parameters<typeof configModule.mergeConfig>[0])
+
+  return import('./pg-connection')
+}
+
 describe('getPgCancelConnectionTarget', () => {
   it('uses direct client host and port for TCP cancel connections', () => {
     expect(
@@ -1067,3 +1085,95 @@ describe('PgPoolStrategy', () => {
     }
   })
 })
+
+describe('PgPoolStrategy TLS session resumption wiring', () => {
+  afterEach(() => {
+    vi.resetModules()
+  })
+
+  function createDynamicTestablePgPoolStrategy(PgPoolStrategyCtor: typeof PgPoolStrategy) {
+    return class DynamicTestablePgPoolStrategy extends PgPoolStrategyCtor {
+      getCurrentPoolForTest(): Pool {
+        return this.getPool()
+      }
+    }
+  }
+
+  it('installs the session getter, slot marker, and custom client when enabled with SSL', async () => {
+    const { PgPoolStrategy: DynamicPgPoolStrategy } = await loadPgConnectionModuleWithConfig({
+      databaseSSLRootCert: '<cert>',
+      databaseTlsSessionResumption: true,
+    })
+    const { TlsSessionResumptionClient } = await import('./tls-session-resumption')
+    const DynamicTestablePgPoolStrategy = createDynamicTestablePgPoolStrategy(DynamicPgPoolStrategy)
+    const strategy = new DynamicTestablePgPoolStrategy(
+      createPoolStrategySettings({
+        dbUrl: 'postgres://postgres:postgres@1.2.3.4:5432/postgres',
+      })
+    )
+
+    try {
+      const pool = strategy.getCurrentPoolForTest()
+      const ssl = pool.options.ssl as object
+
+      expect(ssl).toBeDefined()
+      expect(pool.options.Client).toBe(TlsSessionResumptionClient)
+
+      const sessionDescriptor = Object.getOwnPropertyDescriptor(ssl, 'session')
+      expect(sessionDescriptor?.get).toBeInstanceOf(Function)
+      expect(sessionDescriptor?.enumerable).toBe(true)
+      expect(sessionDescriptor?.configurable).toBe(true)
+      expect(sessionDescriptor?.get?.call(ssl)).toBeUndefined()
+
+      expect(Object.getOwnPropertySymbols(ssl)).toHaveLength(1)
+      const tlsConnectOptions = Object.assign({}, ssl)
+      expect(Object.getOwnPropertySymbols(tlsConnectOptions)).toHaveLength(0)
+      expect(Object.prototype.hasOwnProperty.call(tlsConnectOptions, 'session')).toBe(true)
+    } finally {
+      await strategy.destroy()
+    }
+  })
+
+  it('leaves SSL options untouched when the feature flag is disabled', async () => {
+    const { PgPoolStrategy: DynamicPgPoolStrategy } = await loadPgConnectionModuleWithConfig({
+      databaseSSLRootCert: '<cert>',
+      databaseTlsSessionResumption: false,
+    })
+    const DynamicTestablePgPoolStrategy = createDynamicTestablePgPoolStrategy(DynamicPgPoolStrategy)
+    const strategy = new DynamicTestablePgPoolStrategy(
+      createPoolStrategySettings({
+        dbUrl: 'postgres://postgres:postgres@1.2.3.4:5432/postgres',
+      })
+    )
+
+    try {
+      const pool = strategy.getCurrentPoolForTest()
+      const ssl = pool.options.ssl as object
+
+      expect(ssl).toBeDefined()
+      expect(pool.options.Client).toBeUndefined()
+      expect(Object.getOwnPropertyDescriptor(ssl, 'session')).toBeUndefined()
+      expect(Object.getOwnPropertySymbols(ssl)).toHaveLength(0)
+    } finally {
+      await strategy.destroy()
+    }
+  })
+
+  it('does not install the custom client when SSL settings are absent', async () => {
+    const { PgPoolStrategy: DynamicPgPoolStrategy } = await loadPgConnectionModuleWithConfig({
+      databaseSSLRootCert: undefined,
+      databaseTlsSessionResumption: true,
+    })
+    const DynamicTestablePgPoolStrategy = createDynamicTestablePgPoolStrategy(DynamicPgPoolStrategy)
+    const strategy = new DynamicTestablePgPoolStrategy(createPoolStrategySettings())
+
+    try {
+      const pool = strategy.getCurrentPoolForTest()
+
+      expect(pool.options.ssl).toBeUndefined()
+      expect(pool.options.Client).toBeUndefined()
+    } finally {
+      await strategy.destroy()
+    }
+  })
+})

src/internal/database/pg-connection.ts

@@ -13,6 +13,12 @@ import {
   TenantConnectionOptions,
 } from './pool'
 import { getSslSettings } from './ssl'
+import {
+  createTlsSessionSlot,
+  installTlsSessionResumption,
+  TlsSessionResumptionClient,
+  type TlsSessionSlot,
+} from './tls-session-resumption'
 
 const {
   databaseApplicationName,
@@ -22,6 +28,7 @@ const {
   databasePoolDrainTimeout,
   databaseSSLRootCert,
   databaseStatementTimeout,
+  databaseTlsSessionResumption,
 } = getConfig()
 
 pg.types.setTypeParser(20, 'text', parseInt)
@@ -86,6 +93,7 @@ export type PgCancelConnectionTarget =
 
 export class PgPoolStrategy {
   protected pool?: Pool
+  protected tlsSession?: TlsSessionSlot
 
   constructor(protected readonly options: TenantConnectionOptions) {}
 
@@ -176,14 +184,21 @@ export class PgPoolStrategy {
       databaseSSLRootCert,
     })
 
+    const ssl = sslSettings ? { ...sslSettings } : undefined
+    if (databaseTlsSessionResumption && ssl) {
+      this.tlsSession ??= createTlsSessionSlot()
+      installTlsSessionResumption(ssl, this.tlsSession)
+    }
+
     return attachPgPoolErrorHandler(
       new Pool({
         min: 0,
         max: settings.maxConnections,
         connectionString: settings.dbUrl,
         connectionTimeoutMillis: databaseConnectionTimeout,
         idleTimeoutMillis: settings.idleTimeoutMillis,
-        ssl: sslSettings ? { ...sslSettings } : undefined,
+        ssl,
+        Client: databaseTlsSessionResumption && ssl ? TlsSessionResumptionClient : undefined,
         application_name: databaseApplicationName,
         options: settings.searchPath
           ? `-c search_path=${settings.searchPath.join(',')}`