<commit_before>package com.twitter.finagle.postgresql

import com.twitter.finagle.PostgreSql
import com.twitter.finagle.ssl.TrustCredentials
import com.twitter.finagle.ssl.client.SslClientConfiguration
import io.zonky.test.db.postgres.embedded.EmbeddedPostgres

class TlsSpec extends PgSqlSpec with EmbeddedPgSqlEach with ResourceFileSpec {

  def configureTls(builder: EmbeddedPostgres.Builder): EmbeddedPostgres.Builder =
    builder
      .setServerConfig("ssl", "true")
      .setServerConfig("ssl_cert_file", toTmpFile("/server.crt").getAbsolutePath)
      .setServerConfig("ssl_key_file", toTmpFile("/server.key").getAbsolutePath)

  def withTls(client: PostgreSql.Client): PostgreSql.Client =
    client.withTransport.tls(SslClientConfiguration(trustCredentials = TrustCredentials.Insecure))

  "TLS" should {

    "support tls" in embeddedPsql(configureTls, withTls) { (_, client) =>
      client.toService(Request.Sync)
        .map { response =>
          response must beEqualTo(Response.Ready)
        }
    }

    "handle unsupported tls" in embeddedPsql(identity, withTls) { (_, client) =>
      client.toService(Request.Sync)
        .liftToTry
        .map { response =>
          response.asScala must beAFailedTry(beEqualTo(PgSqlTlsUnsupportedError))
        }
    }
  }
}<commit_msg>Use docker for TLS specs.<commit_after>package com.twitter.finagle.postgresql

import com.spotify.docker.client.messages.HostConfig
import com.twitter.finagle.PostgreSql
import com.twitter.finagle.ssl.TrustCredentials
import com.twitter.finagle.ssl.client.SslClientConfiguration
import com.whisk.docker.testkit.ContainerSpec

class TlsSpec extends PgSqlIntegrationSpec with ResourceFileSpec {

  override def configure(spec: ContainerSpec): ContainerSpec = {
    spec
      .withVolumeBindings(
        HostConfig.Bind.builder()
          .from(toTmpFile("/server.crt").getAbsolutePath)
          .to("/certs/server.crt")
          .readOnly(true)
          .build(),
        HostConfig.Bind.builder()
          .from(toTmpFile("/server.key").getAbsolutePath)
          .to("/certs/server.key")
          .readOnly(true)
          .build()
      )
      .withCommand(
        "-c", "ssl=true",
        "-c", "ssl_cert_file=/certs/server.crt",
        "-c", "ssl_key_file=/certs/server.key",
      )
  }

  def withTls(client: PostgreSql.Client): PostgreSql.Client =
    client.withTransport.tls(SslClientConfiguration(trustCredentials = TrustCredentials.Insecure))

  "TLS" should {

    "support tls" in withClient(cfg = withTls) { client =>
      client.toService(Request.Sync)
        .map { response =>
          response must beEqualTo(Response.Ready)
        }
    }
  }
}

class MissingTlsSpec extends PgSqlIntegrationSpec with ResourceFileSpec {

  def withTls(client: PostgreSql.Client): PostgreSql.Client =
    client.withTransport.tls(SslClientConfiguration(trustCredentials = TrustCredentials.Insecure))

  "TLS" should {
    "handle unsupported tls" in withClient(cfg = withTls) { client =>
      client.toService(Request.Sync)
        .liftToTry
        .map { response =>
          response.asScala must beAFailedTry(beEqualTo(PgSqlTlsUnsupportedError))
        }
    }
  }
}
{'fraction_non_alphanumeric': 0.11027568922305764, 'fraction_numerical': 0.0, 'mean_word_length': 3.367989056087551, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1893212', 'n_tokens_mistral': 998, 'n_tokens_neox': 980, 'n_words': 157}