feat: 支持 MySQL 公网 TLS CA 校验 (#86)

admin/config/config_test.go

@@ -45,6 +45,8 @@ database:
   name: autobuy
   user: buy
   password: "yaml-secret"
+  tls_mode: verify_ca
+  tls_ca: certs/mysql84-ca.pem
 `)
 
 	cfg, err := loadDatabaseFromPath(path)
@@ -57,6 +59,9 @@ database:
 	if cfg.Password != "yaml-secret" {
 		t.Fatal("YAML 数据库密码没有原样读出")
 	}
+	if cfg.TLSMode != DatabaseTLSVerifyCA || cfg.TLSCA != "certs/mysql84-ca.pem" {
+		t.Fatalf("YAML TLS 配置读取错误：%s", cfg)
+	}
 }
 
 func TestLoadDatabaseFromPath_环境变量按字段覆盖YAML(t *testing.T) {
@@ -101,6 +106,62 @@ func TestLoadDatabaseFromPath_文件不存在时完整环境变量仍可启动(t
 	if cfg.Host != "127.0.0.1" || cfg.Port != "3307" {
 		t.Fatalf("线上环境变量模式应该保留安全默认地址，实际：%s", cfg)
 	}
+	if cfg.TLSMode != DatabaseTLSDisabled {
+		t.Fatalf("未配置 TLS 时应该保持本机连接兼容，实际：%s", cfg)
+	}
+}
+
+func TestLoadDatabaseFromPath_TLS环境变量覆盖YAML(t *testing.T) {
+	clearDatabaseEnv(t)
+	t.Setenv(databaseTLSModeEnv, DatabaseTLSVerifyCA)
+	t.Setenv(databaseTLSCAEnv, `D:\certs\mysql-ca.pem`)
+	path := writeConfigFile(t, `
+database:
+  name: autobuy
+  user: buy
+  password: "yaml-secret"
+  tls_mode: disabled
+`)
+
+	cfg, err := loadDatabaseFromPath(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.TLSMode != DatabaseTLSVerifyCA || cfg.TLSCA != `D:\certs\mysql-ca.pem` {
+		t.Fatalf("TLS 环境变量没有覆盖 YAML：%s", cfg)
+	}
+}
+
+func TestLoadDatabaseFromPath_TLS模式校验(t *testing.T) {
+	clearDatabaseEnv(t)
+	path := writeConfigFile(t, `
+database:
+  name: autobuy
+  user: buy
+  password: "yaml-secret"
+  tls_mode: preferred
+`)
+
+	_, err := loadDatabaseFromPath(path)
+	if err == nil || !strings.Contains(err.Error(), "只能是 disabled 或 verify_ca") {
+		t.Fatalf("应该拒绝可能回退明文的 TLS 模式，实际：%v", err)
+	}
+}
+
+func TestLoadDatabaseFromPath_VerifyCA必须配置证书(t *testing.T) {
+	clearDatabaseEnv(t)
+	path := writeConfigFile(t, `
+database:
+  name: autobuy
+  user: buy
+  password: "yaml-secret"
+  tls_mode: verify_ca
+`)
+
+	_, err := loadDatabaseFromPath(path)
+	if err == nil || !strings.Contains(err.Error(), databaseTLSCAEnv) {
+		t.Fatalf("verify_ca 缺少 CA 时应该明确报错，实际：%v", err)
+	}
 }
 
 func clearDatabaseEnv(t *testing.T) {
@@ -111,6 +172,8 @@ func clearDatabaseEnv(t *testing.T) {
 		databaseNameEnv,
 		databaseUserEnv,
 		databasePasswordEnv,
+		databaseTLSModeEnv,
+		databaseTLSCAEnv,
 	} {
 		t.Setenv(name, "")
 	}