fix: complete diagnostic extension remediation

backend/src/workspaces/diagnostics.ts

@@ -50,6 +50,7 @@ export interface ConnectorDiagnosticRequest {
   user?: string;
   credentialFile?: string;
   tlsCaFile?: string;
+  tlsServername?: string;
   resource: DiagnosticResource;
   timeoutMs: number;
   signal: AbortSignal;
@@ -87,6 +88,7 @@ export interface VectorDiagnosticRequest {
   baseUrl?: string;
   credentialFile?: string;
   tlsCaFile?: string;
+  tlsServername?: string;
   diagnostic?: RestDiagnosticRequest & {
     response: { collection: string; dimensions: string; distance: string };
   };
@@ -147,7 +149,7 @@ export interface DatabaseDiagnosticClient {
 
 export interface DatabaseDiagnosticClientFactory {
   connect(request: {
-    host: string; port: number; database: string; user: string; credentialFile: string; tlsCaFile?: string; signal: AbortSignal;
+    host: string; port: number; database: string; user: string; credentialFile: string; tlsCaFile?: string; tlsServername?: string; signal: AbortSignal;
   }): Promise<DatabaseDiagnosticClient>;
 }
 
@@ -298,13 +300,15 @@ export function createConcreteDiagnosticAdapters(
     },
   };
   const databaseClient = dependencies.databaseClient ?? {
-    async connect(request: { host: string; port: number; database: string; user: string; credentialFile: string; tlsCaFile?: string; signal: AbortSignal }) {
+    async connect(request: { host: string; port: number; database: string; user: string; credentialFile: string; tlsCaFile?: string; tlsServername?: string; signal: AbortSignal }) {
       const client = new Client({
         host: request.host, port: request.port, database: request.database, user: request.user,
         password: (await readFile(request.credentialFile, "utf8")).trim(),
-        ssl: request.tlsCaFile
-          ? { ca: await readFile(request.tlsCaFile, "utf8"), rejectUnauthorized: true }
-          : { rejectUnauthorized: true },
+        ssl: {
+          ...(request.tlsCaFile ? { ca: await readFile(request.tlsCaFile, "utf8") } : {}),
+          ...(request.tlsServername ? { servername: request.tlsServername } : {}),
+          rejectUnauthorized: true,
+        },
         connectionTimeoutMillis: 5_000,
       });
       const abort = () => { void client.end(); };
@@ -330,7 +334,8 @@ export function createConcreteDiagnosticAdapters(
       if (!database || !schema) throw new Error("direct probe failed");
       const client = await databaseClient.connect({
         host: request.host, port: request.port, database, user: request.user,
-        credentialFile: request.credentialFile, tlsCaFile: request.tlsCaFile, signal: request.signal,
+        credentialFile: request.credentialFile, tlsCaFile: request.tlsCaFile,
+        tlsServername: request.tlsServername, signal: request.signal,
       });
       try {
         const result = await client.query("SELECT current_database() AS database, current_schema() AS schema", []);
@@ -398,7 +403,8 @@ export function createConcreteDiagnosticAdapters(
         }
         const client = await databaseClient.connect({
           host: request.host, port: request.port, database: resource.database, user: request.user,
-          credentialFile: request.credentialFile, tlsCaFile: request.tlsCaFile, signal: request.signal,
+          credentialFile: request.credentialFile, tlsCaFile: request.tlsCaFile,
+          tlsServername: request.tlsServername, signal: request.signal,
         });
         try {
           const metadata = await client.query(
@@ -584,15 +590,14 @@ function connectorRequest(
       collection: workspace.semantic_index.vector_store.collection,
     };
   const field = (suffix: string) => bindingName(workspace, contractRole, suffix);
-  const credentialFile = values[field(binding.transport === "rest_api" ? "API_KEY_FILE" : "PASSWORD_FILE")];
-  if (credentialFile === undefined) return undefined;
-
   if (binding.transport === "rest_api") {
     const baseUrl = values[field("BASE_URL")];
     const diagnostic = role === "dwh"
       ? workspace.diagnostics?.dwh_rest
       : workspace.diagnostics?.vector_rest?.metadata;
     if (baseUrl === undefined || diagnostic === undefined) return undefined;
+    const credentialFile = diagnostic.auth === "none" ? undefined : values[field("API_KEY_FILE")];
+    if (diagnostic.auth !== "none" && credentialFile === undefined) return undefined;
     return {
       role,
       transport: "rest_api",
@@ -621,6 +626,9 @@ function connectorRequest(
     };
   }
 
+  const credentialFile = values[field("PASSWORD_FILE")];
+  if (credentialFile === undefined) return undefined;
+
   const host = values[field("HOST")];
   const port = numericBinding(values, field("PORT"));
   const user = values[field("USER")];
@@ -660,6 +668,7 @@ function tunnelProbeRequest(
     user,
     credentialFile: password,
     tlsCaFile: binding.values[bindingName(workspace, contractRole, "TLS_CA_FILE")],
+    tlsServername: binding.values[bindingName(workspace, contractRole, "SSH_TARGET_HOST")],
     resource: role === "dwh"
       ? { database: workspace.dwh.database, schema: workspace.dwh.schema }
       : {
@@ -710,7 +719,8 @@ export function createWorkspaceDiagnoser(
                 tunneledVectorMetadata = await adapters.inspectVector({
                   transport: "ssh_tunnel", host: tunneledRequest.host, port: tunneledRequest.port,
                   user: tunneledRequest.user, credentialFile: tunneledRequest.credentialFile,
-                  tlsCaFile: tunneledRequest.tlsCaFile, resource: tunneledRequest.resource,
+                  tlsCaFile: tunneledRequest.tlsCaFile, tlsServername: tunneledRequest.tlsServername,
+                  resource: tunneledRequest.resource,
                   collection: canonical.semantic_index.vector_store.collection,
                   dimensions: canonical.semantic_index.vector_store.dimensions,
                   distance: canonical.semantic_index.vector_store.distance,

backend/src/workspaces/runtime-renderer.ts

@@ -45,11 +45,12 @@ function legacyDirectConnection(
 function legacyRestEndpoint(
   binding: ResolvedBinding,
   names: { baseUrl: string; apiKeyFile: string; tlsCaFile: string },
+  requiresCredential: boolean,
 ): Record<string, unknown> {
   const endpoint: Record<string, unknown> = {
     base_url: requireBinding(binding, names.baseUrl),
-    api_key_file: requireBinding(binding, names.apiKeyFile),
   };
+  if (requiresCredential) endpoint.api_key_file = requireBinding(binding, names.apiKeyFile);
   const tlsCaFile = bindingValue(binding, names.tlsCaFile);
   if (tlsCaFile !== undefined) endpoint.ssl_ca_file = tlsCaFile;
   return endpoint;
@@ -124,7 +125,7 @@ export function renderRuntimeConfig(
     const rest = legacyRestEndpoint(bindings.dwh, {
       baseUrl: name("DWH", "BASE_URL"), apiKeyFile: name("DWH", "API_KEY_FILE"),
       tlsCaFile: name("DWH", "TLS_CA_FILE"),
-    });
+    }, canonical.diagnostics?.dwh_rest?.auth !== "none");
     rendered.rest = rest;
     rendered.dwh = { type: "thoth_rest", database: dwhIdentity, endpoint: rest };
   } else {
@@ -136,7 +137,7 @@ export function renderRuntimeConfig(
     const vectorRest = legacyRestEndpoint(bindings.vector, {
       baseUrl: name("VECTOR", "BASE_URL"), apiKeyFile: name("VECTOR", "API_KEY_FILE"),
       tlsCaFile: name("VECTOR", "TLS_CA_FILE"),
-    });
+    }, canonical.diagnostics?.vector_rest?.metadata.auth !== "none");
     rendered.vector_rest = vectorRest;
     rendered.vectors = { type: "thoth_vector_http", reader: vectorRest };
   } else {