fix(deploy): validate session migrator TLS mode

docker/core.Dockerfile

@@ -63,8 +63,8 @@ ENV PATH="/opt/venv/bin:/usr/local/bin:$PATH" \
     PI_BIN=pi \
     HOME=/home/thoth
 
-COPY docker/core-entrypoint.sh docker/ensure-pi-trust.mjs /app/docker/
-RUN chmod +x /app/docker/core-entrypoint.sh
+COPY docker/core-entrypoint.sh docker/session-migrate.sh docker/ensure-pi-trust.mjs /app/docker/
+RUN chmod +x /app/docker/core-entrypoint.sh /app/docker/session-migrate.sh
 
 WORKDIR /app/backend
 USER thoth

docker/session-migrate.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# One-shot schema migration only. Validate TLS before reading a secret or composing a URL.
+set -eu
+
+case "${THT_SESSION_DB_SSLMODE:-}" in
+  verify-ca|verify-full) ;;
+  *)
+    echo "THT_SESSION_DB_SSLMODE must be verify-ca or verify-full" >&2
+    exit 2
+    ;;
+esac
+
+require_env() {
+  eval "value=\${$1:-}"
+  if [ -z "$value" ]; then
+    echo "missing required session migrator configuration" >&2
+    exit 2
+  fi
+}
+
+require_env THT_SESSION_DB_HOST
+require_env THT_SESSION_DB_PORT
+require_env THT_SESSION_DB_NAME
+require_env THT_SESSION_MIGRATOR_USER
+require_env THT_SESSION_MIGRATOR_PASSWORD_FILE
+require_env THT_SESSION_DB_SSLROOTCERT
+
+if [ ! -r "$THT_SESSION_MIGRATOR_PASSWORD_FILE" ]; then
+  echo "session migrator credential is unavailable" >&2
+  exit 2
+fi
+export PGPASSWORD="$(cat "$THT_SESSION_MIGRATOR_PASSWORD_FILE")"
+if [ -z "$PGPASSWORD" ]; then
+  echo "session migrator credential is unavailable" >&2
+  exit 2
+fi
+
+exec "${THT_BIN:-/opt/venv/bin/tht}" session migrate --database-url \
+  "postgresql+psycopg2://${THT_SESSION_MIGRATOR_USER}@${THT_SESSION_DB_HOST}:${THT_SESSION_DB_PORT}/${THT_SESSION_DB_NAME}?sslmode=${THT_SESSION_DB_SSLMODE}&sslrootcert=${THT_SESSION_DB_SSLROOTCERT}" \
+  --json

docker/session-migrate.test.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+helper="$root/docker/session-migrate.sh"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+
+if THT_SESSION_DB_SSLMODE=prefer sh "$helper" >"$tmp/invalid.out" 2>&1; then
+  echo "session migrator accepted an unverified TLS mode" >&2
+  exit 1
+fi
+grep -qx 'THT_SESSION_DB_SSLMODE must be verify-ca or verify-full' "$tmp/invalid.out"
+
+printf '%s' password >"$tmp/password"
+cat >"$tmp/tht" <<'EOF'
+#!/bin/sh
+printf '%s\n' "$@" >"$ARGS_FILE"
+EOF
+chmod +x "$tmp/tht"
+
+ARGS_FILE="$tmp/args" \
+THT_BIN="$tmp/tht" \
+THT_SESSION_DB_HOST=sessions-db.internal \
+THT_SESSION_DB_PORT=5432 \
+THT_SESSION_DB_NAME=thoth \
+THT_SESSION_MIGRATOR_USER=thoth_sessions_migrate \
+THT_SESSION_MIGRATOR_PASSWORD_FILE="$tmp/password" \
+THT_SESSION_DB_SSLMODE=verify-full \
+THT_SESSION_DB_SSLROOTCERT=/run/secrets/session_ca.pem \
+sh "$helper"
+
+grep -qx 'session' "$tmp/args"
+grep -qx 'migrate' "$tmp/args"
+grep -qx -- '--database-url' "$tmp/args"
+grep -Fxq 'postgresql+psycopg2://thoth_sessions_migrate@sessions-db.internal:5432/thoth?sslmode=verify-full&sslrootcert=/run/secrets/session_ca.pem' "$tmp/args"
+
+echo "session migrator TLS contract passed."