Allow users to pass certs with PG environment variables

If PGSSLMODE is specified and is either require, verify-ca or verify-full,
then the PGSSLROOTCERT, PGSSLCERT, and PGSSLKEY environment variables
will be checked for certificate paths and used to connect.

Author: RichardJCai

Diff for: packages/pg/lib/connection-parameters.js

@@ -1,6 +1,7 @@
 'use strict'
 
 var dns = require('dns')
+var fs = require('fs')
 
 var defaults = require('./defaults')
 
@@ -23,10 +24,15 @@ var readSSLConfigFromEnvironment = function () {
     case 'disable':
       return false
     case 'prefer':
+      return true
     case 'require':
     case 'verify-ca':
     case 'verify-full':
-      return true
+      return {
+        ca: process.env.PGSSLROOTCERT ? fs.readFileSync(process.env.PGSSLROOTCERT).toString() : undefined,
+        key: process.env.PGSSLKEY ? fs.readFileSync(process.env.PGSSLKEY).toString() : undefined,
+        cert: process.env.PGSSLCERT ? fs.readFileSync(process.env.PGSSLCERT).toString() : undefined,
+      }
     case 'no-verify':
       return { rejectUnauthorized: false }
   }

Diff for: packages/pg/test/integration/connection-pool/tls-tests.js

@@ -9,13 +9,9 @@ const suite = new helper.Suite()
 
 if (process.env.PG_CLIENT_CERT_TEST) {
   suite.testAsync('client certificate', async () => {
-    const pool = new pg.Pool({
-      ssl: {
-        ca: fs.readFileSync(process.env.PGSSLROOTCERT),
-        cert: fs.readFileSync(process.env.PGSSLCERT),
-        key: fs.readFileSync(process.env.PGSSLKEY),
-      },
-    })
+    // PGSSLROOTCERT, PGSSLCERT, and PGSSLKEY are all set as environment
+    // variables in .travis.yml
+    const pool = new pg.Pool()
 
     await pool.query('SELECT 1')
     await pool.end()

Diff for: packages/pg/test/unit/connection-parameters/environment-variable-tests.js

@@ -117,9 +117,9 @@ testVal('', false)
 testVal('disable', false)
 testVal('allow', false)
 testVal('prefer', true)
-testVal('require', true)
-testVal('verify-ca', true)
-testVal('verify-full', true)
+testVal('require', { ca: undefined, cert: undefined, key: undefined })
+testVal('verify-ca', { ca: undefined, cert: undefined, key: undefined })
+testVal('verify-full', { ca: undefined, cert: undefined, key: undefined })
 testVal('no-verify', { rejectUnauthorized: false })
 
 // restore process.env