feat: add data:pg:get-ca (#3880)

* feat: add data pg get-ca command

* add support for common runtime region alias names

* fix: use standard postgres certificate directory

* test: use platform-specific certificate paths

* fix: handle region lookup errors consistently

* refactor: hide get ca implementation methods

* refactor: use native fetch for get ca

---------

Co-authored-by: Johnny Winn <88165065+heroku-johnny@users.noreply.github.com>

Author: jdowning

src/commands/data/pg/get-ca.ts

@@ -0,0 +1,73 @@
+import {Command, flags} from '@heroku-cli/command'
+import * as Heroku from '@heroku-cli/schema'
+import fs from 'fs-extra'
+import os from 'node:os'
+import path from 'node:path'
+
+const RDS_CERTIFICATE_HOST = 'https://truststore.pki.rds.amazonaws.com'
+const REGION_ALIASES: Record<string, string> = {
+  eu: 'eu-west-1',
+  us: 'us-east-1',
+}
+
+export default class DataPgGetCa extends Command {
+  static description = 'download the RDS CA bundle for a Heroku region'
+  static examples = [
+    '<%= config.bin %> <%= command.id %> --region virginia',
+    '<%= config.bin %> <%= command.id %> --region global',
+  ]
+  static flags = {
+    region: flags.string({
+      description: 'Heroku region or global for the AWS global CA bundle',
+      required: true,
+    }),
+  }
+
+  public async run(): Promise<void> {
+    const {flags} = await this.parse(DataPgGetCa)
+    let destination = ''
+
+    try {
+      destination = this.destinationDirectory()
+      const awsRegion = flags.region === 'global' ? 'global' : await this.awsRegion(flags.region)
+      const fileName = `${awsRegion}-bundle.pem`
+      destination = path.join(destination, fileName)
+      const url = `${RDS_CERTIFICATE_HOST}/${awsRegion}/${fileName}`
+      const certificate = await this.download(url)
+      await fs.outputFile(destination, certificate, {mode: 0o600})
+      this.log(`RDS CA bundle retrieved successfully: ${destination}`)
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      this.error(`Unable to retrieve the RDS CA bundle at ${destination}: ${message}`)
+    }
+  }
+
+  private async awsRegion(herokuRegion: string): Promise<string> {
+    if (REGION_ALIASES[herokuRegion]) return REGION_ALIASES[herokuRegion]
+
+    const {body: regions} = await this.heroku.get<Heroku.Region[]>('/regions')
+    const region = regions.find(candidate => candidate.name === herokuRegion)
+    const awsRegion = region?.provider?.region
+
+    if (!awsRegion) throw new Error(`${herokuRegion} is not a Heroku region backed by AWS.`)
+
+    return awsRegion
+  }
+
+  private destinationDirectory(): string {
+    if (process.platform === 'win32') {
+      if (!process.env.APPDATA) throw new Error('APPDATA is not set; unable to determine the PostgreSQL certificate directory.')
+
+      return path.join(process.env.APPDATA, 'postgresql')
+    }
+
+    return path.join(os.homedir(), '.postgresql')
+  }
+
+  private async download(url: string): Promise<Buffer> {
+    const response = await fetch(url)
+    if (!response.ok) throw new Error(`AWS RDS returned ${response.status} ${response.statusText}.`)
+
+    return Buffer.from(await response.arrayBuffer())
+  }
+}

test/unit/commands/data/pg/get-ca.unit.test.ts

@@ -0,0 +1,123 @@
+import {runCommand} from '@heroku-cli/test-utils'
+import {expect} from 'chai'
+import fs from 'fs-extra'
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  it,
+} from 'mocha'
+import nock from 'nock'
+import os from 'node:os'
+import path from 'node:path'
+import {restore, SinonStub, stub} from 'sinon'
+
+import DataPgGetCa from '../../../../../src/commands/data/pg/get-ca.js'
+
+describe('data:pg:get-ca', function () {
+  const certificate = '-----BEGIN CERTIFICATE-----\ncertificate\n-----END CERTIFICATE-----\n'
+  const destinationDirectory = () => process.platform === 'win32'
+    ? path.join(process.env.APPDATA ?? '', 'postgresql')
+    : path.join(os.homedir(), '.postgresql')
+  let outputFileStub: SinonStub
+
+  beforeEach(function () {
+    outputFileStub = stub(fs, 'outputFile').resolves()
+  })
+
+  afterEach(function () {
+    restore()
+    nock.cleanAll()
+  })
+
+  it('downloads the CA bundle for an AWS-backed Heroku region', async function () {
+    nock('https://api.heroku.com')
+      .get('/regions')
+      .reply(200, [{name: 'virginia', provider: {region: 'us-east-1'}}])
+    nock('https://truststore.pki.rds.amazonaws.com')
+      .get('/us-east-1/us-east-1-bundle.pem')
+      .reply(200, certificate)
+
+    const {stdout} = await runCommand(DataPgGetCa, ['--region', 'virginia'])
+    const destination = path.join(destinationDirectory(), 'us-east-1-bundle.pem')
+
+    expect(outputFileStub.calledOnceWith(
+      destination,
+      Buffer.from(certificate),
+      {mode: 0o600},
+    )).to.be.true
+    expect(stdout).to.equal(`RDS CA bundle retrieved successfully: ${destination}\n`)
+  })
+
+  it('downloads the AWS global CA bundle without requesting Heroku regions', async function () {
+    nock('https://truststore.pki.rds.amazonaws.com')
+      .get('/global/global-bundle.pem')
+      .reply(200, certificate)
+
+    const {stdout} = await runCommand(DataPgGetCa, ['--region', 'global'])
+    const destination = path.join(destinationDirectory(), 'global-bundle.pem')
+
+    expect(outputFileStub.calledOnceWith(
+      destination,
+      Buffer.from(certificate),
+      {mode: 0o600},
+    )).to.be.true
+    expect(stdout).to.equal(`RDS CA bundle retrieved successfully: ${destination}\n`)
+  })
+
+  it('downloads the US Common Runtime CA bundle without requesting Heroku regions', async function () {
+    nock('https://truststore.pki.rds.amazonaws.com')
+      .get('/us-east-1/us-east-1-bundle.pem')
+      .reply(200, certificate)
+
+    const {stdout} = await runCommand(DataPgGetCa, ['--region', 'us'])
+    const destination = path.join(destinationDirectory(), 'us-east-1-bundle.pem')
+
+    expect(outputFileStub.calledOnceWith(
+      destination,
+      Buffer.from(certificate),
+      {mode: 0o600},
+    )).to.be.true
+    expect(stdout).to.equal(`RDS CA bundle retrieved successfully: ${destination}\n`)
+  })
+
+  it('downloads the EU Common Runtime CA bundle without requesting Heroku regions', async function () {
+    nock('https://truststore.pki.rds.amazonaws.com')
+      .get('/eu-west-1/eu-west-1-bundle.pem')
+      .reply(200, certificate)
+
+    const {stdout} = await runCommand(DataPgGetCa, ['--region', 'eu'])
+    const destination = path.join(destinationDirectory(), 'eu-west-1-bundle.pem')
+
+    expect(outputFileStub.calledOnceWith(
+      destination,
+      Buffer.from(certificate),
+      {mode: 0o600},
+    )).to.be.true
+    expect(stdout).to.equal(`RDS CA bundle retrieved successfully: ${destination}\n`)
+  })
+
+  it('denies retrieval when AWS cannot provide the CA bundle', async function () {
+    nock('https://api.heroku.com')
+      .get('/regions')
+      .reply(200, [{name: 'virginia', provider: {region: 'us-east-1'}}])
+    nock('https://truststore.pki.rds.amazonaws.com')
+      .get('/us-east-1/us-east-1-bundle.pem')
+      .reply(503, 'temporarily unavailable')
+
+    const {error: commandError} = await runCommand(DataPgGetCa, ['--region', 'virginia'])
+    const destination = path.join(destinationDirectory(), 'us-east-1-bundle.pem')
+    expect(commandError?.message).to.equal(`Unable to retrieve the RDS CA bundle at ${destination}: AWS RDS returned 503 Service Unavailable.`)
+    expect(outputFileStub.called).to.be.false
+  })
+
+  it('rejects non-AWS Heroku regions', async function () {
+    nock('https://api.heroku.com')
+      .get('/regions')
+      .reply(200, [{name: 'example', provider: {region: null}}])
+
+    const {error} = await runCommand(DataPgGetCa, ['--region', 'example'])
+    const destination = destinationDirectory()
+    expect(error?.message).to.equal(`Unable to retrieve the RDS CA bundle at ${destination}: example is not a Heroku region backed by AWS.`)
+  })
+})