fix(credentials): validate the saved-connection port in the form and carry TLS tradeoffs into the provider catalog

The connection modal now refuses a port that is not a whole number from 1 to
65535 and says so beside the field, instead of a generic verify failure. The
v2 provider catalog hint for saved PostgreSQL, MySQL, and SQL Server
connections now includes each transport-security field's tradeoff, so API
callers see what Preferred, Encrypt, and Trust server certificate give up.
The integration fixture decodes the database name from TEST_DATABASE_URL.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/database-connection-account-modal.tsx

@@ -42,6 +42,8 @@ interface DatabaseConnectionAccountModalProps {
   submitPending?: boolean
 }
 
+const MAX_PORT = 65535
+
 interface LoginFields {
   host: string
   port: string
@@ -98,10 +100,12 @@ function DatabaseConnectionAccountForm({
     createCredential.isPending || updateCredential.isPending || submitPending === true
   const action = credentialId ? 'Reconnect' : 'Add'
   const title = `${action} ${descriptor.label} connection`
+  const port = login.port.trim()
+  const portIsValid = /^\d+$/.test(port) && Number(port) >= 1 && Number(port) <= MAX_PORT
   const disabled =
     isPending ||
     !login.host.trim() ||
-    !login.port.trim() ||
+    !portIsValid ||
     !login.database.trim() ||
     !login.username.trim() ||
     !login.password
@@ -114,7 +118,7 @@ function DatabaseConnectionAccountForm({
     setError(null)
     const serviceAccountJson = JSON.stringify({
       host: login.host.trim(),
-      port: Number(login.port),
+      port: Number(port),
       database: login.database.trim(),
       username: login.username.trim(),
       password: login.password,
@@ -182,6 +186,9 @@ function DatabaseConnectionAccountForm({
           placeholder={String(descriptor.defaultPort)}
           required
           autoComplete='off'
+          error={
+            port !== '' && !portIsValid ? `Enter a whole number from 1 to ${MAX_PORT}.` : undefined
+          }
         />
         <ChipModalField
           type='input'

apps/sim/lib/credentials/__integration__/database-connection.integration.ts

@@ -26,7 +26,7 @@ const databaseUrl = new URL(readTestDatabaseUrl())
 const connection = {
   host: '127.0.0.1',
   port: Number(databaseUrl.port || 5432),
-  database: databaseUrl.pathname.slice(1),
+  database: decodeURIComponent(databaseUrl.pathname.slice(1)),
   username: decodeURIComponent(databaseUrl.username),
   // The disposable server trusts loopback logins, so any non-empty password is accepted.
   password: decodeURIComponent(databaseUrl.password) || 'unused-under-trust-auth',

apps/sim/lib/credentials/application/provider-catalog-contract.test.ts

@@ -25,6 +25,7 @@ import { v2ListCredentialProvidersContract } from '@/lib/api/contracts/v2/creden
 import { env } from '@/lib/core/config/env'
 import { listCredentialProviders } from '@/lib/credentials/application/list-credential-providers'
 import { listCredentialProviderCatalog } from '@/lib/credentials/application/provider-catalog'
+import { DATABASE_CONNECTION_DESCRIPTORS } from '@/lib/credentials/database-connections/descriptors'
 import { getMissingServiceAccountFields } from '@/lib/credentials/service-account-fields'
 import {
   isWorkloadIdentityServiceAccountProviderId,
@@ -198,4 +199,18 @@ describe('v2 credential provider catalog contract', () => {
       expect.objectContaining({ providerId: CLAUDE_PROVIDER_ID, available: false })
     )
   })
+
+  it('tells API callers what each saved database connection transport-security mode trades away', async () => {
+    const providers = await listProviders()
+
+    for (const descriptor of Object.values(DATABASE_CONNECTION_DESCRIPTORS)) {
+      const provider = providers.find(
+        (entry) => entry.type === 'service_account' && entry.providerId === descriptor.providerId
+      )
+      const hint = provider?.fields.find((field) => field.id === 'serviceAccountJson')?.hint
+      for (const field of descriptor.tls) {
+        expect(hint).toContain(field.hint)
+      }
+    }
+  })
 })

apps/sim/lib/credentials/application/provider-catalog.ts

@@ -285,6 +285,7 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
           `${field.id} (${field.options.map((option) => option.value).join(', ')}; default ${field.defaultValue})`
       )
       .join(' and ')
+    const tlsTradeoffs = database.tls.map((field) => `${field.id}: ${field.hint}`).join(' ')
     return {
       name: `${database.label} connection`,
       description: `Connect to ${database.label} with a saved host, database, login, and transport-security settings.`,
@@ -304,7 +305,7 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
           required: true,
           secret: true,
           multiline: true,
-          hint: `JSON object with host, port, database, username, password, and optional ${tls}. Sim verifies it with SELECT 1 before saving.`,
+          hint: `JSON object with host, port, database, username, password, and optional ${tls}. Sim verifies it with SELECT 1 before saving. ${tlsTradeoffs}`,
         },
       ],
     }