feat(outbound): add HTTPS CHECK constraint on outbound_connections.url

Defense-in-depth per code review. DTO layer already validates HTTPS at save
time; this DB-level check guards against future code paths that might bypass
the DTO validator. Mustache template variables in the URL (e.g., {{env.slug}})
remain valid since only the scheme prefix is constrained.
This commit is contained in:
hsiegeln
2026-04-19 15:37:35 +02:00
parent 116038262a
commit ffdfd6cd9a

View File

@@ -10,7 +10,7 @@ CREATE TABLE outbound_connections (
tenant_id varchar(64) NOT NULL,
name varchar(100) NOT NULL,
description text,
url text NOT NULL,
url text NOT NULL CHECK (url ~ '^https://'),
method outbound_method_enum NOT NULL,
default_headers jsonb NOT NULL DEFAULT '{}',
default_body_tmpl text,