dot upstreams: per-upstream tls_name for sni and cert verification by dns name

src/storage/repositories/upstreams_repo.zig

@@ -18,7 +18,9 @@ const InsertContext = context.InsertContext;
 
 /// Every string in the result is a heap copy owned by `gpa`.
 pub fn listUpstreams(database: *db.Db, gpa: Allocator) db.Error!std.ArrayList(model.UpstreamServer) {
-    var stmt = try database.prepare("SELECT url, priority, enabled FROM upstreams ORDER BY priority, url");
+    var stmt = try database.prepare(
+        "SELECT url, priority, enabled, tls_name FROM upstreams ORDER BY priority, url",
+    );
     defer stmt.deinit();
 
     var out: std.ArrayList(model.UpstreamServer) = .empty;
@@ -31,22 +33,35 @@ pub fn listUpstreams(database: *db.Db, gpa: Allocator) db.Error!std.ArrayList(mo
         const url = try stmt.columnTextAlloc(gpa, 0);
         errdefer gpa.free(url);
         const priority = std.math.cast(i32, stmt.columnInt(1)) orelse return error.Mismatch;
-        try out.append(gpa, .{ .url = url, .priority = priority, .enabled = stmt.columnBool(2) });
+        const tls_name = try stmt.columnTextAlloc(gpa, 3);
+        errdefer gpa.free(tls_name);
+        try out.append(gpa, .{
+            .url = url,
+            .priority = priority,
+            .enabled = stmt.columnBool(2),
+            .tls_name = tls_name,
+        });
     }
     return out;
 }
 
 pub fn freeUpstreams(gpa: Allocator, items: []const model.UpstreamServer) void {
-    for (items) |item| gpa.free(item.url);
+    for (items) |item| {
+        gpa.free(item.url);
+        gpa.free(item.tls_name);
+    }
 }
 
 pub fn insertUpstream(database: *db.Db, item: model.UpstreamServer, ctx: InsertContext) db.Error!void {
     _ = ctx;
-    var stmt = try database.prepare("INSERT INTO upstreams (url, priority, enabled) VALUES (?1, ?2, ?3)");
+    var stmt = try database.prepare(
+        "INSERT INTO upstreams (url, priority, enabled, tls_name) VALUES (?1, ?2, ?3, ?4)",
+    );
     defer stmt.deinit();
     try stmt.bindText(1, item.url);
     try stmt.bindInt(2, item.priority);
     try stmt.bindBool(3, item.enabled);
+    try stmt.bindText(4, item.tls_name);
     try stmt.exec();
 }
 
@@ -75,7 +90,12 @@ fn openMigrated() !db.Db {
 fn seedUpstreams(database: *db.Db) !void {
     const ctx: InsertContext = .{};
     try insertUpstream(database, .{ .url = "https://dns.example/dns-query", .priority = 50 }, ctx);
-    try insertUpstream(database, .{ .url = "tls://1.1.1.1:853", .priority = 10, .enabled = false }, ctx);
+    try insertUpstream(database, .{
+        .url = "tls://1.1.1.1:853",
+        .priority = 10,
+        .enabled = false,
+        .tls_name = "one.one.one.one",
+    }, ctx);
     try insertUpstream(database, .{ .url = "https://a.example/dns-query", .priority = 50 }, ctx);
 }
 
@@ -92,7 +112,10 @@ test "upstreams round-trip in priority then url order" {
     try testing.expectEqualStrings("tls://1.1.1.1:853", items.items[0].url);
     try testing.expectEqual(@as(i32, 10), items.items[0].priority);
     try testing.expect(!items.items[0].enabled);
+    try testing.expectEqualStrings("one.one.one.one", items.items[0].tls_name);
     try testing.expectEqualStrings("https://a.example/dns-query", items.items[1].url);
+    // An upstream inserted without one reads back as the empty column default.
+    try testing.expectEqualStrings("", items.items[1].tls_name);
     try testing.expectEqual(@as(i32, 50), items.items[1].priority);
     try testing.expect(items.items[1].enabled);
     try testing.expectEqualStrings("https://dns.example/dns-query", items.items[2].url);