fix(connectors): rename flag to isPrivateDatabaseHostsAllowed; trim comment

- Rename env-flag const to satisfy the env-flags 'is' prefix CI check
  (env var ALLOW_PRIVATE_DATABASE_HOSTS is unchanged).
- Tighten the postgres pinning comment to a single line.

Author: waleedlatif1

apps/sim/app/api/tools/postgresql/utils.ts

@@ -18,9 +18,7 @@ export async function createPostgresConnection(config: PostgresConnectionConfig)
         : { rejectUnauthorized: false, servername: config.host }
 
   const sql = postgres({
-    // Always connect to the validated, pinned IP to prevent DNS rebinding between
-    // host validation and connection. For SSL modes that verify, the original
-    // hostname is preserved as the TLS servername (SNI) above.
+    // Pin the validated IP (never the hostname) to prevent DNS rebinding; SNI stays the hostname above.
     host: resolvedHost,
     port: config.port,
     database: config.database,

apps/sim/lib/core/config/env-flags.ts

@@ -82,7 +82,7 @@ if (isTruthy(env.DISABLE_AUTH)) {
  * their database lives on the same private network. Blocked on the hosted platform
  * regardless of the env var, mirroring {@link isAuthDisabled}.
  */
-export const allowPrivateDatabaseHosts = isTruthy(env.ALLOW_PRIVATE_DATABASE_HOSTS) && !isHosted
+export const isPrivateDatabaseHostsAllowed = isTruthy(env.ALLOW_PRIVATE_DATABASE_HOSTS) && !isHosted
 
 if (isTruthy(env.ALLOW_PRIVATE_DATABASE_HOSTS)) {
   import('@sim/logger')

apps/sim/lib/core/security/input-validation.server.ts

@@ -6,7 +6,7 @@ import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import * as ipaddr from 'ipaddr.js'
 import { Agent, type RequestInit as UndiciRequestInit, fetch as undiciFetch } from 'undici'
-import { allowPrivateDatabaseHosts, isHosted } from '@/lib/core/config/env-flags'
+import { isHosted, isPrivateDatabaseHostsAllowed } from '@/lib/core/config/env-flags'
 import { type ValidationResult, validateExternalUrl } from '@/lib/core/security/input-validation'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 
@@ -156,7 +156,7 @@ export async function validateUrlWithDNS(
  * on their private network (e.g. a Docker/Swarm service name that resolves to an
  * internal IP). The opt-in only bypasses the private/reserved/loopback block; DNS
  * is still resolved so the caller can pin the connection to the resolved IP. The
- * bypass is never honored on the hosted platform (see {@link allowPrivateDatabaseHosts}).
+ * bypass is never honored on the hosted platform (see {@link isPrivateDatabaseHostsAllowed}).
  *
  * @param host - The database hostname to validate
  * @param paramName - Name of the parameter for error messages
@@ -174,18 +174,22 @@ export async function validateDatabaseHost(
   const cleanHost =
     lowerHost.startsWith('[') && lowerHost.endsWith(']') ? lowerHost.slice(1, -1) : lowerHost
 
-  if (cleanHost === 'localhost' && !allowPrivateDatabaseHosts) {
+  if (cleanHost === 'localhost' && !isPrivateDatabaseHostsAllowed) {
     return { isValid: false, error: `${paramName} cannot be localhost` }
   }
 
-  if (ipaddr.isValid(cleanHost) && isPrivateOrReservedIP(cleanHost) && !allowPrivateDatabaseHosts) {
+  if (
+    ipaddr.isValid(cleanHost) &&
+    isPrivateOrReservedIP(cleanHost) &&
+    !isPrivateDatabaseHostsAllowed
+  ) {
     return { isValid: false, error: `${paramName} cannot be a private IP address` }
   }
 
   try {
     const { address } = await dns.lookup(cleanHost, { verbatim: true })
 
-    if (isPrivateOrReservedIP(address) && !allowPrivateDatabaseHosts) {
+    if (isPrivateOrReservedIP(address) && !isPrivateDatabaseHostsAllowed) {
       logger.warn('Database host resolves to blocked IP address', {
         paramName,
         hostname: host,

apps/sim/lib/core/security/input-validation.test.ts

@@ -765,7 +765,7 @@ describe('validateUrlWithDNS', () => {
 
 describe('validateDatabaseHost', () => {
   afterEach(() => {
-    envFlagsMock.allowPrivateDatabaseHosts = false
+    envFlagsMock.isPrivateDatabaseHostsAllowed = false
   })
 
   describe('default (SSRF guard on)', () => {
@@ -808,7 +808,7 @@ describe('validateDatabaseHost', () => {
 
   describe('self-host opt-in (ALLOW_PRIVATE_DATABASE_HOSTS)', () => {
     beforeEach(() => {
-      envFlagsMock.allowPrivateDatabaseHosts = true
+      envFlagsMock.isPrivateDatabaseHostsAllowed = true
     })
 
     it('allows localhost and still resolves an IP to pin', async () => {

packages/testing/src/mocks/env-flags.mock.ts

@@ -17,7 +17,7 @@ export const envFlagsMock = {
   isBillingEnabled: false,
   isEmailVerificationEnabled: false,
   isAuthDisabled: false,
-  allowPrivateDatabaseHosts: false,
+  isPrivateDatabaseHostsAllowed: false,
   isRegistrationDisabled: false,
   isEmailPasswordEnabled: false,
   isTriggerDevEnabled: false,