* fix(connectors): allow self-hosted private DB hosts via opt-in flag
Database/connector tools rejected any host resolving to a private/reserved/
loopback IP, blocking the common self-hosted topology where the DB is reached
by a Docker/K8s/Swarm service name. Add an opt-in ALLOW_PRIVATE_DATABASE_HOSTS
flag that bypasses the private-host block in validateDatabaseHost while still
resolving and pinning DNS. Blocked on the hosted platform regardless of the env
var, mirroring DISABLE_AUTH.
Fixes#4319
* fix(connectors): pin postgres IP in all ssl modes; strip IPv6 brackets
Address review on #5322:
- validateDatabaseHost now strips surrounding IPv6 brackets before the
localhost/private-IP checks and DNS lookup, so a bracketed loopback like
[::1] is classified correctly instead of failing as unresolvable.
- PostgreSQL connector always connects to the validated, pinned IP (removed
the ssl='preferred' carve-out that passed the original hostname and let the
driver re-resolve during connection). Matches the MySQL/MongoDB pin pattern.
- Add postgres connector pinning tests and bracketed-IPv6 host tests.
* fix(connectors): rename flag to isPrivateDatabaseHostsAllowed; trim comment
- Rename env-flag const to satisfy the env-flags 'is' prefix CI check
(env var ALLOW_PRIVATE_DATABASE_HOSTS is unchanged).
- Tighten the postgres pinning comment to a single line.
Waleed
af87de09a7