Disable GSS encryption on the database connection

src/Data/EvilCase.Data/Bootstrap.cs

@@ -4,6 +4,7 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
+using Npgsql;
 
 namespace EvilBrains.EvilCase.Data;
 
@@ -21,7 +22,9 @@ public static IServiceCollection AddEvilCaseData(this IServiceCollection service
                 var connectionStringSection = configuration.GetRequiredSection("EvilBrains:EvilCase:ConnectionString");
                 var connectionString = connectionStringSection.Value ?? throw new InvalidOperationException("Connection string not found");
 
-                options.UseNpgsql(connectionString, static npgsql => npgsql.UseEvilCaseMigrations());
+                var connectionStringBuilder = new NpgsqlConnectionStringBuilder(connectionString) { GssEncryptionMode = GssEncryptionMode.Disable };
+
+                options.UseNpgsql(connectionStringBuilder.ConnectionString, static npgsql => npgsql.UseEvilCaseMigrations());
                 options.UseQueryTrackingBehavior(QueryTrackingBehavior.NoTracking);
                 options.AddInterceptors(
                     serviceProvider.GetRequiredService<UserWriteInterceptor>(),

src/Tests/EvilCase.Tests/Data/ConnectionStringTests.cs

@@ -0,0 +1,39 @@
+using EvilBrains.EvilCase.Data;
+using EvilBrains.EvilCase.Data.DbContexts;
+using EvilBrains.EvilCase.Domain.Users;
+using EvilBrains.EvilCase.Tests.Auth;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Npgsql;
+
+namespace EvilBrains.EvilCase.Tests.Data;
+
+public class ConnectionStringTests
+{
+    [Test]
+    public void TheContextDisablesGssEncryption()
+    {
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["EvilBrains:EvilCase:ConnectionString"] = "Host=127.0.0.1;Database=evilcase-tests" })
+            .Build();
+
+        var services = new ServiceCollection()
+            .AddSingleton<IConfiguration>(configuration)
+            .AddSingleton(Substitute.For<IHostEnvironment>())
+            .AddScoped<IUserContext, StubUserContext>()
+            .AddEvilCaseData();
+
+        using var provider = services.BuildServiceProvider();
+        using var scope = provider.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
+
+        var connectionString = new NpgsqlConnectionStringBuilder(context.Database.GetConnectionString());
+
+        Assert.That(
+            connectionString.GssEncryptionMode,
+            Is.EqualTo(GssEncryptionMode.Disable),
+            "the connection must not probe GSS encryption, which loads a native library the Alpine image lacks");
+    }
+}