Pass pg_service.conf SSL options to the connection

AUTHORS

@@ -161,6 +161,7 @@ Contributors:
     * Wei-Lun Li (b84330808)
 
     * jackwalkerlabs (Codex-assisted)
+    * João Rito
 
 Creator:
 --------

changelog.rst

@@ -14,6 +14,9 @@ Bug fixes:
   interactive session, allowing recovery from an aborted transaction.
 * Fix the development setup instructions to activate the ``.venv`` directory
   created by ``uv venv``.
+* Pass the SSL options (``sslmode``, ``sslrootcert``, ``sslcert``, ``sslkey``) and
+  other connection parameters from a ``pg_service.conf`` entry to the connection
+  when using ``service=...`` or ``PGSERVICE``.
 * Read ``alias_map_file`` as UTF-8 (with or without a BOM) instead of the
   locale encoding, which made non-ASCII aliases fail on Windows.
 

pgcli/main.py

@@ -737,6 +737,8 @@ def connect_service(self, service, user):
             user=user or service_config.get("user"),
             port=service_config.get("port"),
             passwd=service_config.get("password"),
+            # Forward the remaining libpq parameters (sslmode, sslrootcert, ...)
+            **{k: v for k, v in service_config.items() if k not in ("dbname", "host", "user", "port", "password")},
         )
         self.service_name = service or os.getenv("PGSERVICE")
 

tests/test_main.py

@@ -700,6 +700,35 @@ def test_quoted_db_uri(tmpdir):
     mock_connect.assert_called_with(database="testdb[", host="baz.com", user="bar^", passwd="]foo")
 
 
+def test_pg_service_file_forwards_ssl_options(tmp_path, monkeypatch):
+    service_file = tmp_path / "pg_service.conf"
+    service_file.write_text(
+        "[secure]\n"
+        "host=a_host\n"
+        "user=a_user\n"
+        "dbname=a_dbname\n"
+        "sslmode=verify-full\n"
+        "sslrootcert=/path/to/ca.crt\n"
+        "sslcert=/path/to/user.crt\n"
+        "sslkey=/path/to/user.key\n"
+    )
+    monkeypatch.setenv("PGSERVICEFILE", str(service_file))
+    with mock.patch.object(PGCli, "connect") as mock_connect:
+        cli = PGCli(pgclirc_file=str(tmp_path / "rcfile"))
+        cli.connect_service("secure", None)
+    mock_connect.assert_called_with(
+        database="a_dbname",
+        host="a_host",
+        user="a_user",
+        port=None,
+        passwd=None,
+        sslmode="verify-full",
+        sslrootcert="/path/to/ca.crt",
+        sslcert="/path/to/user.crt",
+        sslkey="/path/to/user.key",
+    )
+
+
 def test_pg_service_file(tmpdir):
     with mock.patch.object(PGCli, "connect") as mock_connect:
         cli = PGCli(pgclirc_file=str(tmpdir.join("rcfile")))