fix(webapp): preserve TLS hostname for snapshot Redis clusters

Preserve the configured TLS hostname when connecting the snapshot Redis
cluster client to discovered nodes, without disabling certificate
verification.

Mono-RevId: e5da247d6c0c75ea6bb827c173c64872ef17ede9

Author: d-cs

apps/webapp/app/v3/utils/snapshotStoreConnection.server.ts

@@ -18,11 +18,20 @@ export function snapshotClusterOptions(endpoint: string) {
   return {
     nodes: [{ host: url.hostname, port: Number(url.port || 6379) }],
     failFast: true,
-    clusterOptions: { lazyConnect: true, scaleReads: "master" as const },
+    clusterOptions: {
+      lazyConnect: true,
+      scaleReads: "master" as const,
+      ...(url.protocol === "rediss:" && {
+        // Preserve the seed hostname; AWS TLS certificates do not identify private IPs.
+        dnsLookup: (address: string, callback: (err: Error | null, address: string) => void) =>
+          callback(null, address),
+      }),
+    },
     redisOptions: {
       username: url.username ? decodeURIComponent(url.username) : undefined,
       password: url.password ? decodeURIComponent(url.password) : undefined,
-      tls: url.protocol === "rediss:" ? {} : undefined,
+      // Discovered nodes can be IPs too; verify them against the configured cluster hostname.
+      tls: url.protocol === "rediss:" ? { servername: url.hostname } : undefined,
       commandTimeout: COMMAND_TIMEOUT_MS,
       connectTimeout: CONNECT_TIMEOUT_MS,
     },

apps/webapp/app/v3/utils/snapshotStoreMetrics.server.test.ts

@@ -14,7 +14,16 @@ test("snapshot metrics ignore raw organization IDs; the endpoint creates no eage
 
   const options = snapshotClusterOptions("rediss://snapshot.example:6379");
   expect(options.failFast).toBe(true);
-  expect(options.clusterOptions).toEqual({ lazyConnect: true, scaleReads: "master" });
+  expect(options.clusterOptions).toMatchObject({ lazyConnect: true, scaleReads: "master" });
+  expect(options.redisOptions.tls).toEqual({ servername: "snapshot.example" });
+  expect(options.clusterOptions.dnsLookup).toBeTypeOf("function");
+  options.clusterOptions.dnsLookup!("snapshot.example", (error, address) => {
+    expect(error).toBeNull();
+    expect(address).toBe("snapshot.example");
+  });
+  const plainOptions = snapshotClusterOptions("redis://127.0.0.1:1");
+  expect(plainOptions.clusterOptions).toEqual({ lazyConnect: true, scaleReads: "master" });
+  expect(plainOptions.redisOptions.tls).toBeUndefined();
   expect(options.redisOptions.commandTimeout).toBe(500);
   const connection = createSnapshotConnection("redis://127.0.0.1:1");
   connection.getStore(); // Registers local Lua commands only.