FIXUP: review, Mar 4

Author: cbandy

internal/postgres/hba.go

@@ -6,6 +6,7 @@ package postgres
 
 import (
 	"fmt"
+	"maps"
 	"regexp"
 	"slices"
 	"strings"
@@ -155,8 +156,8 @@ func (hba *HostBasedAuthentication) NoSSL() *HostBasedAuthentication {
 // Options specifies any options for the authentication method.
 func (hba *HostBasedAuthentication) Options(opts map[string]string) *HostBasedAuthentication {
 	hba.options = ""
-	for k, v := range opts {
-		hba.options = fmt.Sprintf("%s %s=%s", hba.options, hba.quote(k), hba.quote(v))
+	for _, k := range slices.Sorted(maps.Keys(opts)) {
+		hba.options = fmt.Sprintf("%s %s=%s", hba.options, hba.quote(k), hba.quote(opts[k]))
 	}
 	return hba
 }

internal/postgres/hba_test.go

@@ -60,6 +60,14 @@ func TestHostBasedAuthentication(t *testing.T) {
 	assert.Equal(t, `hostnossl all all all "reject"`,
 		NewHBA().NoSSL().Method("reject").String())
 
+	t.Run("OptionsSorted", func(t *testing.T) {
+		assert.Equal(t, `hostssl all all all "ldap"  "ldapbasedn"="dc=example,dc=org" "ldapserver"="example.org"`,
+			NewHBA().TLS().Method("ldap").Options(map[string]string{
+				"ldapserver": "example.org",
+				"ldapbasedn": "dc=example,dc=org",
+			}).String())
+	})
+
 	t.Run("SpecialCharactersEscaped", func(t *testing.T) {
 		// Databases; slash U+002F triggers regex escaping; regex characters themselves do not
 		assert.Equal(t, `local "/^[/]asdf_[+][?]1234$","/^[/][*][$]$","+*$" all`,