feat(config): add peer-state config/user hash + tls unit accessors

Scaffolds the config-subsystem port into the library: a later change
persists the applied config/user hashes and the last-rendered TLS flag
to peer relation data so the update_config manager can detect drift
without re-deriving it from live workload state. Add the plain-databag
accessors now so that change only wires them up.

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>

Author: marceloneppel

single_kernel_postgresql/core/peer_relation.py

@@ -225,6 +225,48 @@ def is_connectivity_enabled(self) -> bool:
             return True
         return self.relation.data[self.unit].get("connectivity", "on") == "on"
 
+    @property
+    def config_hash(self) -> str | None:
+        """Get the last-applied PostgreSQL config hash from the peer relation data."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.unit].get("config_hash")
+
+    @config_hash.setter
+    def config_hash(self, value: str) -> None:
+        """Set the last-applied PostgreSQL config hash in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.unit]["config_hash"] = value
+
+    @property
+    def user_hash(self) -> str | None:
+        """Get the last-applied users hash from the peer relation data."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.unit].get("user_hash")
+
+    @user_hash.setter
+    def user_hash(self, value: str) -> None:
+        """Set the last-applied users hash in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.unit]["user_hash"] = value
+
+    @property
+    def tls(self) -> bool:
+        """Get the last-rendered TLS flag from the peer relation data."""
+        if not self.relation:
+            return False
+        return self.relation.data[self.unit].get("tls") == "enabled"
+
+    @tls.setter
+    def tls(self, value: bool) -> None:
+        """Set the last-rendered TLS flag in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.unit]["tls"] = "enabled" if value else ""
+
     @cached_property
     def data(self) -> MutableMapping[str, str]:
         """Escape hatch method to access the peer data directly."""
@@ -418,6 +460,20 @@ def is_ldap_enabled(self) -> bool:
         """Return whether this unit has LDAP enabled."""
         return self.is_ldap_charm_related and self.is_cluster_initialised
 
+    @property
+    def user_hash(self) -> str | None:
+        """Get the last-applied users hash from the peer relation data."""
+        if not self.relation:
+            return None
+        return self.relation.data[self.app].get("user_hash")
+
+    @user_hash.setter
+    def user_hash(self, value: str) -> None:
+        """Set the last-applied users hash in the peer relation data."""
+        if not self.relation:
+            return
+        self.relation.data[self.app]["user_hash"] = value
+
     def get_secret(self, key: str) -> str | None:
         """Get the secret value for 'key' from the peer relation data."""
         if not self.relation:

tests/unit/test_peer_relation.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+"""Tests for the config/user hash + tls plain-databag accessors on peer state.
+
+These accessors scaffold the config-subsystem port: PostgreSQLPeer.config_hash
+and .user_hash persist the last-applied config/user hashes, PostgreSQLPeer.tls
+persists the last-rendered TLS flag, and PostgreSQLApplication.user_hash
+persists the app-wide user hash. All are plain (non-secret) databag values,
+matching the charm's unit_peer_data / app_peer_data storage.
+"""
+
+
+def _get_unit_db(harness, key):
+    rel_id = harness.model.get_relation("database-peers").id
+    return harness.get_relation_data(rel_id, harness.charm.unit.name).get(key)
+
+
+def _get_app_db(harness, key):
+    rel_id = harness.model.get_relation("database-peers").id
+    return harness.get_relation_data(rel_id, harness.charm.app.name).get(key)
+
+
+# -- PostgreSQLPeer.config_hash ----------------------------------------------
+
+
+def test_config_hash_unset_is_none(harness):
+    assert harness.charm.state.peer.config_hash is None
+
+
+def test_config_hash_roundtrip(harness):
+    peer = harness.charm.state.peer
+    peer.config_hash = "abc123"
+    assert peer.config_hash == "abc123"
+
+
+def test_config_hash_writes_exact_databag_key(harness):
+    harness.charm.state.peer.config_hash = "abc123"
+    assert _get_unit_db(harness, "config_hash") == "abc123"
+
+
+# -- PostgreSQLPeer.user_hash -------------------------------------------------
+
+
+def test_peer_user_hash_unset_is_none(harness):
+    assert harness.charm.state.peer.user_hash is None
+
+
+def test_peer_user_hash_roundtrip(harness):
+    peer = harness.charm.state.peer
+    peer.user_hash = "def456"
+    assert peer.user_hash == "def456"
+
+
+def test_peer_user_hash_writes_exact_databag_key(harness):
+    harness.charm.state.peer.user_hash = "def456"
+    assert _get_unit_db(harness, "user_hash") == "def456"
+
+
+# -- PostgreSQLPeer.tls --------------------------------------------------------
+
+
+def test_tls_unset_is_false(harness):
+    assert harness.charm.state.peer.tls is False
+
+
+def test_tls_set_true_roundtrip(harness):
+    peer = harness.charm.state.peer
+    peer.tls = True
+    assert peer.tls is True
+
+
+def test_tls_set_true_writes_enabled(harness):
+    harness.charm.state.peer.tls = True
+    assert _get_unit_db(harness, "tls") == "enabled"
+
+
+def test_tls_set_false_roundtrip(harness):
+    peer = harness.charm.state.peer
+    peer.tls = True
+    peer.tls = False
+    assert peer.tls is False
+
+
+def test_tls_set_false_clears_enabled_key(harness):
+    """tls=False writes "", which ops relation data drops on write — observed as key absence."""
+    peer = harness.charm.state.peer
+    peer.tls = True
+    peer.tls = False
+    assert _get_unit_db(harness, "tls") is None
+
+
+# -- PostgreSQLApplication.user_hash ------------------------------------------
+
+
+def test_app_user_hash_unset_is_none(harness):
+    assert harness.charm.state.application.user_hash is None
+
+
+def test_app_user_hash_roundtrip(harness):
+    application = harness.charm.state.application
+    application.user_hash = "ghi789"
+    assert application.user_hash == "ghi789"
+
+
+def test_app_user_hash_writes_exact_databag_key(harness):
+    harness.charm.state.application.user_hash = "ghi789"
+    assert _get_app_db(harness, "user_hash") == "ghi789"