[datlechin]

Summary

• One connection URL parser, tablepro_core::connection_url, replaces the one in ffi. It reads libpq, MySQL/MariaDB (mysqlx too), SQL Server (URL and JDBC ; properties), MongoDB (+srv, host lists, replicaSet, authSource), Redis/Valkey, ClickHouse, Cassandra/ScyllaDB and SQLite/DuckDB file URLs, the jdbc: prefix and user/password parameters, and passwords with an unescaped @ or #.
• URL TLS settings map onto the core's TLS modes and files: sslmode/ssl-mode/tlsmode, ssl/tls/secure, sslaccept, encrypt with trustServerCertificate, sslrootcert/tlsCAFile, sslcert/sslkey, hostNameInCertificate, rediss/valkeys/mongodb+srv. prefer no longer maps to Disable; it leaves the connection's default. channel_binding=require is kept and sent to tokio-postgres as ChannelBinding::Require (a Require Channel Binding row in the dialog); requirepeer, require_auth, sslcrl, sslcrldir and gssencmode/sslcertmode=require refuse the URL rather than being dropped, as do MySQL's RSA key pins and CRLs, SQL Server logins other than SQL ones, certificate pins and trust stores, and MongoDB's CRL and an insisted SCRAM-SHA-256. Every other parameter the connection has no setting for, except pool sizes, timeouts and client names, is named in a toast. MariaDB's useSsl verifies the certificate; JDBC's last property wins. url leaves the workspace: the parser splits URLs itself, since url 2.5.8 refuses host lists, an empty host with a user, JDBC properties and # in a password.
• Linux connect dialog: a Connection URL row above the form fills every row it can, then clears itself; the password goes to the Secret Service on save, never into connections.json. A refused URL marks the row and says why without echoing it.
• Unix-domain sockets for PostgreSQL (a folder, .s.PGSQL.<port>, as libpq) and MySQL/MariaDB (the socket file): a host that is an absolute path. tablepro_net::LocalSocketTransport (cfg(unix)), TransportKind/TransportClass::LocalSocket, TransportError::LocalSocket. Peer, auth_socket and unix_socket logins work. A socket takes no SSH tunnel. PostgreSQL takes no TLS on one; MySQL keeps its TLS mode there, and with Encryption off logs in as Preferred, since MySQL expects caching_sha2_password's password in the clear on a socket and sqlx sends it only inside TLS.
• Linux dialog: a Unix Socket switch that trades the host for the socket path, starting on the first default place a server listens; Port, SSH and Security hide where a socket does not take them.
• MongoDB host lists: NetworkOptions.replica_set and more_hosts seed the client with no direct connection; refused over SSH and with a seed list; directConnection=true keeps the one named server. Other Hosts and Replica Set rows in the dialog.
• MySQL accounts on a client plugin sqlx lacks (MariaDB ed25519, parsec) say so instead of "could not read the server's reply".
• Flatpak grants /run/postgresql:ro and /run/mysqld:ro (ADR 0035, amending 0008); a missing socket in the Flatpak says which folders it sees.
• Windows: ParsedConnectionUrl carries the CA file, client certificate, key and server name into the draft (bindings regenerated); a URL needing what its connections cannot hold (a socket, a seed list, a replica set, another authentication database, required channel binding) is refused with url.settings_unsupported; every new url.* code has a string.

Test plan

• tablepro-core: parser cases for every engine and provider form (Supabase, Neon, Heroku, Atlas, Upstash, PlanetScale, Aiven, Azure JDBC), socket naming and default lookup, host list and socket validation.
• tablepro-net: the socket transport against a UnixListener, a missing socket and a dead one.
• tablepro-session: a socket host dials the engine's socket file; refused without a socket option and with TLS.
• tablepro-driver-mongodb: a host list seeds the replica set; refused over an in-process route. tablepro-driver-mysql: an unknown auth plugin maps to AuthPlugin.
• tablepro widget tests: URL fill and clear, a refused URL, Edit hides the row, MongoDB rows, the socket switch and a path typed as the host. Form tests: the URL password reaches the keyring list and not the saved JSON.
• requires docker: PostgreSQL logs in through its socket folder with no password; MySQL and MariaDB root log in through the socket on the first login after a start (cold caching_sha2_password cache). Linux CI only: Docker Desktop does not pass a Unix socket to the host.
• Probes against PostgreSQL 17, MySQL 8.4 and MariaDB over a real socket (peer, auth_socket, unix_socket, cold cache).

Screenshots

Before, light and dark:

After: the Connection URL row and the Unix Socket switch, light and dark:

After, with Unix Socket on: