Add MongoDB TLS options (`tlsAllowInvalidCertificates`, `retryWrites`, `tlsCAFile`) to the connection form with backend URL normalization and DocumentDB/SSH tunnel guidance, while preserving legacy `tlsCAFile` in `url_params` for existing DocumentDB users, hardening auth failure hint matching, and clarifying TLS bypass security labels.
* feat(core): implement PIP-0001 database connection timeout recovery
- Add DbOperationBudget struct for unified execution budget model
- Add deadpool create/recycle timeout for PostgreSQL pools
- Add checkout_postgres_client helper replacing 14 bare pool.get() calls
with timeout + cancel token support
- Fix PostgreSQL TLS cancel: rebuild TLS connector from stored context,
fallback to NoTls on failure
- Add timeout to MySQL kill_query and kill_query_with_opts (5s)
- Extend is_connection_error to match deadpool pool timeout messages
- Unify keepalive default to 30s (was 60s Rust / 0s frontend mismatch)
- Inject PostgreSQL TCP keepalive params (idle=30s, interval=10s, retries=3)
- Inject MySQL tcp_keepalive=30s in OptsBuilder
- Make MySQL inactive_connection_ttl configurable from idle_timeout_secs
- Add stage-based structured logging for pool.checkout/health.check/cancel
- Store PostgresCancelContext in AppState for TLS cancel reconstruction
- Clean up cancel contexts on pool removal/drain
- Add unit tests for DbOperationBudget and pool timeout error detection
* fix(core): align timeout recovery with PIP-0001
* fix(core): handle timeout recovery review issues
* fix(core): complete connection timeout recovery
* fix(core): fall back postgres cancel connector build
* refactor: revert comment translations to English in connection.rs and query.rs
- Revert DbOperationBudget doc comments to English (query.rs)
- Revert PostgresCancelContext and TLS cancel comments to English (connection.rs)
- Keep Chinese error-matching strings in is_connection_error unchanged
---------
Co-authored-by: onceMisery <onceMisery@users.noreply.github.com>
Some SSH proxies and jump-hosts authenticate with the "none" method,
requiring no password or key. dbx only tried publickey/password/agent,
so connecting through such a host failed with "SSH public key
authentication failed" — and the frontend forced users to enter a
credential just to pass validation.
- Backend: probe authenticate_none first in connect_and_authenticate;
on rejection fall back to the configured credential method, matching
standard openssh behavior.
- Frontend: drop the "password/key/agent required" check in
validateTransportLayers so passwordless hops can be saved and tested.
Refs #1628
