audit: connection management

[EVWorth]

Audit: Connection Management

Drives docs/audits/connection.md. Scope: profiles, SSH/SSL/keyring/pooling/auto-reconnect/color/groups/read-only/quick-connect.

Findings (P0/P1 — child issues)

• [P0][security] SSH tunnel stored but never used; no ssh2 dependency; ARCHITECTURE §3.1 SSHTunnel unimplemented #273 [P0] [security] SSH tunnel stored but never used; ssh2 crate missing
• [P0][security] edit-save save_connection_profile silently wipes the OS keyring password when get() fails #274 [P0] [security] edit-save silently wipes OS keyring password when get() fails
• [P0][arch] ConnectionDialog.tsx is a 616-LOC monolith; refactor to one component per tab #275 [P0] [arch] ConnectionDialog 616-LOC monolith; refactor to one component per tab
• [P1][bug] auto-reconnect on launch is a single-shot try/catch; no backoff, no surface, no HealthChecker (FR-1.2.4 / ARCHITECTURE §3.1 HealthChecker) #276 [P1] [bug] auto-reconnect single-shot try/catch; no backoff / HealthChecker
• [P1][security] read_only profile flag is UI-only — backend executes DML/DDL unrestricted (FR-1.2.7) #277 [P1] [security] read_only UI-only — backend executes DML/DDL
• [P1][security] init_keyring() panic on Linux + ConnectionStore::new .expect() block all app launches #278 [P1] [security] init_keyring panic + ConnectionStore::new .expect() block all launches
• [P1][bug] Pool exhaustion (per-profile pool_max=5 default) surfaces opaquely; no UI for live pool stats (FR-1.2.3) #279 [P1] [bug] Pool exhaustion opaque; no status-bar pool stats (FR-1.2.3)
• [P1][bug] connect→disconnect race leaks a connection in activeConnections map (test documents as expected) #280 [P1] [bug] connect→disconnect race leaks connection in activeConnections

Backlog (P2 — 10 items)

See audit doc:

• #? F9 Duplicate profile missing (FR-1.1.4)
• #? F10 Import/export encrypted profiles (FR-1.1.6)
• #? F11 Connection groups/folders (FR-1.2.6)
• #? F12 Recent connections (FR-1.3.1)
• #? F13 Quick connect Ctrl+Shift+C (FR-1.3.4)
• #? F14 Yellow "connecting" status indicator (FR-1.3.2)
• #? F15 default_database over-logged
• #? F16 Bare try/catch on auto-reconnect leaves tabs in inconsistent state
• #? F17 connect() overwrites selectedConnectionId unexpectedly
• #? F18 Redundant SELECT in save_connection_profile

Backlog (P3 — 9 items)

See audit doc: F19–F27 covering TESTING_STRATEGY drift, keyring migration tests, tab-level database clobber, ARCHITECTURE §6.1 password wording, port constant duplication, env-color hint, path allowlist, password placeholder.

Doc drift

• Doc drift — Connection Mgmt: align DESIGN_REQUIREMENTS, ARCHITECTURE, TESTING_STRATEGY with code #294 align DESIGN_REQUIREMENTS / ARCHITECTURE / TESTING_STRATEGY with code

Good (👍)

See docs/audits/connection.md "Good (👍)" section for the full list. Highlights:

• snake_case TS types match Rust serde
• Password never crosses IPC for list responses
• Tracing discipline + AssertSqlSafe correct usage
• Migration framework on PRAGMA user_version
• Frontend IPC chain clean

Proposed fix order

1. [P0][security] SSH tunnel stored but never used; no ssh2 dependency; ARCHITECTURE §3.1 SSHTunnel unimplemented #273 (SSH) + [P0][security] edit-save save_connection_profile silently wipes the OS keyring password when get() fails #274 (keyring wipe) — restore the security contracts first
2. [P0][arch] ConnectionDialog.tsx is a 616-LOC monolith; refactor to one component per tab #275 (refactor) — required before adding features
3. [P1][security] read_only profile flag is UI-only — backend executes DML/DDL unrestricted (FR-1.2.7) #277 (read_only enforcement), [P1][security] init_keyring() panic on Linux + ConnectionStore::new .expect() block all app launches #278 (graceful keyring), [P1][bug] auto-reconnect on launch is a single-shot try/catch; no backoff, no surface, no HealthChecker (FR-1.2.4 / ARCHITECTURE §3.1 HealthChecker) #276 (HealthChecker) — third wave
4. [P1][security] init_keyring() panic on Linux + ConnectionStore::new .expect() block all app launches #278, [P1][bug] Pool exhaustion (per-profile pool_max=5 default) surfaces opaquely; no UI for live pool stats (FR-1.2.3) #279, [P1][bug] connect→disconnect race leaks a connection in activeConnections map (test documents as expected) #280 — operational correctness
5. Everything P2/P3 — opportunistic as touched