feat(connections): add SSL client certificate support for MySQL, MongoDB, Redis (#278)

lib/core/database/mongodb_connection.dart

@@ -1,4 +1,5 @@
 import 'package:mongo_dart/mongo_dart.dart';
+import 'package:querya_desktop/features/connections/ssl_certificate_support.dart';
 
 /// MongoDB connection configuration and state.
 class MongoConnection {
@@ -119,7 +120,7 @@ class MongoConnection {
     }
 
     try {
-      final uri = buildConnectionUri();
+      final uri = await _effectiveMongoUri();
       _db = await Db.create(uri);
       await _db!.open();
       _isConnected = true;
@@ -130,6 +131,34 @@ class MongoConnection {
     }
   }
 
+  Future<String> _effectiveMongoUri() async {
+    final base = buildConnectionUri();
+    final parsed = Uri.parse(base);
+    final paths = extractSslCertificatePaths(parsed);
+    final params = Map<String, String>.from(parsed.queryParameters);
+    params.remove(kSslRootCertParam);
+    params.remove(kSslCertParam);
+    params.remove(kSslKeyParam);
+
+    if (paths.rootCert != null && paths.rootCert!.trim().isNotEmpty) {
+      params[kMongoTlsCaFileParam] = paths.rootCert!.trim();
+    }
+    final clientPem = await resolveMongoTlsCertificateKeyFile(
+      clientCert: paths.clientCert,
+      clientKey: paths.clientKey,
+    );
+    if (clientPem != null) {
+      params[kMongoTlsCertificateKeyFileParam] = clientPem;
+    }
+    if (useSSL || paths.hasAny) {
+      params['ssl'] = 'true';
+    }
+
+    return parsed
+        .replace(queryParameters: params.isEmpty ? null : params)
+        .toString();
+  }
+
   /// Disconnects from MongoDB server.
   Future<void> disconnect() async {
     _isConnected = false;

lib/core/database/mysql_connection.dart

@@ -3,6 +3,7 @@ import 'dart:async';
 import 'package:flutter/foundation.dart';
 import 'package:mysql_client/mysql_client.dart';
 import 'package:querya_desktop/core/storage/local_db.dart';
+import 'package:querya_desktop/features/connections/ssl_certificate_support.dart';
 
 /// Replaces the database in a `mysql://` / `mariadb://` URI (path or `database=`).
 String replaceDatabaseInMysqlConnectionString(
@@ -98,23 +99,30 @@ class MysqlConnection {
               )
             : connectionString!.trim();
         final parsed = _parseMysqlUri(uriStr, fallbackSsl: useSSL);
+        final sslPaths = extractSslCertificatePathsFromString(uriStr);
+        final securityContext = buildSecurityContext(sslPaths);
         _conn = await MySQLConnection.createConnection(
           host: parsed.host,
           port: parsed.port,
           userName: parsed.userName,
           password: parsed.password,
-          secure: parsed.secure,
+          secure: parsed.secure || sslPaths.hasAny,
           databaseName: parsed.databaseName,
+          securityContext: securityContext,
         );
         await _conn!.connect(timeoutMs: connectTimeoutMs);
       } else {
+        final securityContext = buildSecurityContext(
+          extractSslCertificatePathsFromString(connectionString),
+        );
         _conn = await MySQLConnection.createConnection(
           host: host,
           port: port,
           userName: user,
           password: pass,
           secure: useSSL,
           databaseName: database,
+          securityContext: securityContext,
         );
         await _conn!.connect(timeoutMs: connectTimeoutMs);
       }
@@ -174,6 +182,11 @@ class MysqlConnection {
     if (ssl == 'require' || ssl == 'verify_ca' || ssl == 'verify_identity') {
       secure = true;
     }
+    if (q.containsKey(kSslRootCertParam) ||
+        q.containsKey(kSslCertParam) ||
+        q.containsKey(kSslKeyParam)) {
+      secure = true;
+    }
 
     return (
       host: hostStr,
@@ -185,6 +198,15 @@ class MysqlConnection {
     );
   }
 
+  /// Whether [connectionString] implies a TLS session (including cert query params).
+  @visibleForTesting
+  static bool connectionStringRequiresSsl(
+    String connectionString, {
+    bool fallbackSsl = true,
+  }) {
+    return _parseMysqlUri(connectionString, fallbackSsl: fallbackSsl).secure;
+  }
+
   Future<void> disconnect() async {
     _isConnected = false;
     final c = _conn;

lib/core/database/redis_connection.dart

@@ -1,4 +1,8 @@
+import 'dart:io';
+
 import 'package:flutter/foundation.dart';
+import 'package:querya_desktop/core/storage/local_db.dart';
+import 'package:querya_desktop/features/connections/ssl_certificate_support.dart';
 import 'package:redis/redis.dart' as redis;
 
 /// Redis connection using the Dart redis package (no Java/JRE).
@@ -10,14 +14,57 @@ class RedisConnection {
     this.port = 6379,
     this.username,
     this.password,
+    this.useSSL = false,
+    this.connectionString,
   });
 
+  factory RedisConnection.fromConnectionRow(ConnectionRow row) {
+    final uriText = row.connectionString?.trim();
+    if (uriText != null && uriText.isNotEmpty) {
+      final parsed = Uri.parse(uriText);
+      final info = parsed.userInfo;
+      String? user;
+      String? pass;
+      if (info.isNotEmpty) {
+        final colon = info.indexOf(':');
+        if (colon >= 0) {
+          user = Uri.decodeComponent(info.substring(0, colon));
+          pass = Uri.decodeComponent(info.substring(colon + 1));
+        } else {
+          user = Uri.decodeComponent(info);
+        }
+      }
+      return RedisConnection(
+        id: row.id ?? 0,
+        name: row.name,
+        host: parsed.host.isEmpty ? (row.host ?? 'localhost') : parsed.host,
+        port: parsed.hasPort ? parsed.port : (row.port ?? 6379),
+        username: user ?? row.username,
+        password: pass ?? row.password,
+        useSSL: row.useSSL || parsed.scheme == 'rediss',
+        connectionString: uriText,
+      );
+    }
+    return RedisConnection(
+      id: row.id ?? 0,
+      name: row.name,
+      host: row.host ?? 'localhost',
+      port: row.port ?? 6379,
+      username: row.username,
+      password: row.password,
+      useSSL: row.useSSL,
+      connectionString: row.connectionString,
+    );
+  }
+
   final int id;
   final String name;
   final String host;
   final int port;
   final String? username;
   final String? password;
+  final bool useSSL;
+  final String? connectionString;
 
   redis.RedisConnection? _conn;
   redis.Command? _command;
@@ -28,7 +75,19 @@ class RedisConnection {
   Future<void> connect() async {
     if (_isConnected && _command != null) return;
     _conn = redis.RedisConnection();
-    _command = await _conn!.connect(host, port);
+    final sslPaths = extractSslCertificatePathsFromString(connectionString);
+    final secure = useSSL || sslPaths.hasAny;
+    if (secure) {
+      final context = buildSecurityContext(sslPaths);
+      final socket = await SecureSocket.connect(
+        host,
+        port,
+        context: context,
+      );
+      _command = await _conn!.connectWithSocket(socket);
+    } else {
+      _command = await _conn!.connect(host, port);
+    }
     if (password != null && password!.isNotEmpty) {
       if (username != null && username!.trim().isNotEmpty) {
         await _command!.send_object(['AUTH', username!.trim(), password!]);
@@ -308,7 +367,12 @@ class RedisConnectionTestFake extends RedisConnection {
     this.firstScanKeys = const ['alpha', 'beta'],
     this.secondScanKeys = const <String>[],
     this.dbSizeResult = 2,
-  }) : super(id: -1, name: 'test-fake', host: 'localhost', port: 6379);
+  }) : super(
+          id: -1,
+          name: 'test-fake',
+          host: 'localhost',
+          port: 6379,
+        );
 
   final List<String> firstScanKeys;
   final List<String> secondScanKeys;

lib/core/database/redis_service.dart

@@ -23,14 +23,7 @@ class RedisService {
       existing.disconnect(); // fire-and-forget; disconnect is safe
     }
 
-    final conn = RedisConnection(
-      id: id,
-      name: row.name,
-      host: row.host ?? 'localhost',
-      port: row.port ?? 6379,
-      username: row.username,
-      password: row.password,
-    );
+    final conn = RedisConnection.fromConnectionRow(row);
     _connections[id] = conn;
     return conn;
   }