fix: connection URL parsing, SSH key resolution, and export compatibility

CHANGELOG.md

@@ -7,11 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Connection URL parsing: SSH `user:password@host` split, `safeModeLevel` from TablePlus URLs, case-insensitive query params
+- Connection URL export: SSH password, Redis database index, MongoDB auth params (`authSource`, `authMechanism`, `replicaSet`), and multi-host
+- SSH Private Key auth resolves keys from `~/.ssh/config` and default locations (`id_ed25519`, `id_rsa`, `id_ecdsa`) when no explicit key path is set
+
 ### Changed
 
 - Inspector: dense field list, PK/FK key icons, Set NULL/DEFAULT in picker dropdowns, toolbar tracking separator
 - OpenSSL shared as dylib across app and plugins, saving ~15MB in bundle size
 
+### Fixed
+
+- Connection form: `usePrivateKey=true` from URL no longer disables Test/Create buttons
+- Transient connections from URL clean up keychain entries on connection failure
+
 ## [0.36.0] - 2026-04-27
 
 ### Added

TablePro/AppDelegate+ConnectionHandler.swift

@@ -41,16 +41,23 @@ extension AppDelegate {
         }
 
         let connection: DatabaseConnection
+        let isTransient: Bool
         if let matched = matchedConnection {
             connection = matched
+            isTransient = false
         } else {
             connection = buildTransientConnection(from: parsed)
+            isTransient = true
         }
 
         if !parsed.password.isEmpty {
             ConnectionStorage.shared.savePassword(parsed.password, for: connection.id)
         }
 
+        if let sshPass = parsed.sshPassword, !sshPass.isEmpty {
+            ConnectionStorage.shared.saveSSHPassword(sshPass, for: connection.id)
+        }
+
         // Check if already connected or connecting (by ID or by params).
         // This catches duplicates from URL handler, auto-reconnect, or any other source.
         if DatabaseManager.shared.activeSessions[connection.id] != nil {
@@ -94,6 +101,10 @@ extension AppDelegate {
                 self.handlePostConnectionActions(parsed, connectionId: connection.id)
             } catch {
                 connectionLogger.error("Database URL connect failed: \(error.localizedDescription)")
+                if isTransient {
+                    ConnectionStorage.shared.deletePassword(for: connection.id)
+                    ConnectionStorage.shared.deleteSSHPassword(for: connection.id)
+                }
                 await self.handleConnectionFailure(error)
             }
         }
@@ -545,6 +556,8 @@ extension AppDelegate {
             tagId = ConnectionURLParser.tagId(fromEnvName: envName)
         }
 
+        let resolvedSafeMode = parsed.safeModeLevel.flatMap(SafeModeLevel.from(urlInteger:)) ?? .silent
+
         var connection = DatabaseConnection(
             name: parsed.connectionName ?? parsed.suggestedName,
             host: parsed.host,
@@ -556,6 +569,7 @@ extension AppDelegate {
             sslConfig: sslConfig,
             color: color,
             tagId: tagId,
+            safeModeLevel: resolvedSafeMode,
             mongoAuthSource: parsed.authSource,
             mongoUseSrv: parsed.useSrv,
             mongoAuthMechanism: parsed.mongoQueryParams["authMechanism"],

TablePro/Core/SSH/LibSSH2TunnelFactory.swift

@@ -482,20 +482,27 @@ internal enum LibSSH2TunnelFactory {
             return PasswordAuthenticator(password: sshPassword)
 
         case .privateKey:
-            let primary = buildKeyFileAuthenticator(
-                keyPath: config.privateKeyPath,
-                providedPassphrase: credentials.keyPassphrase,
-                configEntry: configEntry,
-                canPrompt: true
-            )
+            let keyPaths = resolveIdentityFiles(privateKeyPath: config.privateKeyPath, configEntry: configEntry)
+            guard !keyPaths.isEmpty else {
+                throw SSHTunnelError.authenticationFailed
+            }
+            var authenticators: [any SSHAuthenticator] = keyPaths.map { keyPath in
+                buildKeyFileAuthenticator(
+                    keyPath: keyPath,
+                    providedPassphrase: credentials.keyPassphrase,
+                    configEntry: configEntry,
+                    canPrompt: true
+                )
+            }
             if config.totpMode != .none {
-                let totpAuth = KeyboardInteractiveAuthenticator(
+                authenticators.append(KeyboardInteractiveAuthenticator(
                     password: nil,
                     totpProvider: buildTOTPProvider(config: config, credentials: credentials)
-                )
-                return CompositeAuthenticator(authenticators: [primary, totpAuth])
+                ))
             }
-            return primary
+            return authenticators.count == 1
+                ? authenticators[0]
+                : CompositeAuthenticator(authenticators: authenticators)
 
         case .sshAgent:
             // Resolve agent socket: UI config > SSH config IdentityAgent > system default
@@ -511,7 +518,7 @@ internal enum LibSSH2TunnelFactory {
             var authenticators: [any SSHAuthenticator] = [AgentAuthenticator(socketPath: socketPath)]
 
             // Fallback: try key files if agent has no loaded identities
-            for keyPath in resolveIdentityFiles(config: config, configEntry: configEntry) {
+            for keyPath in resolveIdentityFiles(privateKeyPath: config.privateKeyPath, configEntry: configEntry) {
                 authenticators.append(buildKeyFileAuthenticator(
                     keyPath: keyPath,
                     providedPassphrase: credentials.keyPassphrase,
@@ -634,13 +641,22 @@ internal enum LibSSH2TunnelFactory {
 
         switch jumpHost.authMethod {
         case .privateKey:
-            return KeyFileAuthenticator(
-                keyPath: jumpHost.privateKeyPath,
-                providedPassphrase: nil,
-                canPrompt: true,
-                useKeychain: configEntry?.useKeychain ?? true,
-                addKeysToAgent: configEntry?.addKeysToAgent ?? false
-            )
+            let keyPaths = resolveIdentityFiles(privateKeyPath: jumpHost.privateKeyPath, configEntry: configEntry)
+            guard !keyPaths.isEmpty else {
+                throw SSHTunnelError.authenticationFailed
+            }
+            let authenticators = keyPaths.map { path in
+                KeyFileAuthenticator(
+                    keyPath: path,
+                    providedPassphrase: nil,
+                    canPrompt: true,
+                    useKeychain: configEntry?.useKeychain ?? true,
+                    addKeysToAgent: configEntry?.addKeysToAgent ?? false
+                )
+            }
+            return authenticators.count == 1
+                ? authenticators[0]
+                : CompositeAuthenticator(authenticators: authenticators)
         case .sshAgent:
             let socketPath = configEntry?.identityAgent
             let agent = AgentAuthenticator(socketPath: socketPath)
@@ -658,38 +674,26 @@ internal enum LibSSH2TunnelFactory {
         }
     }
 
-    /// Resolve identity file paths for key file authentication.
-    /// Priority: user-configured path > SSH config IdentityFile(s) > default key paths.
-    /// Respects `IdentitiesOnly` — skips default paths when set.
-    /// Returns multiple paths when SSH config has multiple IdentityFile directives.
     private static func resolveIdentityFiles(
-        config: SSHConfiguration,
+        privateKeyPath: String,
         configEntry: SSHConfigEntry?
     ) -> [String] {
-        // User-configured path in the connection UI always takes priority
-        if !config.privateKeyPath.isEmpty {
-            return [config.privateKeyPath]
+        if !privateKeyPath.isEmpty {
+            return [privateKeyPath]
         }
-
-        // SSH config IdentityFile(s) — try all in order
         if let files = configEntry?.identityFiles, !files.isEmpty {
             return files
         }
-
-        // When IdentitiesOnly is set, don't try default key paths
         if configEntry?.identitiesOnly == true {
             return []
         }
-
-        // Fall back to default key paths
         let sshDir = FileManager.default.homeDirectoryForCurrentUser
             .appendingPathComponent(".ssh", isDirectory: true)
         return ["id_ed25519", "id_rsa", "id_ecdsa"]
             .map { sshDir.appendingPathComponent($0).path }
             .filter { FileManager.default.isReadableFile(atPath: $0) }
     }
 
-
     private static func buildTOTPProvider(
         config: SSHConfiguration,
         credentials: SSHTunnelCredentials

TablePro/Core/Utilities/Connection/ConnectionURLFormatter.swift

@@ -25,7 +25,7 @@ struct ConnectionURLFormatter {
 
         let ssh = connection.resolvedSSHConfig
         if ssh.enabled {
-            return formatSSH(connection, sshConfig: ssh, scheme: scheme, password: password)
+            return formatSSH(connection, sshConfig: ssh, scheme: scheme, password: password, sshPassword: sshPassword)
         }
 
         return formatStandard(connection, scheme: scheme, password: password)
@@ -56,12 +56,17 @@ struct ConnectionURLFormatter {
         _ connection: DatabaseConnection,
         sshConfig ssh: SSHConfiguration,
         scheme: String,
-        password: String?
+        password: String?,
+        sshPassword: String?
     ) -> String {
         var result = "\(scheme)+ssh://"
 
         if !ssh.username.isEmpty {
-            result += "\(percentEncodeUserinfo(ssh.username))@"
+            result += percentEncodeUserinfo(ssh.username)
+            if let sshPassword, !sshPassword.isEmpty {
+                result += ":\(percentEncodeUserinfo(sshPassword))"
+            }
+            result += "@"
         }
         result += ssh.host
         if ssh.port != 22 {
@@ -83,9 +88,12 @@ struct ConnectionURLFormatter {
             result += ":\(connection.port)"
         }
 
-        let sshPathComponent = connection.type == .oracle
+        var sshPathComponent = connection.type == .oracle
             ? (connection.oracleServiceName ?? connection.database)
             : connection.database
+        if connection.type == .redis, let redisDb = connection.redisDatabase, redisDb > 0 {
+            sshPathComponent = String(redisDb)
+        }
         result += "/\(sshPathComponent)"
 
         let query = buildQueryString(connection, sshConfig: ssh)
@@ -111,14 +119,22 @@ struct ConnectionURLFormatter {
             result += "@"
         }
 
-        result += connection.host
-        if connection.port != connection.type.defaultPort {
-            result += ":\(connection.port)"
+        if connection.type.pluginTypeId == "MongoDB",
+           let mongoHosts = connection.additionalFields["mongoHosts"], !mongoHosts.isEmpty {
+            result += mongoHosts
+        } else {
+            result += connection.host
+            if connection.port != connection.type.defaultPort {
+                result += ":\(connection.port)"
+            }
         }
 
-        let pathComponent = connection.type == .oracle
+        var pathComponent = connection.type == .oracle
             ? (connection.oracleServiceName ?? connection.database)
             : connection.database
+        if connection.type == .redis, let redisDb = connection.redisDatabase, redisDb > 0 {
+            pathComponent = String(redisDb)
+        }
         result += "/\(pathComponent)"
 
         let query = buildQueryString(connection)
@@ -178,6 +194,19 @@ struct ConnectionURLFormatter {
             params.append("env=\(encoded)")
         }
 
+        if let authSource = connection.mongoAuthSource, !authSource.isEmpty {
+            params.append("authSource=\(percentEncodeQueryValue(authSource))")
+        }
+        if let authMech = connection.mongoAuthMechanism, !authMech.isEmpty {
+            params.append("authMechanism=\(percentEncodeQueryValue(authMech))")
+        }
+        if let replicaSet = connection.mongoReplicaSet, !replicaSet.isEmpty {
+            params.append("replicaSet=\(percentEncodeQueryValue(replicaSet))")
+        }
+        if connection.mongoUseSrv {
+            params.append("mongoUseSrv=true")
+        }
+
         return params.joined(separator: "&")
     }
 
@@ -210,4 +239,11 @@ struct ConnectionURLFormatter {
         allowed.remove(charactersIn: ":@")
         return value.addingPercentEncoding(withAllowedCharacters: allowed) ?? value
     }
+
+    private static func percentEncodeQueryValue(_ value: String) -> String {
+        value.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed)?
+            .replacingOccurrences(of: "&", with: "%26")
+            .replacingOccurrences(of: "=", with: "%3D")
+            ?? value
+    }
 }