fix(connections): connect MongoDB over SSH and Cloudflare tunnels (#1621)

[datlechin]

Fixes #1621

Problem

A MongoDB connection over an SSH (or Cloudflare) tunnel fails to connect. The SSH section's own "Test connection" passes, but the General-section test and a real connect fail with:

No suitable servers found (`serverSelectionTryOnce` set): [connection refused calling hello on 'localhost:27017']. Topology type: Single

Root cause

tunneledConnection() rewrites a connection's host/port to the local tunnel endpoint (127.0.0.1:<localPort>), but the MongoDB driver prefers additionalFields["mongoHosts"] over host/port, and that field still holds the original localhost:27017. Every MongoDB connection always has mongoHosts populated, even single-host ones, so the driver dials the original address and bypasses the tunnel.

The SSH-section "Test connection" only checks the libssh2 handshake, which is why it passes while the actual driver connect fails.

Why not just clear mongoHosts

Clearing the seed list alone fixes the single-host case but leaves replica sets broken: with a single seed and no directConnection, the driver defaults to topology discovery, runs hello, learns the members' advertised hostnames, and connects to those directly, escaping the tunnel. A tunnel forwards one local port, so the correct behavior is a direct connection to that one node. This is also the documented way mature clients (Studio 3T, NoSQLBooster, the PyMongo docs) reach MongoDB through a tunnel.

Fix

In tunneledConnection(), for a non-SRV MongoDB connection:

• clear mongoHosts so the driver uses the rewritten 127.0.0.1:<localPort>
• set directConnection=true so topology discovery does not leave the tunnel
• skip SRV/Atlas connections (directConnection is invalid with an SRV URI, and an IP cannot satisfy SRV/TLS; tunnel + SRV is not supported regardless)

Applies to both SSH and Cloudflare tunnels via the shared helper.

directConnection=true means the client talks only to the tunneled node: no replica set failover, and writes require that node to be the primary. That is inherent to single-port tunneling and is strictly better than failing to connect. The multi-host SSH warning in the connection form was updated to match.

Changes

• DatabaseManager+Tunnel.swift: collapse the MongoDB seed list to the tunnel endpoint and force a direct connection
• DatabaseConnection.swift: usesMongoSrv helper mirroring the driver's SRV detection
• GeneralPaneView.swift: corrected the multi-host tunnel warning
• DatabaseManagerTunnelTests.swift: tests for the rewrite, the SRV skip, and the non-MongoDB no-op

No PluginKit ABI change; host app only.

Tests

xcodebuild -project TablePro.xcodeproj -scheme TablePro test \
  -skipPackagePluginValidation \
  -only-testing:TableProTests/DatabaseManagerTunnelTests