[vinimcorrea]

Closes #12

Host side: TabularisDB/tabularis#1467. It must merge first; without it, the host never sends the proxy fields and this plugin behaves as before.

Problem

With SSH enabled, the host forwards one local port to the connection's host:port and gives the plugin 127.0.0.1:<port>. A mongodb+srv:// URI or a replica-set seedlist makes the driver discover the other members and connect to them by name, bypassing that forward. Only a single node works, and Atlas Private Link and replica sets behind a bastion can't be reached (#12).

Changes

The host PR adds a socks5_proxy driver capability. A driver that declares it gets a SOCKS5 proxy over the SSH session, and the host leaves host, port and connection_uri unchanged. The mongodb crate supports a SOCKS5 proxy through its socks5-proxy feature and the proxy* URI options, so the plugin only needs to pass the proxy on.

File	Change
.tabularium	declares "socks5_proxy": true
Cargo.toml	enables the socks5-proxy feature of mongodb
src/main.rs	apply_socks5_proxy() adds proxyHost, proxyPort and, when present, proxyUsername / proxyPassword to the URI, for both a connection_uri and one built from the legacy fields
README.md	new "SSH tunnels" section with the limitations

The driver gives the proxy hostnames unresolved, so the bastion resolves node names such as pl-0-...mongodb.net or mongo-internal.

Conflict with a proxy already in the URI. If SSH is enabled and the URI already sets proxyHost, proxyPort, proxyUsername or proxyPassword, the connection fails with an error. It doesn't pick one of the two proxies silently, so the SSH tab can't look active while the traffic takes another route:

The connection URI sets 'proxyHost', but SSH is enabled for this connection and Tabularis routes it through the SSH tunnel's SOCKS5 proxy. Remove the proxy options from the URI or disable SSH.

Without SSH, a URI proxy is used as before.

Other checks: the username and password must come together, the port must be valid, the credentials are percent-encoded, and the proxy password is masked in error messages.

Testing

• cargo test: 43 passed. New tests cover appending the proxy to SRV and seedlist URIs (with and without a path or options), the URI conflict, URI proxies kept without SSH, credential encoding and pairing, masking, legacy fields, and port validation.
• End to end with the host branch, through an OpenSSH bastion in Docker to a mongo:7.0 replica set whose only member is mongo-internal:27017, a name that resolves only on the bastion's network:
  • Connected, listed databases and queried shop.orders through both host backends (russh with proxy credentials, and system ssh -D).
  • A URI with proxyHost gave the error above.
  • Screenshots are in the host PR.
• Atlas Private Link, manually, before this cleanup: the proxy logged CONNECT to pl-0-...:1462, :1463 and :1464, one per replica-set member.

Limits

• SRV and TXT lookups stay local. For mongodb+srv://, the driver resolves the SRV and TXT records with the local resolver before connecting. If those records are published only in the private network's DNS, discovery fails, and a mongodb:// seedlist is needed. Atlas publishes them publicly, so Private Link works. I haven't been able to test a network where they are private-only.
• Requires the host PR. On an older Tabularis version, SSH keeps the single-port behavior.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Reviewed apply_socks5_proxy and its tests against the existing helpers (get_string_param, encode_uri_component, mask_mongo_uri). Port validation, credential pairing, percent-encoding, URI-conflict detection and query/path handling are correct. Proxy password masking is covered by the existing URI masking. Not executed (read-only review).

Files Reviewed (5 files)

• .tabularium
• Cargo.lock
• Cargo.toml
• README.md
• src/main.rs

---

_{Reviewed by claude-sonnet-5.5 · Input: 248 · Output: 1.5K · Cached: 167.5K}