proxy/

Package conncheck validates that a configured server row is actually reachable and usable: that an SSH bastion accepts the stored key, and that a database target can be dialed (and authenticated against) — optionally through that bastion.

Package kubernetes holds the end-to-end integration suite for the Kubernetes port-forward tunnel: a real k3s cluster, a real PostgreSQL pod, and dbbat's own proxy dialing through `pods/portforward`.

Package mongodb implements a transparent MongoDB wire-protocol proxy for dbbat: it terminates client authentication (SASL PLAIN over TLS or a dbb_ API key), authenticates to the upstream MongoDB with stored credentials (SCRAM-SHA-256), and grant-checks, classifies, logs and quota-enforces every command — the same pipeline as the PostgreSQL/Oracle/MySQL proxies.

Package testsupport holds fixtures shared by the protocol proxies' test suites (PostgreSQL, MySQL, MongoDB, Oracle, SQL Server).

Package upstream owns the single path dbbat takes from "a server row" to "an authenticated connection to that server".