fix(ios): send the Redis ACL username so Valkey and Redis 6 users can sign in - #2084

A user reported that a Valkey login works in TablePro on macOS but is rejected on iOS and in the mobile app running on a Mac. Their password is 64 hex characters from openssl rand -hex 32, which is a red herring: that is exactly what Redis's own ACL GENPASS produces, and hiredis sends it with an explicit byte length.

Root cause

The mobile driver never sends the ACL username.

Redis and Valkey hard-code the one-argument form of AUTH to the default user. From authCommand() in src/acl.c, identical in every Redis 6+ and every Valkey:

if (c->argc == 2) {
    username = shared.default_username;   // always
    password = c->argv[1];
} else {
    username = c->argv[1];
    password = c->argv[2];
}

So AUTH <password> checks the password against default, never against an ACL user, and answers WRONGPASS invalid username-password pair or user is disabled.

The two code paths had diverged:

• macOS RedisPluginConnection.swift sent ["AUTH", username, password] when a username was set. Works.
• Mobile RedisDriver.swift always sent ["AUTH", password] and had no username property, and IOSDriverFactory forwarded connection.username to MySQL and PostgreSQL but not to Redis.

The iOS form has always shown a Username field for Redis, and it saved and synced. The user filled it in, the app stored it, and the driver threw it away. docs/databases/redis.mdx already documented the field as "sent as AUTH username password".

What changed

Rather than adding a username parameter and leaving two hand-written copies of the same logic, the AUTH rules and the Redis database-index resolution moved into two pure files that both platforms call:

• RedisAuthCommand decides the AUTH argument shape and classifies the server's rejection.
• RedisDatabaseIndex resolves additionalFields["redisDatabase"] then database then 0.

Also fixed on mobile, found on the same path:

• The Redis database index was ignored, so a connection configured on the Mac for db 3 opened db 0. That matters here because Valkey's db= ACL selectors scope a user to specific databases, and connections always start in db 0.
• The Redis TLS options never set the client certificate or key.

Error messages

A rejected login now says what to change. When no username was sent, it points at the Username field. Redis's nopass reply and a pre-6 server's arity error each get their own message. WRONGPASS with a username supplied gets no hint, because the server deliberately does not say which half was wrong.

ERR invalid password is a Redis 5 reply and maps to a plain rejection with no hint, since Redis 5 has no ACL users and suggesting a username there would be wrong.

Testing

13 new unit tests over the two pure helpers, plus 2 for the SSL accessors. macOS RedisDriver plugin builds, iOS app builds, swiftlint --strict clean.

Note

docs/databases/redis.mdx also documents a related trap: >password sets a password and #hash sets a SHA-256 hash, and a 64-character hex string is syntactically valid for both. ACL SETUSER u on #<64-hex> is accepted where > was meant and fails every later login with the same WRONGPASS.