<?php
declare(strict_types=1);

final class PostgresService
{
    /** @var array{host:string,port:int,database:string,user:string,password:string} */
    private array $credentials;

    private Settings $settings;

    /** @var array<string,resource> */
    private array $connections = [];

    public function __construct(array $credentials, Settings $settings)
    {
        $database = $credentials['database'] ?? 'postgres';
        if ($database === '*' || trim((string)$database) === '') {
            $database = 'postgres';
        }

        $this->credentials = [
            'host' => (string)($credentials['host'] ?? 'localhost'),
            'port' => (int)($credentials['port'] ?? 5432),
            'database' => (string)$database,
            'user' => (string)($credentials['user'] ?? 'postgres'),
            'password' => (string)($credentials['password'] ?? ''),
        ];
        $this->settings = $settings;
    }

    public function ensureMetadataSchema(): void
    {
        $this->query('CREATE SCHEMA IF NOT EXISTS da_plugin');
        $this->query(
            'CREATE TABLE IF NOT EXISTS da_plugin.access_hosts (
                da_user text NOT NULL,
                db_name text NOT NULL DEFAULT \'\',
                role_name text NOT NULL,
                host_pattern text NOT NULL,
                note text NOT NULL DEFAULT \'\',
                created_at timestamptz NOT NULL DEFAULT now(),
                updated_at timestamptz NOT NULL DEFAULT now(),
                PRIMARY KEY (role_name, db_name, host_pattern)
            )'
        );
        $this->query('ALTER TABLE da_plugin.access_hosts ADD COLUMN IF NOT EXISTS db_name text NOT NULL DEFAULT \'\'');
        $this->query('ALTER TABLE da_plugin.access_hosts DROP CONSTRAINT IF EXISTS access_hosts_pkey');
        $this->query('ALTER TABLE da_plugin.access_hosts ADD CONSTRAINT access_hosts_pkey PRIMARY KEY (role_name, db_name, host_pattern)');
        $this->query('ALTER TABLE da_plugin.access_hosts ADD COLUMN IF NOT EXISTS note text NOT NULL DEFAULT \'\'');
        $this->query('CREATE INDEX IF NOT EXISTS access_hosts_da_user_idx ON da_plugin.access_hosts (da_user)');
        $this->query('CREATE INDEX IF NOT EXISTS access_hosts_da_user_db_idx ON da_plugin.access_hosts (da_user, db_name)');

        $this->query(
            'CREATE TABLE IF NOT EXISTS da_plugin.grant_profiles (
                db_name text NOT NULL,
                role_name text NOT NULL,
                privileges text NOT NULL,
                updated_at timestamptz NOT NULL DEFAULT now(),
                PRIMARY KEY (db_name, role_name)
            )'
        );
    }

    /**
     * @return array{host:string,port:int}
     */
    public function connectionEndpoint(): array
    {
        return [
            'host' => $this->credentials['host'],
            'port' => (int)$this->credentials['port'],
        ];
    }

    public function serverPort(): int
    {
        $row = $this->fetchOne('SHOW port');
        $port = isset($row['port']) ? (int)$row['port'] : 0;
        if ($port > 0) {
            return $port;
        }

        return (int)$this->credentials['port'];
    }

    public function serverVersion(): string
    {
        $row = $this->fetchOne('SHOW server_version');
        if (isset($row['server_version'])) {
            return trim((string)$row['server_version']);
        }

        $row = $this->fetchOne('SELECT version() AS version');
        if (isset($row['version'])) {
            return trim((string)$row['version']);
        }

        return '';
    }

    public function countDatabasesForUser(string $daUser): int
    {
        $row = $this->fetchOne(
            'SELECT COUNT(*)::int AS cnt
             FROM pg_database
             WHERE datistemplate = false AND datname LIKE $1 ESCAPE \'\\\'',
            [$this->likePattern($daUser . '_')]
        );

        return isset($row['cnt']) ? (int)$row['cnt'] : 0;
    }

    /**
     * @return array<int,array{name:string,owner:string,size:string}>
     */
    public function listDatabasesForUser(string $daUser, bool $includeSize = true): array
    {
        if ($includeSize) {
            $rows = $this->fetchAll(
                'SELECT d.datname AS name,
                        pg_get_userbyid(d.datdba) AS owner,
                        pg_size_pretty(pg_database_size(d.datname)) AS size
                 FROM pg_database d
                 WHERE d.datistemplate = false AND d.datname LIKE $1 ESCAPE \'\\\'
                 ORDER BY d.datname',
                [$this->likePattern($daUser . '_')]
            );
        } else {
            $rows = $this->fetchAll(
                'SELECT d.datname AS name,
                        pg_get_userbyid(d.datdba) AS owner,
                        \'\'::text AS size
                 FROM pg_database d
                 WHERE d.datistemplate = false AND d.datname LIKE $1 ESCAPE \'\\\'
                 ORDER BY d.datname',
                [$this->likePattern($daUser . '_')]
            );
        }

        $out = [];
        foreach ($rows as $row) {
            $out[] = [
                'name' => (string)$row['name'],
                'owner' => (string)$row['owner'],
                'size' => (string)$row['size'],
            ];
        }

        return $out;
    }

    /**
     * @return array<int,array{name:string,can_login:bool}>
     */
    public function listRolesForUser(string $daUser): array
    {
        $rows = $this->fetchAll(
            'SELECT rolname AS name, rolcanlogin AS can_login
             FROM pg_roles
             WHERE rolname LIKE $1 ESCAPE \'\\\'
             ORDER BY rolname',
            [$this->likePattern($daUser . '_')]
        );

        $out = [];
        foreach ($rows as $row) {
            $out[] = [
                'name' => (string)$row['name'],
                'can_login' => ($row['can_login'] === 't' || $row['can_login'] === true),
            ];
        }

        return $out;
    }

    /**
     * @return array<string,array<int,string>>
     */
    public function listDatabaseUsersMap(string $daUser): array
    {
        $rows = $this->fetchAll(
            'SELECT d.datname AS db_name, r.rolname AS role_name
             FROM pg_database d
             JOIN pg_roles r ON r.rolname LIKE $1 ESCAPE \'\\\'
             WHERE d.datistemplate = false
               AND d.datname LIKE $2 ESCAPE \'\\\'
               AND (
                     d.datdba = r.oid
                     OR EXISTS (
                         SELECT 1
                         FROM aclexplode(COALESCE(d.datacl, acldefault(\'d\', d.datdba))) AS acl
                         WHERE acl.grantee = r.oid
                           AND acl.privilege_type = \'CONNECT\'
                     )
               )
             ORDER BY d.datname, r.rolname',
            [$this->likePattern($daUser . '_'), $this->likePattern($daUser . '_')]
        );

        $map = [];
        foreach ($rows as $row) {
            $db = (string)$row['db_name'];
            $role = (string)$row['role_name'];
            if (!isset($map[$db])) {
                $map[$db] = [];
            }
            $map[$db][] = $role;
        }

        return $map;
    }

    /**
     * @return array<string,array<int,string>>
     */
    public function listRoleDatabasesMap(string $daUser): array
    {
        $dbMap = $this->listDatabaseUsersMap($daUser);
        $out = [];
        foreach ($dbMap as $db => $roles) {
            foreach ($roles as $role) {
                if (!isset($out[$role])) {
                    $out[$role] = [];
                }
                $out[$role][] = $db;
            }
        }

        ksort($out);
        return $out;
    }

    /**
     * @return string[]
     */
    public function listDatabaseUsers(string $daUser, string $database): array
    {
        $rows = $this->fetchAll(
            'SELECT r.rolname AS role_name
             FROM pg_roles r
             JOIN pg_database d ON d.datname = $2
             WHERE r.rolname LIKE $1 ESCAPE \'\\\'
               AND d.datistemplate = false
               AND (
                     d.datdba = r.oid
                     OR EXISTS (
                         SELECT 1
                         FROM aclexplode(COALESCE(d.datacl, acldefault(\'d\', d.datdba))) AS acl
                         WHERE acl.grantee = r.oid
                           AND acl.privilege_type = \'CONNECT\'
                     )
               )
             ORDER BY r.rolname',
            [$this->likePattern($daUser . '_'), $database]
        );

        $out = [];
        foreach ($rows as $row) {
            $out[] = (string)$row['role_name'];
        }
        return $out;
    }

    public function roleExists(string $role): bool
    {
        $row = $this->fetchOne('SELECT 1 AS ok FROM pg_roles WHERE rolname = $1', [$role]);
        return !empty($row);
    }

    public function databaseExists(string $dbName): bool
    {
        $row = $this->fetchOne('SELECT 1 AS ok FROM pg_database WHERE datname = $1', [$dbName]);
        return !empty($row);
    }

    public function getDatabaseOwner(string $dbName): ?string
    {
        $row = $this->fetchOne('SELECT pg_get_userbyid(datdba) AS owner FROM pg_database WHERE datname = $1', [$dbName]);
        if (empty($row['owner'])) {
            return null;
        }
        return (string)$row['owner'];
    }

    /**
     * @return array{name:string,owner:string,size:string,encoding:string,collation:string}
     */
    public function getDatabaseInfo(string $dbName): array
    {
        $row = $this->fetchOne(
            'SELECT d.datname AS name,
                    pg_get_userbyid(d.datdba) AS owner,
                    pg_size_pretty(pg_database_size(d.datname)) AS size,
                    pg_encoding_to_char(d.encoding) AS encoding,
                    d.datcollate AS collation
             FROM pg_database d
             WHERE d.datname = $1',
            [$dbName]
        );

        if (empty($row)) {
            throw new RuntimeException('Nie znaleziono bazy danych: ' . $dbName);
        }

        return [
            'name' => (string)($row['name'] ?? $dbName),
            'owner' => (string)($row['owner'] ?? ''),
            'size' => (string)($row['size'] ?? '0 B'),
            'encoding' => (string)($row['encoding'] ?? 'UTF8'),
            'collation' => (string)($row['collation'] ?? ''),
        ];
    }

    /**
     * @return array{tables:int,views:int,triggers:int,routines:int}
     */
    public function getDatabaseObjectStats(string $dbName): array
    {
        $row = $this->fetchOne(
            'SELECT
                (SELECT COUNT(*)::int FROM information_schema.tables WHERE table_schema = \'public\' AND table_type = \'BASE TABLE\') AS tables,
                (SELECT COUNT(*)::int FROM information_schema.views WHERE table_schema = \'public\') AS views,
                (SELECT COUNT(*)::int FROM information_schema.triggers WHERE trigger_schema = \'public\') AS triggers,
                (SELECT COUNT(*)::int FROM information_schema.routines WHERE specific_schema = \'public\') AS routines',
            [],
            $dbName
        );

        return [
            'tables' => (int)($row['tables'] ?? 0),
            'views' => (int)($row['views'] ?? 0),
            'triggers' => (int)($row['triggers'] ?? 0),
            'routines' => (int)($row['routines'] ?? 0),
        ];
    }

    /**
     * @return string[]
     */
    public function roleOwnedDatabases(string $role, string $daUser): array
    {
        $rows = $this->fetchAll(
            'SELECT datname AS name
             FROM pg_database
             WHERE datistemplate = false
               AND pg_get_userbyid(datdba) = $1
               AND datname LIKE $2 ESCAPE \'\\\'
             ORDER BY datname',
            [$role, $this->likePattern($daUser . '_')]
        );

        $out = [];
        foreach ($rows as $row) {
            $out[] = (string)$row['name'];
        }
        return $out;
    }

    /**
     * @return string[]
     */
    public function roleAssignedDatabases(string $role, string $daUser): array
    {
        $rows = $this->fetchAll(
            'SELECT datname AS name
             FROM pg_database d
             JOIN pg_roles r ON r.rolname = $1
             WHERE d.datistemplate = false
               AND d.datname LIKE $2 ESCAPE \'\\\'
               AND (
                     d.datdba = r.oid
                     OR EXISTS (
                         SELECT 1
                         FROM aclexplode(COALESCE(d.datacl, acldefault(\'d\', d.datdba))) AS acl
                         WHERE acl.grantee = r.oid
                           AND acl.privilege_type = \'CONNECT\'
                     )
               )
             ORDER BY d.datname',
            [$role, $this->likePattern($daUser . '_')]
        );

        $out = [];
        foreach ($rows as $row) {
            $out[] = (string)$row['name'];
        }
        return $out;
    }

    /**
     * @return array<int,array{db_name:string,host:string,note:string}>
     */
    public function getRoleHostEntries(string $daUser, string $role, string $dbName = ''): array
    {
        $rows = $this->fetchAll(
            'SELECT db_name, host_pattern, note
             FROM da_plugin.access_hosts
             WHERE da_user = $1 AND role_name = $2 AND db_name = $3
             ORDER BY host_pattern',
            [$daUser, $role, $dbName]
        );

        $out = [];
        foreach ($rows as $row) {
            $out[] = [
                'db_name' => (string)($row['db_name'] ?? ''),
                'host' => (string)$row['host_pattern'],
                'note' => $this->sanitizeHostNote((string)($row['note'] ?? '')),
            ];
        }
        return $out;
    }

    /**
     * @return string[]
     */
    public function getRoleHosts(string $daUser, string $role): array
    {
        $entries = $this->getRoleHostEntries($daUser, $role);
        $out = [];
        foreach ($entries as $entry) {
            $out[] = $entry['host'];
        }
        return $out;
    }

    /**
     * @param string[] $hosts
     */
    public function replaceRoleHosts(string $daUser, string $role, array $hosts): void
    {
        $entries = [];
        foreach ($hosts as $host) {
            $entries[] = ['host' => (string)$host, 'note' => ''];
        }
        $this->replaceRoleHostsWithNotes($daUser, $role, $entries);
    }

    /**
     * @param array<int,array{host:string,note:string}> $hostEntries
     */
    public function replaceRoleHostsWithNotes(string $daUser, string $role, array $hostEntries, string $dbName = ''): void
    {
        $normalized = [];
        foreach ($hostEntries as $entry) {
            $host = trim((string)($entry['host'] ?? ''));
            if ($host === '') {
                continue;
            }
            $normalized[$host] = $this->sanitizeHostNote((string)($entry['note'] ?? ''));
        }

        $this->query(
            'DELETE FROM da_plugin.access_hosts WHERE da_user = $1 AND role_name = $2 AND db_name = $3',
            [$daUser, $role, $dbName]
        );

        foreach ($normalized as $host => $note) {
            $this->query(
                'INSERT INTO da_plugin.access_hosts (da_user, db_name, role_name, host_pattern, note, updated_at)
                 VALUES ($1, $2, $3, $4, $5, now())
                 ON CONFLICT (role_name, db_name, host_pattern)
                 DO UPDATE SET da_user = EXCLUDED.da_user, note = EXCLUDED.note, updated_at = now()',
                [$daUser, $dbName, $role, $host, $note]
            );
        }
    }

    public function deleteRoleHosts(string $daUser, string $role, ?string $dbName = null): void
    {
        if ($dbName === null) {
            $this->query('DELETE FROM da_plugin.access_hosts WHERE da_user = $1 AND role_name = $2', [$daUser, $role]);
            return;
        }

        $this->query(
            'DELETE FROM da_plugin.access_hosts WHERE da_user = $1 AND role_name = $2 AND db_name = $3',
            [$daUser, $role, $dbName]
        );
    }

    public function createRole(string $role, string $password): void
    {
        $qRole = $this->quoteIdentifier($role);
        $qPassword = $this->quoteLiteral($password);
        $this->query("SET password_encryption = 'scram-sha-256'");
        $this->query(
            'CREATE ROLE ' . $qRole . ' LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT NOREPLICATION PASSWORD ' . $qPassword
        );
    }

    public function changeRolePassword(string $role, string $password): void
    {
        $qRole = $this->quoteIdentifier($role);
        $qPassword = $this->quoteLiteral($password);
        $this->query("SET password_encryption = 'scram-sha-256'");
        $this->query('ALTER ROLE ' . $qRole . ' WITH LOGIN PASSWORD ' . $qPassword);
    }

    public function createDatabase(string $dbName, string $owner): void
    {
        $qDb = $this->quoteIdentifier($dbName);
        $qOwner = $this->quoteIdentifier($owner);

        $this->query('CREATE DATABASE ' . $qDb . ' WITH OWNER ' . $qOwner . " ENCODING 'UTF8' TEMPLATE template0");
        $this->enforceDatabaseIsolation($dbName);
    }

    public function dropDatabase(string $dbName): void
    {
        $qDb = $this->quoteIdentifier($dbName);
        $this->query(
            'SELECT pg_terminate_backend(pid)
             FROM pg_stat_activity
             WHERE datname = $1 AND pid <> pg_backend_pid()',
            [$dbName]
        );
        $this->query('DROP DATABASE IF EXISTS ' . $qDb);
    }

    public function dropRole(string $role): void
    {
        $qRole = $this->quoteIdentifier($role);
        $this->query('DROP ROLE IF EXISTS ' . $qRole);
    }

    public function reassignOwnedObjects(string $dbName, string $fromRole, string $toRole): void
    {
        if ($fromRole === $toRole) {
            return;
        }

        $qFrom = $this->quoteIdentifier($fromRole);
        $qTo = $this->quoteIdentifier($toRole);
        $this->query('REASSIGN OWNED BY ' . $qFrom . ' TO ' . $qTo, [], $dbName);
        $this->query('DROP OWNED BY ' . $qFrom, [], $dbName);
    }

    /**
     * @param string[] $privileges
     */
    public function grantPrivileges(string $dbName, string $role, array $privileges): void
    {
        $privileges = array_values(array_unique($privileges));
        if (empty($privileges)) {
            throw new RuntimeException('Brak uprawnień do nadania.');
        }
        $this->enforceDatabaseIsolation($dbName);

        if (in_array('ALL', $privileges, true)) {
            $this->grantAllPrivileges($dbName, $role);
            $this->saveGrantProfile($dbName, $role, ['ALL']);
            return;
        }

        $this->revokePrivilegesInternal($dbName, $role, false);

        $qDb = $this->quoteIdentifier($dbName);
        $qRole = $this->quoteIdentifier($role);

        $dbPrivsMap = [
            'CONNECT' => 'CONNECT',
            'CREATE' => 'CREATE',
            'TEMPORARY' => 'TEMPORARY',
        ];

        $dbPrivs = [];
        foreach ($dbPrivsMap as $key => $sqlPriv) {
            if (in_array($key, $privileges, true)) {
                $dbPrivs[] = $sqlPriv;
            }
        }

        if (!empty($dbPrivs)) {
            $this->query('GRANT ' . implode(', ', $dbPrivs) . ' ON DATABASE ' . $qDb . ' TO ' . $qRole);
        }

        $schemaPrivs = [];
        if (in_array('SCHEMA_USAGE', $privileges, true)) {
            $schemaPrivs[] = 'USAGE';
        }
        if (in_array('CREATE', $privileges, true)) {
            $schemaPrivs[] = 'CREATE';
        }

        $tablePrivs = [];
        $tableMap = [
            'TABLE_SELECT' => 'SELECT',
            'TABLE_INSERT' => 'INSERT',
            'TABLE_UPDATE' => 'UPDATE',
            'TABLE_DELETE' => 'DELETE',
            'TABLE_TRUNCATE' => 'TRUNCATE',
            'TABLE_REFERENCES' => 'REFERENCES',
            'TABLE_TRIGGER' => 'TRIGGER',
        ];
        foreach ($tableMap as $key => $sqlPriv) {
            if (in_array($key, $privileges, true)) {
                $tablePrivs[] = $sqlPriv;
            }
        }

        $sequencePrivs = [];
        $seqMap = [
            'SEQUENCE_USAGE' => 'USAGE',
            'SEQUENCE_SELECT' => 'SELECT',
            'SEQUENCE_UPDATE' => 'UPDATE',
        ];
        foreach ($seqMap as $key => $sqlPriv) {
            if (in_array($key, $privileges, true)) {
                $sequencePrivs[] = $sqlPriv;
            }
        }

        $functionExecute = in_array('FUNCTION_EXECUTE', $privileges, true);

        if (!empty($schemaPrivs)) {
            $this->query('GRANT ' . implode(', ', $schemaPrivs) . ' ON SCHEMA public TO ' . $qRole, [], $dbName);
        }

        if (!empty($tablePrivs)) {
            $this->query('GRANT ' . implode(', ', $tablePrivs) . ' ON ALL TABLES IN SCHEMA public TO ' . $qRole, [], $dbName);
        }

        if (!empty($sequencePrivs)) {
            $this->query('GRANT ' . implode(', ', $sequencePrivs) . ' ON ALL SEQUENCES IN SCHEMA public TO ' . $qRole, [], $dbName);
        }

        if ($functionExecute) {
            $this->query('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ' . $qRole, [], $dbName);
        }

        $owner = $this->getDatabaseOwner($dbName);
        if ($owner !== null) {
            $qOwner = $this->quoteIdentifier($owner);
            if (!empty($tablePrivs)) {
                $this->tryQuery(
                    'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public GRANT ' . implode(', ', $tablePrivs) . ' ON TABLES TO ' . $qRole,
                    [],
                    $dbName
                );
            }
            if (!empty($sequencePrivs)) {
                $this->tryQuery(
                    'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public GRANT ' . implode(', ', $sequencePrivs) . ' ON SEQUENCES TO ' . $qRole,
                    [],
                    $dbName
                );
            }
            if ($functionExecute) {
                $this->tryQuery(
                    'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ' . $qRole,
                    [],
                    $dbName
                );
            }
        }

        sort($privileges);
        $this->saveGrantProfile($dbName, $role, $privileges);
    }

    public function revokePrivileges(string $dbName, string $role): void
    {
        $this->revokePrivilegesInternal($dbName, $role, true);
    }

    public function getGrantProfile(string $dbName, string $role): array
    {
        $row = $this->fetchOne(
            'SELECT privileges FROM da_plugin.grant_profiles WHERE db_name = $1 AND role_name = $2',
            [$dbName, $role]
        );

        if (empty($row['privileges'])) {
            return [];
        }

        $parts = array_filter(array_map('trim', explode(',', (string)$row['privileges'])));
        $parts = array_map('strtoupper', $parts);
        return array_values(array_unique($parts));
    }

    /**
     * @return array{ok:bool,output:string}
     */
    public function syncHbaRules(bool $restartPostgresql = false): array
    {
        $script = $this->settings->hbaSyncScript();
        if (!is_file($script)) {
            return ['ok' => false, 'output' => 'Brak skryptu synchronizacji pg_hba: ' . $script];
        }

        $cmd = '/usr/bin/sudo -n ' . escapeshellarg($script);
        if ($restartPostgresql) {
            $cmd .= ' --restart-postgresql';
        }
        $cmd .= ' 2>&1';
        $output = [];
        $exitCode = 0;
        exec($cmd, $output, $exitCode);

        if ($restartPostgresql) {
            $this->resetConnections();
            if ($exitCode === 0 && !$this->waitForConnectionAfterRestart()) {
                $exitCode = 1;
                $output[] = 'PostgreSQL został zrestartowany, ale plugin nie odzyskał połączenia w czasie oczekiwania.';
            }
        }

        return [
            'ok' => $exitCode === 0,
            'output' => trim(implode("\n", $output)),
        ];
    }

    public function createTemporaryRole(string $role, string $password, int $expiresAt): void
    {
        $qRole = $this->quoteIdentifier($role);
        $qPassword = $this->quoteLiteral($password);
        $validUntil = gmdate('Y-m-d H:i:s+00', max($expiresAt, time() + 60));
        $qValidUntil = $this->quoteLiteral($validUntil);

        $this->query("SET password_encryption = 'scram-sha-256'");
        $this->query(
            'CREATE ROLE ' . $qRole .
            ' LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT NOREPLICATION PASSWORD ' . $qPassword .
            ' VALID UNTIL ' . $qValidUntil
        );
    }

    public function grantTemporaryAdminerAccess(string $dbName, string $role): void
    {
        $qDb = $this->quoteIdentifier($dbName);
        $qRole = $this->quoteIdentifier($role);

        $this->tryQuery('GRANT CONNECT, TEMPORARY ON DATABASE ' . $qDb . ' TO ' . $qRole);
        $this->tryQuery('GRANT USAGE ON SCHEMA public TO ' . $qRole, [], $dbName);
        $this->tryQuery(
            'GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER ON ALL TABLES IN SCHEMA public TO ' . $qRole,
            [],
            $dbName
        );
        $this->tryQuery(
            'GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA public TO ' . $qRole,
            [],
            $dbName
        );
        $this->tryQuery('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ' . $qRole, [], $dbName);
    }

    public function dropTemporaryRole(string $role): void
    {
        $qRole = $this->quoteIdentifier($role);
        $dbRows = $this->fetchAll(
            'SELECT datname AS name
             FROM pg_database
             WHERE datistemplate = false
             ORDER BY datname'
        );

        foreach ($dbRows as $dbRow) {
            $dbName = (string)($dbRow['name'] ?? '');
            if ($dbName === '') {
                continue;
            }
            $this->tryQuery('DROP OWNED BY ' . $qRole, [], $dbName);
        }

        $this->tryQuery('DROP ROLE IF EXISTS ' . $qRole);
    }

    public function cleanupExpiredAdminerRoles(string $rolePrefix = 'da_tmp_adminer_'): int
    {
        $rows = $this->fetchAll(
            'SELECT rolname AS name
             FROM pg_roles
             WHERE rolname LIKE $1 ESCAPE \'\\\'
               AND rolvaliduntil IS NOT NULL
               AND rolvaliduntil < now()
             ORDER BY rolname',
            [$this->likePattern($rolePrefix)]
        );

        if (empty($rows)) {
            return 0;
        }

        $removed = 0;
        foreach ($rows as $row) {
            $role = (string)($row['name'] ?? '');
            if ($role === '') {
                continue;
            }

            try {
                $this->dropTemporaryRole($role);
                if (!$this->roleExists($role)) {
                    $removed++;
                }
            } catch (Throwable $e) {
                // Ignorujemy błędy cleanupu, aby nie blokować logowania.
            }
        }

        return $removed;
    }

    private function grantAllPrivileges(string $dbName, string $role): void
    {
        $qDb = $this->quoteIdentifier($dbName);
        $qRole = $this->quoteIdentifier($role);
        $this->enforceDatabaseIsolation($dbName);

        $this->revokePrivilegesInternal($dbName, $role, false);

        $this->query('GRANT ALL PRIVILEGES ON DATABASE ' . $qDb . ' TO ' . $qRole);
        $this->query('GRANT USAGE, CREATE ON SCHEMA public TO ' . $qRole, [], $dbName);
        $this->query('GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ' . $qRole, [], $dbName);
        $this->query('GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ' . $qRole, [], $dbName);
        $this->query('GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO ' . $qRole, [], $dbName);

        $owner = $this->getDatabaseOwner($dbName);
        if ($owner !== null) {
            $qOwner = $this->quoteIdentifier($owner);
            $this->tryQuery(
                'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ' . $qRole,
                [],
                $dbName
            );
            $this->tryQuery(
                'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO ' . $qRole,
                [],
                $dbName
            );
            $this->tryQuery(
                'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO ' . $qRole,
                [],
                $dbName
            );
        }
    }

    private function revokePrivilegesInternal(string $dbName, string $role, bool $removeProfile): void
    {
        $qDb = $this->quoteIdentifier($dbName);
        $qRole = $this->quoteIdentifier($role);

        $this->tryQuery('REVOKE ALL PRIVILEGES ON DATABASE ' . $qDb . ' FROM ' . $qRole);
        $this->tryQuery('REVOKE ALL PRIVILEGES ON SCHEMA public FROM ' . $qRole, [], $dbName);
        $this->tryQuery('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM ' . $qRole, [], $dbName);
        $this->tryQuery('REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM ' . $qRole, [], $dbName);
        $this->tryQuery('REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public FROM ' . $qRole, [], $dbName);

        $owner = $this->getDatabaseOwner($dbName);
        if ($owner !== null) {
            $qOwner = $this->quoteIdentifier($owner);
            $this->tryQuery(
                'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public REVOKE ALL PRIVILEGES ON TABLES FROM ' . $qRole,
                [],
                $dbName
            );
            $this->tryQuery(
                'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public REVOKE ALL PRIVILEGES ON SEQUENCES FROM ' . $qRole,
                [],
                $dbName
            );
            $this->tryQuery(
                'ALTER DEFAULT PRIVILEGES FOR ROLE ' . $qOwner . ' IN SCHEMA public REVOKE ALL PRIVILEGES ON FUNCTIONS FROM ' . $qRole,
                [],
                $dbName
            );
        }

        if ($removeProfile) {
            $this->query('DELETE FROM da_plugin.grant_profiles WHERE db_name = $1 AND role_name = $2', [$dbName, $role]);
        }
    }

    /**
     * @param string[] $privileges
     */
    private function saveGrantProfile(string $dbName, string $role, array $privileges): void
    {
        sort($privileges);
        $serialized = implode(',', $privileges);
        $this->query(
            'INSERT INTO da_plugin.grant_profiles (db_name, role_name, privileges, updated_at)
             VALUES ($1, $2, $3, now())
             ON CONFLICT (db_name, role_name)
             DO UPDATE SET privileges = EXCLUDED.privileges, updated_at = now()',
            [$dbName, $role, $serialized]
        );
    }

    private function sanitizeHostNote(string $note): string
    {
        $note = preg_replace('/[\r\n\t]+/', ' ', $note) ?? '';
        $note = preg_replace('/\s+/', ' ', $note) ?? '';
        $note = trim($note);

        if (strlen($note) > NamePolicy::MAX_HOST_COMMENT_LEN) {
            $note = substr($note, 0, NamePolicy::MAX_HOST_COMMENT_LEN);
        }

        return $note;
    }

    private function likePattern(string $prefix): string
    {
        return str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $prefix) . '%';
    }

    private function quoteIdentifier(string $name): string
    {
        if (!preg_match('/^[A-Za-z0-9_]+$/', $name)) {
            throw new RuntimeException('Nieprawidłowy identyfikator PostgreSQL: ' . $name);
        }

        if (strlen($name) > NamePolicy::MAX_IDENTIFIER_LEN) {
            throw new RuntimeException('Identyfikator PostgreSQL przekracza 63 znaki: ' . $name);
        }

        return '"' . str_replace('"', '""', $name) . '"';
    }

    private function enforceDatabaseIsolation(string $dbName): void
    {
        $qDb = $this->quoteIdentifier($dbName);
        $this->query('REVOKE ALL PRIVILEGES ON DATABASE ' . $qDb . ' FROM PUBLIC');
        $this->tryQuery('REVOKE ALL PRIVILEGES ON SCHEMA public FROM PUBLIC', [], $dbName);
    }

    private function quoteLiteral(string $value, string $database = 'postgres'): string
    {
        $conn = $this->connect($database);
        $quoted = pg_escape_literal($conn, $value);
        if ($quoted === false) {
            throw new RuntimeException('Nie udało się bezpiecznie zacytować wartości SQL.');
        }

        return $quoted;
    }

    /**
     * @param array<int,mixed> $params
     */
    private function query(string $sql, array $params = [], string $database = 'postgres')
    {
        $conn = $this->connect($database);

        if ($params === []) {
            $res = @pg_query($conn, $sql);
        } else {
            $res = @pg_query_params($conn, $sql, $params);
        }

        if ($res === false) {
            throw new RuntimeException(trim((string)pg_last_error($conn)) . ' | SQL: ' . $sql);
        }

        return $res;
    }

    /**
     * @param array<int,mixed> $params
     */
    private function tryQuery(string $sql, array $params = [], string $database = 'postgres'): void
    {
        try {
            $this->query($sql, $params, $database);
        } catch (Throwable $e) {
            // celowo ignorujemy błędy pomocnicze (kompatybilność i idempotencja)
        }
    }

    /**
     * @param array<int,mixed> $params
     * @return array<int,array<string,mixed>>
     */
    private function fetchAll(string $sql, array $params = [], string $database = 'postgres'): array
    {
        $res = $this->query($sql, $params, $database);
        $rows = pg_fetch_all($res);
        if ($rows === false) {
            return [];
        }
        return $rows;
    }

    /**
     * @param array<int,mixed> $params
     * @return array<string,mixed>
     */
    private function fetchOne(string $sql, array $params = [], string $database = 'postgres'): array
    {
        $rows = $this->fetchAll($sql, $params, $database);
        if (empty($rows)) {
            return [];
        }
        return $rows[0];
    }

    /**
     * @return resource
     */
    private function connect(string $database = 'postgres')
    {
        if (isset($this->connections[$database])) {
            if (@pg_connection_status($this->connections[$database]) === PGSQL_CONNECTION_OK) {
                return $this->connections[$database];
            }
            @pg_close($this->connections[$database]);
            unset($this->connections[$database]);
        }

        $targetDb = $database !== '' ? $database : $this->credentials['database'];

        $connString = sprintf(
            "host=%s port=%d dbname=%s user=%s password=%s connect_timeout=5",
            $this->escapeConnValue($this->credentials['host']),
            $this->credentials['port'],
            $this->escapeConnValue($targetDb),
            $this->escapeConnValue($this->credentials['user']),
            $this->escapeConnValue($this->credentials['password'])
        );

        $conn = @pg_connect($connString);
        if ($conn === false) {
            throw new RuntimeException('Nie udało się połączyć z PostgreSQL.');
        }

        $this->connections[$database] = $conn;
        return $conn;
    }

    private function resetConnections(): void
    {
        foreach ($this->connections as $conn) {
            @pg_close($conn);
        }
        $this->connections = [];
    }

    private function waitForConnectionAfterRestart(int $timeoutSeconds = 20): bool
    {
        $deadline = time() + max(1, $timeoutSeconds);
        do {
            try {
                $this->resetConnections();
                $this->query('SELECT 1');
                return true;
            } catch (Throwable $e) {
                usleep(500000);
            }
        } while (time() < $deadline);

        $this->resetConnections();
        return false;
    }

    private function escapeConnValue(string $value): string
    {
        return "'" . str_replace(['\\', "'"], ['\\\\', "\\'"], $value) . "'";
    }
}