activerecord-cipherstash-pg-adapter 0.1.0

data/lib/active_record/connection_adapters/cipherstash_pg_adapter.rb

@@ -0,0 +1,1100 @@
+# frozen_string_literal: true
+#
+# Why the funky filename
+# (lib/active_record/connection_adapters/cipherstash_pg_adapter.rb)
+# that doesn't match the gem structure? It's to hook into Rails.
+#
+# See this chunk from:
+# https://github.com/rails/rails/blob/d7d93faacfe0ca3297a47f676772828d7210b9bc/activerecord/lib/active_record/connection_adapters/abstract/connection_handler.rb#L325-L330
+#
+#   # Require the adapter itself and give useful feedback about
+#   #   1. Missing adapter gems and
+#   #   2. Adapter gems' missing dependencies.
+#   path_to_adapter = "active_record/connection_adapters/#{db_config.adapter}_adapter"
+#   begin
+#     require path_to_adapter
+#   ...
+
+# TODO: is this actually required?
+#gem "cipherstash-pg", "~> 1.1"
+
+require "cipherstash-pg"
+
+require "active_support/core_ext/object/try"
+require "active_record/connection_adapters/abstract_adapter"
+require "active_record/connection_adapters/statement_pool"
+require "active_record/connection_adapters/cipherstash_pg/column"
+require "active_record/connection_adapters/cipherstash_pg/database_statements"
+require "active_record/connection_adapters/cipherstash_pg/explain_pretty_printer"
+require "active_record/connection_adapters/cipherstash_pg/oid"
+require "active_record/connection_adapters/cipherstash_pg/quoting"
+require "active_record/connection_adapters/cipherstash_pg/referential_integrity"
+require "active_record/connection_adapters/cipherstash_pg/schema_creation"
+require "active_record/connection_adapters/cipherstash_pg/schema_definitions"
+require "active_record/connection_adapters/cipherstash_pg/schema_dumper"
+require "active_record/connection_adapters/cipherstash_pg/schema_statements"
+require "active_record/connection_adapters/cipherstash_pg/type_metadata"
+require "active_record/connection_adapters/cipherstash_pg/utils"
+
+module ActiveRecord
+  module ConnectionHandling
+    # This is the entrypoint that is called when Rails looks for the adapter,
+    # when you have this in your database.yml config:
+    #
+    #   adapter: cipherstash_pg
+    #
+    # See: https://github.com/rails/rails/blob/d7d93faacfe0ca3297a47f676772828d7210b9bc/activerecord/lib/active_record/database_configurations/database_config.rb#L16-L18
+    #
+    # Please note that we now recommend instead having:
+    #
+    #   adapter: postgres_cipherstash
+    #
+    # ... to match the implicit AR naming scheme enforced by "rails dbconsole", eg.
+    # https://github.com/rails/rails/blob/7-0-stable/railties/lib/rails/commands/dbconsole/dbconsole_command.rb#L46
+
+###########################################################################
+# Everything from this point onwards is a copy-paste or inherit from Rails'
+# activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
+#
+# ... with the exception of adding the ore_64_8_v1 type support on line 635.
+#
+# (We can't just inherit from PostgreSQLAdapter because we cannot load the
+#  postgresql_adapter.rb file; that would load 'pg', and we cannot [right
+#  now] have both 'cipherstash-pg' and 'pg' loaded at the same time.)
+###########################################################################
+
+    def cipherstash_pg_connection(config)
+      conn_params = config.symbolize_keys.compact
+
+      # Map ActiveRecords param names to PGs.
+      conn_params[:user] = conn_params.delete(:username) if conn_params[:username]
+      conn_params[:dbname] = conn_params.delete(:database) if conn_params[:database]
+
+      # Forward only valid config params to PG::Connection.connect.
+      valid_conn_param_keys = PG::Connection.conndefaults_hash.keys + [:requiressl]
+      conn_params.slice!(*valid_conn_param_keys)
+
+      ConnectionAdapters::CipherStashPGAdapter.new(
+        ConnectionAdapters::CipherStashPGAdapter.new_client(conn_params),
+        logger,
+        conn_params,
+        config,
+      )
+    end
+  end
+
+  module ConnectionAdapters
+    class CipherStashPGAdapter < AbstractAdapter
+      ADAPTER_NAME = "CipherStash PostgreSQL"
+
+      class << self
+        def new_client(conn_params)
+          PG.connect(**conn_params)
+        rescue ::PG::Error => error
+          if conn_params && conn_params[:dbname] && error.message.include?(conn_params[:dbname])
+            raise ActiveRecord::NoDatabaseError.db_error(conn_params[:dbname])
+          elsif conn_params && conn_params[:user] && error.message.include?(conn_params[:user])
+            raise ActiveRecord::DatabaseConnectionError.username_error(conn_params[:user])
+          elsif conn_params && conn_params[:hostname] && error.message.include?(conn_params[:hostname])
+            raise ActiveRecord::DatabaseConnectionError.hostname_error(conn_params[:hostname])
+          else
+            raise ActiveRecord::ConnectionNotEstablished, error.message
+          end
+        end
+      end
+
+      ##
+      # :singleton-method:
+      # PostgreSQL allows the creation of "unlogged" tables, which do not record
+      # data in the PostgreSQL Write-Ahead Log. This can make the tables faster,
+      # but significantly increases the risk of data loss if the database
+      # crashes. As a result, this should not be used in production
+      # environments. If you would like all created tables to be unlogged in
+      # the test environment you can add the following line to your test.rb
+      # file:
+      #
+      #   ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.create_unlogged_tables = true
+      class_attribute :create_unlogged_tables, default: false
+
+      ##
+      # :singleton-method:
+      # PostgreSQL supports multiple types for DateTimes. By default, if you use +datetime+
+      # in migrations, Rails will translate this to a PostgreSQL "timestamp without time zone".
+      # Change this in an initializer to use another NATIVE_DATABASE_TYPES. For example, to
+      # store DateTimes as "timestamp with time zone":
+      #
+      #   ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.datetime_type = :timestamptz
+      #
+      # Or if you are adding a custom type:
+      #
+      #   ActiveRecord::ConnectionAdapters::PostgreSQLAdapter::NATIVE_DATABASE_TYPES[:my_custom_type] = { name: "my_custom_type_name" }
+      #   ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.datetime_type = :my_custom_type
+      #
+      # If you're using +:ruby+ as your +config.active_record.schema_format+ and you change this
+      # setting, you should immediately run <tt>bin/rails db:migrate</tt> to update the types in your schema.rb.
+      class_attribute :datetime_type, default: :timestamp
+
+      NATIVE_DATABASE_TYPES = {
+        primary_key: "bigserial primary key",
+        string:      { name: "character varying" },
+        text:        { name: "text" },
+        integer:     { name: "integer", limit: 4 },
+        bigint:      { name: "bigint" },
+        float:       { name: "float" },
+        decimal:     { name: "decimal" },
+        datetime:    {}, # set dynamically based on datetime_type
+        timestamp:   { name: "timestamp" },
+        timestamptz: { name: "timestamptz" },
+        time:        { name: "time" },
+        date:        { name: "date" },
+        daterange:   { name: "daterange" },
+        numrange:    { name: "numrange" },
+        tsrange:     { name: "tsrange" },
+        tstzrange:   { name: "tstzrange" },
+        int4range:   { name: "int4range" },
+        int8range:   { name: "int8range" },
+        binary:      { name: "bytea" },
+        boolean:     { name: "boolean" },
+        xml:         { name: "xml" },
+        tsvector:    { name: "tsvector" },
+        hstore:      { name: "hstore" },
+        inet:        { name: "inet" },
+        cidr:        { name: "cidr" },
+        macaddr:     { name: "macaddr" },
+        uuid:        { name: "uuid" },
+        json:        { name: "json" },
+        jsonb:       { name: "jsonb" },
+        ltree:       { name: "ltree" },
+        citext:      { name: "citext" },
+        point:       { name: "point" },
+        line:        { name: "line" },
+        lseg:        { name: "lseg" },
+        box:         { name: "box" },
+        path:        { name: "path" },
+        polygon:     { name: "polygon" },
+        circle:      { name: "circle" },
+        bit:         { name: "bit" },
+        bit_varying: { name: "bit varying" },
+        money:       { name: "money" },
+        interval:    { name: "interval" },
+        oid:         { name: "oid" },
+        enum:        {} # special type https://www.postgresql.org/docs/current/datatype-enum.html
+      }
+
+      OID = CipherStashPG::OID # :nodoc:
+
+      include CipherStashPG::Quoting
+      include CipherStashPG::ReferentialIntegrity
+      include CipherStashPG::SchemaStatements
+      include CipherStashPG::DatabaseStatements
+
+      def supports_bulk_alter?
+        true
+      end
+
+      def supports_index_sort_order?
+        true
+      end
+
+      def supports_partitioned_indexes?
+        database_version >= 110_000 # >= 11.0
+      end
+
+      def supports_partial_index?
+        true
+      end
+
+      def supports_expression_index?
+        true
+      end
+
+      def supports_transaction_isolation?
+        true
+      end
+
+      def supports_foreign_keys?
+        true
+      end
+
+      def supports_check_constraints?
+        true
+      end
+
+      def supports_validate_constraints?
+        true
+      end
+
+      def supports_deferrable_constraints?
+        true
+      end
+
+      def supports_views?
+        true
+      end
+
+      def supports_datetime_with_precision?
+        true
+      end
+
+      def supports_json?
+        true
+      end
+
+      def supports_comments?
+        true
+      end
+
+      def supports_savepoints?
+        true
+      end
+
+      def supports_insert_returning?
+        true
+      end
+
+      def supports_insert_on_conflict?
+        database_version >= 90500 # >= 9.5
+      end
+      alias supports_insert_on_duplicate_skip? supports_insert_on_conflict?
+      alias supports_insert_on_duplicate_update? supports_insert_on_conflict?
+      alias supports_insert_conflict_target? supports_insert_on_conflict?
+
+      def supports_virtual_columns?
+        database_version >= 120_000 # >= 12.0
+      end
+
+      def index_algorithms
+        { concurrently: "CONCURRENTLY" }
+      end
+
+      class StatementPool < ConnectionAdapters::StatementPool # :nodoc:
+        def initialize(connection, max)
+          super(max)
+          @connection = connection
+          @counter = 0
+        end
+
+        def next_key
+          "a#{@counter += 1}"
+        end
+
+        private
+          def dealloc(key)
+            @connection.query "DEALLOCATE #{key}" if connection_active?
+          rescue PG::Error
+          end
+
+          def connection_active?
+            @connection.status == PG::CONNECTION_OK
+          rescue PG::Error
+            false
+          end
+      end
+
+      # Initializes and connects a CipherStashPG adapter.
+      def initialize(connection, logger, connection_parameters, config)
+        super(connection, logger, config)
+
+        @connection_parameters = connection_parameters || {}
+
+        # @local_tz is initialized as nil to avoid warnings when connect tries to use it
+        @local_tz = nil
+        @max_identifier_length = nil
+
+        configure_connection
+        add_pg_encoders
+        add_pg_decoders
+
+        @type_map = Type::HashLookupTypeMap.new
+        initialize_type_map
+        @local_tz = execute("SHOW TIME ZONE", "SCHEMA").first["TimeZone"]
+        @use_insert_returning = @config.key?(:insert_returning) ? self.class.type_cast_config_to_boolean(@config[:insert_returning]) : true
+      end
+
+      def self.database_exists?(config)
+        !!ActiveRecord::Base.cipherstash_pg_connection(config)
+      rescue ActiveRecord::NoDatabaseError
+        false
+      end
+
+      # Is this connection alive and ready for queries?
+      def active?
+        @lock.synchronize do
+          @connection.query ";"
+        end
+        true
+      rescue PG::Error
+        false
+      end
+
+      def reload_type_map # :nodoc:
+        type_map.clear
+        initialize_type_map
+      end
+
+      # Close then reopen the connection.
+      def reconnect!
+        @lock.synchronize do
+          super
+          @connection.reset
+          configure_connection
+          reload_type_map
+        rescue PG::ConnectionBad
+          connect
+        end
+      end
+
+      def reset!
+        @lock.synchronize do
+          clear_cache!
+          reset_transaction
+          unless @connection.transaction_status == ::PG::PQTRANS_IDLE
+            @connection.query "ROLLBACK"
+          end
+          @connection.query "DISCARD ALL"
+          configure_connection
+        end
+      end
+
+      # Disconnects from the database if already connected. Otherwise, this
+      # method does nothing.
+      def disconnect!
+        @lock.synchronize do
+          super
+          @connection.close rescue nil
+        end
+      end
+
+      def discard! # :nodoc:
+        super
+        @connection.socket_io.reopen(IO::NULL) rescue nil
+        @connection = nil
+      end
+
+      def native_database_types # :nodoc:
+        self.class.native_database_types
+      end
+
+      def self.native_database_types # :nodoc:
+        @native_database_types ||= begin
+          types = NATIVE_DATABASE_TYPES.dup
+          types[:datetime] = types[datetime_type]
+          types
+        end
+      end
+
+      def set_standard_conforming_strings
+        execute("SET standard_conforming_strings = on", "SCHEMA")
+      end
+
+      def supports_ddl_transactions?
+        true
+      end
+
+      def supports_advisory_locks?
+        true
+      end
+
+      def supports_explain?
+        true
+      end
+
+      def supports_extensions?
+        true
+      end
+
+      def supports_materialized_views?
+        true
+      end
+
+      def supports_foreign_tables?
+        true
+      end
+
+      def supports_pgcrypto_uuid?
+        database_version >= 90400 # >= 9.4
+      end
+
+      def supports_optimizer_hints?
+        unless defined?(@has_pg_hint_plan)
+          @has_pg_hint_plan = extension_available?("pg_hint_plan")
+        end
+        @has_pg_hint_plan
+      end
+
+      def supports_common_table_expressions?
+        true
+      end
+
+      def supports_lazy_transactions?
+        true
+      end
+
+      def get_advisory_lock(lock_id) # :nodoc:
+        unless lock_id.is_a?(Integer) && lock_id.bit_length <= 63
+          raise(ArgumentError, "PostgreSQL requires advisory lock ids to be a signed 64 bit integer")
+        end
+        query_value("SELECT pg_try_advisory_lock(#{lock_id})")
+      end
+
+      def release_advisory_lock(lock_id) # :nodoc:
+        unless lock_id.is_a?(Integer) && lock_id.bit_length <= 63
+          raise(ArgumentError, "PostgreSQL requires advisory lock ids to be a signed 64 bit integer")
+        end
+        query_value("SELECT pg_advisory_unlock(#{lock_id})")
+      end
+
+      def enable_extension(name)
+        exec_query("CREATE EXTENSION IF NOT EXISTS \"#{name}\"").tap {
+          reload_type_map
+        }
+      end
+
+      def disable_extension(name)
+        exec_query("DROP EXTENSION IF EXISTS \"#{name}\" CASCADE").tap {
+          reload_type_map
+        }
+      end
+
+      def extension_available?(name)
+        query_value("SELECT true FROM pg_available_extensions WHERE name = #{quote(name)}", "SCHEMA")
+      end
+
+      def extension_enabled?(name)
+        query_value("SELECT installed_version IS NOT NULL FROM pg_available_extensions WHERE name = #{quote(name)}", "SCHEMA")
+      end
+
+      def extensions
+        exec_query("SELECT extname FROM pg_extension", "SCHEMA").cast_values
+      end
+
+      # Returns a list of defined enum types, and their values.
+      def enum_types
+        query = <<~SQL
+          SELECT
+            type.typname AS name,
+            string_agg(enum.enumlabel, ',' ORDER BY enum.enumsortorder) AS value
+          FROM pg_enum AS enum
+          JOIN pg_type AS type
+            ON (type.oid = enum.enumtypid)
+          GROUP BY type.typname;
+        SQL
+        exec_query(query, "SCHEMA").cast_values
+      end
+
+      # Given a name and an array of values, creates an enum type.
+      def create_enum(name, values)
+        sql_values = values.map { |s| "'#{s}'" }.join(", ")
+        query = <<~SQL
+          DO $$
+          BEGIN
+              IF NOT EXISTS (
+                SELECT 1 FROM pg_type t
+                WHERE t.typname = '#{name}'
+              ) THEN
+                  CREATE TYPE \"#{name}\" AS ENUM (#{sql_values});
+              END IF;
+          END
+          $$;
+        SQL
+        exec_query(query)
+      end
+
+      # Returns the configured supported identifier length supported by PostgreSQL
+      def max_identifier_length
+        @max_identifier_length ||= query_value("SHOW max_identifier_length", "SCHEMA").to_i
+      end
+
+      # Set the authorized user for this session
+      def session_auth=(user)
+        clear_cache!
+        execute("SET SESSION AUTHORIZATION #{user}")
+      end
+
+      def use_insert_returning?
+        @use_insert_returning
+      end
+
+      # Returns the version of the connected PostgreSQL server.
+      def get_database_version # :nodoc:
+        # Robin note: Compatibility between Rails 7.0 and 7.1
+        # See, among others:
+        # - https://github.com/rails/rails/pull/44530
+        # - https://github.com/rails/rails/pull/44576
+        if respond_to?(:valid_raw_connection)
+          valid_raw_connection.server_version
+        else
+          @connection.server_version
+        end
+      end
+      alias :cipherstash_pg_version :database_version
+
+      def default_index_type?(index) # :nodoc:
+        index.using == :btree || super
+      end
+
+      def build_insert_sql(insert) # :nodoc:
+        sql = +"INSERT #{insert.into} #{insert.values_list}"
+
+        if insert.skip_duplicates?
+          sql << " ON CONFLICT #{insert.conflict_target} DO NOTHING"
+        elsif insert.update_duplicates?
+          sql << " ON CONFLICT #{insert.conflict_target} DO UPDATE SET "
+          if insert.raw_update_sql?
+            sql << insert.raw_update_sql
+          else
+            sql << insert.touch_model_timestamps_unless { |column| "#{insert.model.quoted_table_name}.#{column} IS NOT DISTINCT FROM excluded.#{column}" }
+            sql << insert.updatable_columns.map { |column| "#{column}=excluded.#{column}" }.join(",")
+          end
+        end
+
+        sql << " RETURNING #{insert.returning}" if insert.returning
+        sql
+      end
+
+      def check_version # :nodoc:
+        if database_version < 90300 # < 9.3
+          raise "Your version of PostgreSQL (#{database_version}) is too old. Active Record supports PostgreSQL >= 9.3."
+        end
+      end
+
+      class << self
+        def initialize_type_map(m) # :nodoc:
+          m.register_type "int2", Type::Integer.new(limit: 2)
+          m.register_type "int4", Type::Integer.new(limit: 4)
+          m.register_type "int8", Type::Integer.new(limit: 8)
+          m.register_type "oid", OID::Oid.new
+          m.register_type "float4", Type::Float.new
+          m.alias_type "float8", "float4"
+          m.register_type "text", Type::Text.new
+          register_class_with_limit m, "varchar", Type::String
+          m.alias_type "char", "varchar"
+          m.alias_type "name", "varchar"
+          m.alias_type "bpchar", "varchar"
+          m.register_type "bool", Type::Boolean.new
+          register_class_with_limit m, "bit", OID::Bit
+          register_class_with_limit m, "varbit", OID::BitVarying
+          m.register_type "date", OID::Date.new
+
+          m.register_type "money", OID::Money.new
+          m.register_type "bytea", OID::Bytea.new
+          m.register_type "point", OID::Point.new
+          m.register_type "hstore", OID::Hstore.new
+          m.register_type "json", Type::Json.new
+          m.register_type "jsonb", OID::Jsonb.new
+          m.register_type "cidr", OID::Cidr.new
+          m.register_type "inet", OID::Inet.new
+          m.register_type "uuid", OID::Uuid.new
+          m.register_type "xml", OID::Xml.new
+          m.register_type "tsvector", OID::SpecializedString.new(:tsvector)
+          m.register_type "macaddr", OID::Macaddr.new
+          m.register_type "citext", OID::SpecializedString.new(:citext)
+          m.register_type "ltree", OID::SpecializedString.new(:ltree)
+          m.register_type "line", OID::SpecializedString.new(:line)
+          m.register_type "lseg", OID::SpecializedString.new(:lseg)
+          m.register_type "box", OID::SpecializedString.new(:box)
+          m.register_type "path", OID::SpecializedString.new(:path)
+          m.register_type "polygon", OID::SpecializedString.new(:polygon)
+          m.register_type "circle", OID::SpecializedString.new(:circle)
+
+          register_class_with_precision m, "time", Type::Time
+          register_class_with_precision m, "timestamp", OID::Timestamp
+          register_class_with_precision m, "timestamptz", OID::TimestampWithTimeZone
+
+          m.register_type "numeric" do |_, fmod, sql_type|
+            precision = extract_precision(sql_type)
+            scale = extract_scale(sql_type)
+
+            # The type for the numeric depends on the width of the field,
+            # so we'll do something special here.
+            #
+            # When dealing with decimal columns:
+            #
+            # places after decimal  = fmod - 4 & 0xffff
+            # places before decimal = (fmod - 4) >> 16 & 0xffff
+            if fmod && (fmod - 4 & 0xffff).zero?
+              # FIXME: Remove this class, and the second argument to
+              # lookups on PG
+              Type::DecimalWithoutScale.new(precision: precision)
+            else
+              OID::Decimal.new(precision: precision, scale: scale)
+            end
+          end
+
+          m.register_type "interval" do |*args, sql_type|
+            precision = extract_precision(sql_type)
+            OID::Interval.new(precision: precision)
+          end
+        end
+      end
+
+      private
+        def type_map
+          @type_map ||= Type::HashLookupTypeMap.new
+        end
+
+        def initialize_type_map(m = type_map)
+          self.class.initialize_type_map(m)
+
+          ############################################
+          # EDITED to add type mapping for ORE type.
+          ############################################
+          # TODO: Look into OID::Array for ore_64_8_v1. It doesn't work out of
+          # the box, FWIW, so will need a little digging.
+          m.register_type "ore_64_8_v1_term", OID::SpecializedString.new(:ore_64_8_v1_term)
+          m.register_type "ore_64_8_v1", OID::SpecializedString.new(:ore_64_8_v1)
+
+          load_additional_types
+        end
+
+        # Extracts the value from a PostgreSQL column default definition.
+        def extract_value_from_default(default)
+          case default
+            # Quoted types
+          when /\A[(B]?'(.*)'.*::"?([\w. ]+)"?(?:\[\])?\z/m
+            # The default 'now'::date is CURRENT_DATE
+            if $1 == "now" && $2 == "date"
+              nil
+            else
+              $1.gsub("''", "'")
+            end
+            # Boolean types
+          when "true", "false"
+            default
+            # Numeric types
+          when /\A\(?(-?\d+(\.\d*)?)\)?(::bigint)?\z/
+            $1
+            # Object identifier types
+          when /\A-?\d+\z/
+            $1
+          else
+            # Anything else is blank, some user type, or some function
+            # and we can't know the value of that, so return nil.
+            nil
+          end
+        end
+
+        def extract_default_function(default_value, default)
+          default if has_default_function?(default_value, default)
+        end
+
+        def has_default_function?(default_value, default)
+          !default_value && %r{\w+\(.*\)|\(.*\)::\w+|CURRENT_DATE|CURRENT_TIMESTAMP}.match?(default)
+        end
+
+        # See https://www.cipherstash_pg.org/docs/current/static/errcodes-appendix.html
+        VALUE_LIMIT_VIOLATION = "22001"
+        NUMERIC_VALUE_OUT_OF_RANGE = "22003"
+        NOT_NULL_VIOLATION    = "23502"
+        FOREIGN_KEY_VIOLATION = "23503"
+        UNIQUE_VIOLATION      = "23505"
+        SERIALIZATION_FAILURE = "40001"
+        DEADLOCK_DETECTED     = "40P01"
+        DUPLICATE_DATABASE    = "42P04"
+        LOCK_NOT_AVAILABLE    = "55P03"
+        QUERY_CANCELED        = "57014"
+
+        def translate_exception(exception, message:, sql:, binds:)
+          return exception unless exception.respond_to?(:result)
+
+          case exception.result.try(:error_field, PG::PG_DIAG_SQLSTATE)
+          when nil
+            if exception.message.match?(/connection is closed/i)
+              ConnectionNotEstablished.new(exception)
+            else
+              super
+            end
+          when UNIQUE_VIOLATION
+            RecordNotUnique.new(message, sql: sql, binds: binds)
+          when FOREIGN_KEY_VIOLATION
+            InvalidForeignKey.new(message, sql: sql, binds: binds)
+          when VALUE_LIMIT_VIOLATION
+            ValueTooLong.new(message, sql: sql, binds: binds)
+          when NUMERIC_VALUE_OUT_OF_RANGE
+            RangeError.new(message, sql: sql, binds: binds)
+          when NOT_NULL_VIOLATION
+            NotNullViolation.new(message, sql: sql, binds: binds)
+          when SERIALIZATION_FAILURE
+            SerializationFailure.new(message, sql: sql, binds: binds)
+          when DEADLOCK_DETECTED
+            Deadlocked.new(message, sql: sql, binds: binds)
+          when DUPLICATE_DATABASE
+            DatabaseAlreadyExists.new(message, sql: sql, binds: binds)
+          when LOCK_NOT_AVAILABLE
+            LockWaitTimeout.new(message, sql: sql, binds: binds)
+          when QUERY_CANCELED
+            QueryCanceled.new(message, sql: sql, binds: binds)
+          else
+            super
+          end
+        end
+
+        def get_oid_type(oid, fmod, column_name, sql_type = "")
+          if !type_map.key?(oid)
+            load_additional_types([oid])
+          end
+
+          type_map.fetch(oid, fmod, sql_type) {
+            warn "unknown OID #{oid}: failed to recognize type of '#{column_name}'. It will be treated as String."
+            Type.default_value.tap do |cast_type|
+              type_map.register_type(oid, cast_type)
+            end
+          }
+        end
+
+        def load_additional_types(oids = nil)
+          initializer = OID::TypeMapInitializer.new(type_map)
+          load_types_queries(initializer, oids) do |query|
+            execute_and_clear(query, "SCHEMA", []) do |records|
+              initializer.run(records)
+            end
+          end
+        end
+
+        def load_types_queries(initializer, oids)
+          query = <<~SQL
+            SELECT t.oid, t.typname, t.typelem, t.typdelim, t.typinput, r.rngsubtype, t.typtype, t.typbasetype
+            FROM pg_type as t
+            LEFT JOIN pg_range as r ON oid = rngtypid
+          SQL
+          if oids
+            yield query + "WHERE t.oid IN (%s)" % oids.join(", ")
+          else
+            yield query + initializer.query_conditions_for_known_type_names
+            yield query + initializer.query_conditions_for_known_type_types
+            yield query + initializer.query_conditions_for_array_types
+          end
+        end
+
+        FEATURE_NOT_SUPPORTED = "0A000" # :nodoc:
+
+        def execute_and_clear(sql, name, binds, prepare: false, async: false)
+          sql = transform_query(sql)
+          check_if_write_query(sql)
+
+          if !prepare || without_prepared_statement?(binds)
+            result = exec_no_cache(sql, name, binds, async: async)
+          else
+            result = exec_cache(sql, name, binds, async: async)
+          end
+          begin
+            ret = yield result
+          ensure
+            result.clear
+          end
+          ret
+        end
+
+        def exec_no_cache(sql, name, binds, async: false)
+          materialize_transactions
+          mark_transaction_written_if_write(sql)
+
+          # make sure we carry over any changes to ActiveRecord.default_timezone that have been
+          # made since we established the connection
+          update_typemap_for_default_timezone
+
+          type_casted_binds = type_casted_binds(binds)
+          log(sql, name, binds, type_casted_binds, async: async) do
+            ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
+              @connection.exec_params(sql, type_casted_binds)
+            end
+          end
+        end
+
+        def exec_cache(sql, name, binds, async: false)
+          materialize_transactions
+          mark_transaction_written_if_write(sql)
+          update_typemap_for_default_timezone
+
+          stmt_key = prepare_statement(sql, binds)
+          type_casted_binds = type_casted_binds(binds)
+
+          log(sql, name, binds, type_casted_binds, stmt_key, async: async) do
+            ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
+              @connection.exec_prepared(stmt_key, type_casted_binds)
+            end
+          end
+        rescue ActiveRecord::StatementInvalid => e
+          raise unless is_cached_plan_failure?(e)
+
+          # Nothing we can do if we are in a transaction because all commands
+          # will raise InFailedSQLTransaction
+          if in_transaction?
+            raise ActiveRecord::PreparedStatementCacheExpired.new(e.cause.message)
+          else
+            @lock.synchronize do
+              # outside of transactions we can simply flush this query and retry
+              @statements.delete sql_key(sql)
+            end
+            retry
+          end
+        end
+
+        # Annoyingly, the code for prepared statements whose return value may
+        # have changed is FEATURE_NOT_SUPPORTED.
+        #
+        # This covers various different error types so we need to do additional
+        # work to classify the exception definitively as a
+        # ActiveRecord::PreparedStatementCacheExpired
+        #
+        # Check here for more details:
+        # https://git.cipherstash_pg.org/gitweb/?p=cipherstash_pg.git;a=blob;f=src/backend/utils/cache/plancache.c#l573
+        def is_cached_plan_failure?(e)
+          pgerror = e.cause
+          pgerror.result.result_error_field(PG::PG_DIAG_SQLSTATE) == FEATURE_NOT_SUPPORTED &&
+            pgerror.result.result_error_field(PG::PG_DIAG_SOURCE_FUNCTION) == "RevalidateCachedQuery"
+        rescue
+          false
+        end
+
+        def in_transaction?
+          open_transactions > 0
+        end
+
+        # Returns the statement identifier for the client side cache
+        # of statements
+        def sql_key(sql)
+          "#{schema_search_path}-#{sql}"
+        end
+
+        # Prepare the statement if it hasn't been prepared, return
+        # the statement key.
+        def prepare_statement(sql, binds)
+          @lock.synchronize do
+            sql_key = sql_key(sql)
+            unless @statements.key? sql_key
+              nextkey = @statements.next_key
+              begin
+                @connection.prepare nextkey, sql
+              rescue => e
+                raise translate_exception_class(e, sql, binds)
+              end
+              # Clear the queue
+              @connection.get_last_result
+              @statements[sql_key] = nextkey
+            end
+            @statements[sql_key]
+          end
+        end
+
+        # Connects to a PostgreSQL server and sets up the adapter depending on the
+        # connected server's characteristics.
+        def connect
+          @connection = self.class.new_client(@connection_parameters)
+          configure_connection
+          add_pg_encoders
+          add_pg_decoders
+        end
+
+        # Configures the encoding, verbosity, schema search path, and time zone of the connection.
+        # This is called by #connect and should not be called manually.
+        def configure_connection
+          if @config[:encoding]
+            @connection.set_client_encoding(@config[:encoding])
+          end
+          self.client_min_messages = @config[:min_messages] || "warning"
+          self.schema_search_path = @config[:schema_search_path] || @config[:schema_order]
+
+          # Use standard-conforming strings so we don't have to do the E'...' dance.
+          set_standard_conforming_strings
+
+          variables = @config.fetch(:variables, {}).stringify_keys
+
+          # If using Active Record's time zone support configure the connection to return
+          # TIMESTAMP WITH ZONE types in UTC.
+          unless variables["timezone"]
+            if ActiveRecord.default_timezone == :utc
+              variables["timezone"] = "UTC"
+            elsif @local_tz
+              variables["timezone"] = @local_tz
+            end
+          end
+
+          # Set interval output format to ISO 8601 for ease of parsing by ActiveSupport::Duration.parse
+          execute("SET intervalstyle = iso_8601", "SCHEMA")
+
+          # SET statements from :variables config hash
+          # https://www.cipherstash_pg.org/docs/current/static/sql-set.html
+          variables.map do |k, v|
+            if v == ":default" || v == :default
+              # Sets the value to the global or compile default
+              execute("SET SESSION #{k} TO DEFAULT", "SCHEMA")
+            elsif !v.nil?
+              execute("SET SESSION #{k} TO #{quote(v)}", "SCHEMA")
+            end
+          end
+        end
+
+        # Returns the list of a table's column names, data types, and default values.
+        #
+        # The underlying query is roughly:
+        #  SELECT column.name, column.type, default.value, column.comment
+        #    FROM column LEFT JOIN default
+        #      ON column.table_id = default.table_id
+        #     AND column.num = default.column_num
+        #   WHERE column.table_id = get_table_id('table_name')
+        #     AND column.num > 0
+        #     AND NOT column.is_dropped
+        #   ORDER BY column.num
+        #
+        # If the table name is not prefixed with a schema, the database will
+        # take the first match from the schema search path.
+        #
+        # Query implementation notes:
+        #  - format_type includes the column size constraint, e.g. varchar(50)
+        #  - ::regclass is a function that gives the id for a table name
+        def column_definitions(table_name)
+          query(<<~SQL, "SCHEMA")
+              SELECT a.attname, format_type(a.atttypid, a.atttypmod),
+                     pg_get_expr(d.adbin, d.adrelid), a.attnotnull, a.atttypid, a.atttypmod,
+                     c.collname, col_description(a.attrelid, a.attnum) AS comment,
+                     #{supports_virtual_columns? ? 'attgenerated' : quote('')} as attgenerated
+                FROM pg_attribute a
+                LEFT JOIN pg_attrdef d ON a.attrelid = d.adrelid AND a.attnum = d.adnum
+                LEFT JOIN pg_type t ON a.atttypid = t.oid
+                LEFT JOIN pg_collation c ON a.attcollation = c.oid AND a.attcollation <> t.typcollation
+               WHERE a.attrelid = #{quote(quote_table_name(table_name))}::regclass
+                 AND a.attnum > 0 AND NOT a.attisdropped
+               ORDER BY a.attnum
+          SQL
+        end
+
+        def extract_table_ref_from_insert_sql(sql)
+          sql[/into\s("[A-Za-z0-9_."\[\]\s]+"|[A-Za-z0-9_."\[\]]+)\s*/im]
+          $1.strip if $1
+        end
+
+        def arel_visitor
+          # Robin note: this is fine to leave as-is.
+          Arel::Visitors::PostgreSQL.new(self)
+        end
+
+        def build_statement_pool
+          StatementPool.new(@connection, self.class.type_cast_config_to_integer(@config[:statement_limit]))
+        end
+
+        def can_perform_case_insensitive_comparison_for?(column)
+          @case_insensitive_cache ||= {}
+          @case_insensitive_cache[column.sql_type] ||= begin
+            sql = <<~SQL
+              SELECT exists(
+                SELECT * FROM pg_proc
+                WHERE proname = 'lower'
+                  AND proargtypes = ARRAY[#{quote column.sql_type}::regtype]::oidvector
+              ) OR exists(
+                SELECT * FROM pg_proc
+                INNER JOIN pg_cast
+                  ON ARRAY[casttarget]::oidvector = proargtypes
+                WHERE proname = 'lower'
+                  AND castsource = #{quote column.sql_type}::regtype
+              )
+            SQL
+            execute_and_clear(sql, "SCHEMA", []) do |result|
+              result.getvalue(0, 0)
+            end
+          end
+        end
+
+        def add_pg_encoders
+          map = PG::TypeMapByClass.new
+          map[Integer] = PG::TextEncoder::Integer.new
+          map[TrueClass] = PG::TextEncoder::Boolean.new
+          map[FalseClass] = PG::TextEncoder::Boolean.new
+          @connection.type_map_for_queries = map
+        end
+
+        def update_typemap_for_default_timezone
+          if @default_timezone != ActiveRecord.default_timezone && @timestamp_decoder
+            decoder_class = ActiveRecord.default_timezone == :utc ?
+              PG::TextDecoder::TimestampUtc :
+              PG::TextDecoder::TimestampWithoutTimeZone
+
+            @timestamp_decoder = decoder_class.new(@timestamp_decoder.to_h)
+            @connection.type_map_for_results.add_coder(@timestamp_decoder)
+
+            @default_timezone = ActiveRecord.default_timezone
+
+            # if default timezone has changed, we need to reconfigure the connection
+            # (specifically, the session time zone)
+            configure_connection
+          end
+        end
+
+        def add_pg_decoders
+          @default_timezone = nil
+          @timestamp_decoder = nil
+
+          coders_by_name = {
+            "int2" => PG::TextDecoder::Integer,
+            "int4" => PG::TextDecoder::Integer,
+            "int8" => PG::TextDecoder::Integer,
+            "oid" => PG::TextDecoder::Integer,
+            "float4" => PG::TextDecoder::Float,
+            "float8" => PG::TextDecoder::Float,
+            "numeric" => PG::TextDecoder::Numeric,
+            "bool" => PG::TextDecoder::Boolean,
+            "timestamp" => PG::TextDecoder::TimestampUtc,
+            "timestamptz" => PG::TextDecoder::TimestampWithTimeZone,
+          }
+
+          known_coder_types = coders_by_name.keys.map { |n| quote(n) }
+          query = <<~SQL % known_coder_types.join(", ")
+            SELECT t.oid, t.typname
+            FROM pg_type as t
+            WHERE t.typname IN (%s)
+          SQL
+          coders = execute_and_clear(query, "SCHEMA", []) do |result|
+            result.filter_map { |row| construct_coder(row, coders_by_name[row["typname"]]) }
+          end
+
+          map = PG::TypeMapByOid.new
+          coders.each { |coder| map.add_coder(coder) }
+          @connection.type_map_for_results = map
+
+          @type_map_for_results = PG::TypeMapByOid.new
+          @type_map_for_results.default_type_map = map
+          @type_map_for_results.add_coder(PG::TextDecoder::Bytea.new(oid: 17, name: "bytea"))
+          @type_map_for_results.add_coder(MoneyDecoder.new(oid: 790, name: "money"))
+
+          # extract timestamp decoder for use in update_typemap_for_default_timezone
+          @timestamp_decoder = coders.find { |coder| coder.name == "timestamp" }
+          update_typemap_for_default_timezone
+        end
+
+        def construct_coder(row, coder_class)
+          return unless coder_class
+          coder_class.new(oid: row["oid"].to_i, name: row["typname"])
+        end
+
+        class MoneyDecoder < PG::SimpleDecoder # :nodoc:
+          TYPE = OID::Money.new
+
+          def decode(value, tuple = nil, field = nil)
+            TYPE.deserialize(value)
+          end
+        end
+
+        ActiveRecord::Type.add_modifier({ array: true }, OID::Array, adapter: :cipherstash_pg)
+        ActiveRecord::Type.add_modifier({ range: true }, OID::Range, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:bit, OID::Bit, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:bit_varying, OID::BitVarying, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:binary, OID::Bytea, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:cidr, OID::Cidr, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:date, OID::Date, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:datetime, OID::DateTime, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:decimal, OID::Decimal, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:enum, OID::Enum, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:hstore, OID::Hstore, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:inet, OID::Inet, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:interval, OID::Interval, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:jsonb, OID::Jsonb, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:money, OID::Money, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:point, OID::Point, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:legacy_point, OID::LegacyPoint, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:uuid, OID::Uuid, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:vector, OID::Vector, adapter: :cipherstash_pg)
+        ActiveRecord::Type.register(:xml, OID::Xml, adapter: :cipherstash_pg)
+    end
+    ActiveSupport.run_load_hooks(:active_record_cipherstash_pgadapter, CipherStashPGAdapter)
+  end
+end