pg_reports 0.9.0 → 1.0.0

data/app/controllers/pg_reports/dashboard_controller.rb

@@ -4,6 +4,38 @@ module PgReports
   class DashboardController < ActionController::Base
     layout "pg_reports/application"
 
+    INDEX_LOOKUP = <<~SQL
+      #{Executor::QUERY_TAG}
+      SELECT schemaname, tablename, indexname, indexdef
+      FROM pg_indexes
+      WHERE indexname = $1 AND ($2::text = '' OR schemaname = $2)
+    SQL
+
+    MAX_RESULT_ROWS = 100
+    # Pages that draw the database selector, the only thing that shows a size
+    DATABASE_SELECTOR_ACTIONS = %w[index show].freeze
+    RATE_LIMITED_ACTIONS = %i[
+      explain_analyze execute_query run_query migration_preview create_migration
+      reset_statistics enable_pg_stat_statements send_to_telegram
+      start_query_monitoring load_query_history
+    ].freeze
+    # PostgreSQL's own limit. A `$99999999` in captured text must not allocate.
+    MAX_BIND_PARAMETERS = 65_535
+    TYPED_PLACEHOLDER = /\b(interval|timestamptz|timestamp|date|time)\s+\$(\d+)/i
+    # What a read-only transaction does not stop: these work outside the database's
+    # own data, leave something behind on a pooled connection, or run SQL held in a
+    # string, which would put the name of anything else here out of reach of a check
+    # that only reads the text. This narrows what a mistake can do; it is not a
+    # sandbox.
+    ADMIN_FUNCTIONS = /\b(?:
+      pg_read_file | pg_read_binary_file | pg_ls_\w+ | pg_stat_file | pg_file_\w+ |
+      pg_terminate_backend | pg_cancel_backend | pg_reload_conf | pg_rotate_logfile |
+      pg_stat_reset\w* | pg_stat_statements_reset | pg_advisory_\w+ | pg_switch_wal |
+      pg_promote | pg_wal_replay_\w+ | pg_create_\w+ | pg_drop_\w+ | pg_logical_\w+ |
+      pg_replication_\w+ | lo_import | lo_export | dblink\w* |
+      query_to_xml\w* | ts_stat | ts_rewrite
+    )\b/x
+
     # CSRF protection. ActionController::Base does NOT enforce this by default;
     # we opt in explicitly because every state-changing endpoint here
     # (switch_*, execute_query, create_migration, reset_statistics, telegram
@@ -11,21 +43,23 @@ module PgReports
     # ships authenticity_token in forms and X-CSRF-Token in XHR.
     protect_from_forgery with: :exception
 
-    before_action :authenticate_dashboard!, if: -> { PgReports.config.dashboard_auth.present? }
+    before_action :authenticate_dashboard!
+    around_action :within_selected_locale
     before_action :set_categories
     before_action :resolve_database_selection
     around_action :within_selected_database
-    before_action :block_query_monitor_in_standalone, only: %i[
+    before_action :require_query_monitor, only: %i[
       start_query_monitoring stop_query_monitoring query_monitor_status
       query_monitor_feed load_query_history download_query_monitor
     ]
-    before_action :enforce_rate_limit!, only: %i[
-      explain_analyze execute_query run_query create_migration
-    ]
+    before_action :enforce_rate_limit!, only: RATE_LIMITED_ACTIONS
+    before_action :require_migration_creation, only: %i[migration_preview create_migration]
 
     helper_method :category_disabled_reason, :category_disabled?
+    helper_method :dashboard_locales, :selected_locale
 
     def index
+      Compatibility.check_postgresql_once!
       @pg_stat_status = pg_stat_status
       @current_database = PgReports.system.current_database
     end
@@ -48,6 +82,21 @@ module PgReports
     # POST /switch_target
     # Persists the chosen target in session, clears the database choice (each
     # target has its own list of databases), and redirects back.
+    # POST /switch_locale
+    # Persists the chosen language in session; #within_selected_locale applies it
+    # to this and every later request.
+    def switch_locale
+      requested = params[:locale].to_s
+
+      if requested.empty?
+        session.delete(:pg_reports_locale)
+      elsif dashboard_locales.any? { |locale| locale.to_s == requested }
+        session[:pg_reports_locale] = requested
+      end
+
+      redirect_back fallback_location: root_path
+    end
+
     def switch_target
       requested = params[:target].to_s
 
@@ -137,11 +186,8 @@ module PgReports
 
       # Load filter parameters from YAML
       @report_filters = load_report_filters(@category, @report_key)
-
-      @report = execute_report(@category, @report_key)
     rescue => e
       @error = report_error_message(e)
-      @report = nil
     end
 
     def run
@@ -270,11 +316,9 @@ module PgReports
         return
       end
 
-      # Substitute parameters if provided
-      final_query = substitute_params(query, query_params)
+      binds = query_binds(query, query_params)
 
-      # Check for remaining unsubstituted parameters
-      if final_query.match?(/\$\d+/)
+      if binds.nil?
         render json: {
           success: false,
           error: I18n.t("pg_reports.ui.errors.missing_parameter_values")
@@ -283,9 +327,9 @@ module PgReports
       end
 
       explain_output = nil
-      with_statement_timeout do
-        result = ActiveRecord::Base.connection.execute("EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) #{final_query}")
-        explain_output = result.map { |r| r["QUERY PLAN"] }.join("\n")
+      in_read_only_transaction do
+        rows = select_rows("EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) #{cast_typed_placeholders(query)}", binds)
+        explain_output = rows.map { |r| r["QUERY PLAN"] }.join("\n")
       end
 
       # Analyze the EXPLAIN output
@@ -300,7 +344,7 @@ module PgReports
         problems: analysis[:problems],
         summary: analysis[:summary]
       }
-    rescue ActiveRecord::QueryCanceled
+    rescue ActiveRecord::QueryCanceled, PG::QueryCanceled
       render json: {success: false, error: query_timed_out_message}, status: :unprocessable_entity
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
@@ -337,11 +381,9 @@ module PgReports
         return
       end
 
-      # Substitute parameters if provided
-      final_query = substitute_params(query, query_params)
+      binds = query_binds(query, query_params)
 
-      # Check for remaining unsubstituted parameters
-      if final_query.match?(/\$\d+/)
+      if binds.nil?
         render json: {
           success: false,
           error: I18n.t("pg_reports.ui.errors.missing_parameter_values")
@@ -349,42 +391,8 @@ module PgReports
         return
       end
 
-      # Execute with LIMIT to prevent huge result sets
-      limited_query = add_limit_if_missing(final_query, 100)
-
-      rows = columns = nil
-      total_count = 0
-      truncated = false
-      execution_time = nil
-
-      with_statement_timeout do
-        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = ActiveRecord::Base.connection.execute(limited_query)
-        end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        execution_time = ((end_time - start_time) * 1000).round(2)
-
-        rows = result.to_a
-        columns = rows.first&.keys || []
-        total_count = rows.size
-
-        # Check if we need to get total count
-        if rows.size >= 100
-          count_result = ActiveRecord::Base.connection.execute("SELECT COUNT(*) FROM (#{final_query}) AS count_query")
-          total_count = count_result.first["count"].to_i
-          truncated = total_count > 100
-        end
-      end
-
-      render json: {
-        success: true,
-        columns: columns,
-        rows: rows,
-        count: rows.size,
-        total_count: total_count,
-        truncated: truncated,
-        execution_time: execution_time
-      }
-    rescue ActiveRecord::QueryCanceled
+      render json: run_limited_select(cast_typed_placeholders(query), binds)
+    rescue ActiveRecord::QueryCanceled, PG::QueryCanceled
       render json: {success: false, error: query_timed_out_message}, status: :unprocessable_entity
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
@@ -419,78 +427,41 @@ module PgReports
         return
       end
 
-      limited_query = add_limit_if_missing(raw_query, 100)
-
-      rows = columns = nil
-      total_count = 0
-      truncated = false
-      execution_time = nil
-
-      with_statement_timeout do
-        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = ActiveRecord::Base.connection.execute(limited_query)
-        end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        execution_time = ((end_time - start_time) * 1000).round(2)
-
-        rows = result.to_a
-        columns = rows.first&.keys || []
-        total_count = rows.size
-
-        if rows.size >= 100
-          count_result = ActiveRecord::Base.connection.execute("SELECT COUNT(*) FROM (#{raw_query}) AS count_query")
-          total_count = count_result.first["count"].to_i
-          truncated = total_count > 100
-        end
-      end
-
-      render json: {
-        success: true,
-        columns: columns,
-        rows: rows,
-        count: rows.size,
-        total_count: total_count,
-        truncated: truncated,
-        execution_time: execution_time
-      }
-    rescue ActiveRecord::QueryCanceled
+      render json: run_limited_select(raw_query)
+    rescue ActiveRecord::QueryCanceled, PG::QueryCanceled
       render json: {success: false, error: query_timed_out_message}, status: :unprocessable_entity
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
     end
 
-    def create_migration
-      unless PgReports.config.allow_migration_creation
-        render json: {
-          success: false,
-          error: I18n.t("pg_reports.ui.errors.migration_dev_only")
-        }, status: :forbidden
-        return
-      end
-
-      file_name = params[:file_name]
-      code = params[:code]
+    # POST /migration_preview
+    def migration_preview
+      migration = drop_index_migration or return
 
-      if file_name.blank? || code.blank?
-        render json: {success: false, error: I18n.t("pg_reports.ui.errors.filename_code_required")}, status: :unprocessable_entity
-        return
-      end
+      render json: {success: true, code: migration.code, file_name: migration.file_name(migration_timestamp)}
+    rescue => e
+      render json: {success: false, error: e.message}, status: :unprocessable_entity
+    end
 
-      # Sanitize file name
-      safe_file_name = file_name.gsub(/[^a-z0-9_.]/, "")
-      unless safe_file_name.match?(/\A\d{14}_\w+\.rb\z/)
-        render json: {success: false, error: I18n.t("pg_reports.ui.errors.invalid_filename_format")}, status: :unprocessable_entity
-        return
-      end
+    # POST /create_migration
+    # Takes the index to drop, never code: the file is built here from what the
+    # database reports, because `rails db:migrate` will execute it.
+    def create_migration
+      migration = drop_index_migration or return
 
-      # Find migrations directory
       migrations_path = Rails.root.join("db", "migrate")
       unless migrations_path.exist?
         render json: {success: false, error: I18n.t("pg_reports.ui.errors.migrations_dir_not_found")}, status: :unprocessable_entity
         return
       end
 
-      file_path = migrations_path.join(safe_file_name)
-      File.write(file_path, code)
+      if migrations_path.glob("*_#{migration.name}.rb").any?
+        render json: {success: false, error: I18n.t("pg_reports.ui.errors.migration_exists")}, status: :unprocessable_entity
+        return
+      end
+
+      file_path = migrations_path.join(migration.file_name(migration_timestamp))
+      File.write(file_path, migration.code, mode: "wx")
 
       render json: {success: true, file_path: file_path.to_s, message: I18n.t("pg_reports.ui.success.migration_created")}
     rescue => e
@@ -498,11 +469,7 @@ module PgReports
     end
 
     def start_query_monitoring
-      monitor = PgReports::QueryMonitor.instance
-      Rails.logger.info("PgReports: start_query_monitoring called. Instance: #{monitor.object_id}")
-
-      result = monitor.start
-      Rails.logger.info("PgReports: start result: #{result.inspect}")
+      result = PgReports::QueryMonitor.instance.start(source: params[:source])
 
       if result[:success]
         render json: result
@@ -510,7 +477,6 @@ module PgReports
         render json: result, status: :unprocessable_entity
       end
     rescue => e
-      Rails.logger.error("PgReports: start_query_monitoring error: #{e.message}\n#{e.backtrace.first(5).join("\n")}")
       render json: {success: false, error: e.message}, status: :unprocessable_entity
     end
 
@@ -529,39 +495,29 @@ module PgReports
     end
 
     def query_monitor_status
-      monitor = PgReports::QueryMonitor.instance
-      status = monitor.status
-
-      render json: {
-        success: true,
-        enabled: status[:enabled],
-        session_id: status[:session_id],
-        query_count: status[:query_count],
-        history_available: status[:history_available]
-      }
+      render json: PgReports::QueryMonitor.instance.status.merge(success: true)
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
     end
 
+    # A session that has ended is an ordinary state here, not an error: it can be
+    # stopped from another tab or run out its time, and the viewer keeps the rows.
     def query_monitor_feed
       monitor = PgReports::QueryMonitor.instance
 
-      unless monitor.enabled
-        Rails.logger.warn("PgReports: query_monitor_feed called but monitoring not active. Instance: #{monitor.object_id}, enabled: #{monitor.enabled}, session_id: #{monitor.session_id}")
-        render json: {success: false, message: "Monitoring not active"}
-        return
-      end
-
-      limit = params[:limit]&.to_i || 50
-      session_id = params[:session_id]
-
-      queries = monitor.queries(limit: limit, session_id: session_id)
+      since = params[:since].to_i
+      queries = monitor.queries(
+        limit: params[:limit]&.to_i || 50,
+        session_id: params[:session_id],
+        since: since
+      )
 
-      render json: {
+      render json: monitor.status.merge(
         success: true,
         queries: queries,
+        last_seq: queries.last ? queries.last[:seq] : since,
         timestamp: Time.current.to_i
-      }
+      )
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
     end
@@ -604,7 +560,7 @@ module PgReports
           type: "text/csv; charset=utf-8",
           disposition: "attachment"
       when "json"
-        send_data queries.to_json,
+        send_data JSON.generate(queries),
           filename: "#{filename}.json",
           type: "application/json; charset=utf-8",
           disposition: "attachment"
@@ -622,13 +578,48 @@ module PgReports
     private
 
     def authenticate_dashboard!
-      instance_exec(&PgReports.config.dashboard_auth)
+      auth = PgReports.config.dashboard_auth
+      return if auth == AccessPolicy::HOST_MANAGED
+      return instance_exec(&auth) if auth.present?
+      return if AccessPolicy.open_access_allowed?(request)
+
+      render plain: AccessPolicy::DASHBOARD_DENIED, status: :forbidden
     end
 
     def set_categories
       @categories = Dashboard::ReportsRegistry.all
     end
 
+    # I18n.locale is global to the process, so assigning it outright would leak
+    # the dashboard's language into the host application's own rendering (and
+    # into whatever request runs next on this thread). with_locale restores the
+    # previous value once the action and its view are done.
+    def within_selected_locale(&block)
+      I18n.with_locale(selected_locale, &block)
+    end
+
+    def selected_locale
+      @selected_locale ||= begin
+        stored = session[:pg_reports_locale].to_s
+        match = dashboard_locales.find { |locale| locale.to_s == stored }
+        match || I18n.locale
+      end
+    end
+
+    # Only locales that actually carry pg_reports translations. A host app can
+    # have dozens of its own locales while translating none of this dashboard,
+    # and offering those would just switch the UI to fallback English. Picked by
+    # probing one key rather than by listing the shipped files, so a host app
+    # that supplies its own pg_reports translations is offered too.
+    def dashboard_locales
+      @dashboard_locales ||= begin
+        translated = I18n.available_locales.select do |locale|
+          I18n.exists?("pg_reports.ui.branding.title", locale)
+        end
+        translated.presence || [I18n.default_locale]
+      end
+    end
+
     # Resolves which target/database every action should run against, based on:
     # 1. session[:pg_reports_target]   (set by #switch_target)
     # 2. session[:pg_reports_database] (set by #switch_database)
@@ -659,7 +650,10 @@ module PgReports
 
       begin
         registry.with_context(target: @selected_target) do
-          @available_databases = registry.fetch(@selected_target).list_databases(current: @target_default_database)
+          @available_databases = registry.fetch(@selected_target).list_databases(
+            current: @target_default_database,
+            sizes: DATABASE_SELECTOR_ACTIONS.include?(action_name)
+          )
         end
       rescue => e
         @database_error = PgReports::Connection::ErrorTranslator.translate(e)
@@ -742,7 +736,11 @@ module PgReports
       else raise ArgumentError, "Unknown category: #{category}"
       end
 
-      unless mod.respond_to?(report_key)
+      # The report name comes from the URL and the dispatch below is public_send,
+      # so the registry decides what can run. respond_to? would also admit
+      # reset_statistics!, enable_pg_stat_statements! and Module#freeze, reachable
+      # by a plain GET that CSRF protection does not cover.
+      unless Dashboard::ReportsRegistry.find(category, report_key)
         raise ArgumentError, "Unknown report: #{report_key}"
       end
 
@@ -828,100 +826,140 @@ module PgReports
       end
     end
 
-    # SQL Query Monitor taps ActiveSupport::Notifications in the host
-    # application's process. In standalone mode there is no host app — pg_reports
-    # is the only process running, so there's nothing meaningful to observe.
     # Blocks the API even if a client calls it directly (the UI panel is also
-    # hidden in standalone, see dashboard/index view).
-    def block_query_monitor_in_standalone
-      return unless PgReports.config.standalone
+    # hidden when the monitor is unavailable, see dashboard/index view).
+    def require_query_monitor
+      return if PgReports.config.query_monitor_available?
 
-      render json: {
-        success: false,
-        error: I18n.t("pg_reports.ui.errors.query_monitor_unavailable_standalone")
-      }, status: :forbidden
+      render json: {success: false, error: I18n.t("pg_reports.ui.errors.query_monitor_disabled")}, status: :forbidden
     end
 
-    # Soft per-IP throttle for the dashboard's privileged raw-query and
-    # migration endpoints. This is not a hardened distributed rate limiter —
-    # just a best-effort guard against a single client hammering these
-    # expensive/privileged actions, backed by Rails.cache (works with or
-    # without a shared cache backend across processes). Fails open if the
-    # cache is unavailable, consistent with the rest of the dashboard (see
-    # #resolve_database_selection, #retrieve_query_by_hash).
+    # Per-IP throttle for what is expensive, privileged or leaves the building. See
+    # RateLimiter for what it can and cannot promise.
     def enforce_rate_limit!
       limit = PgReports.config.raw_query_rate_limit
       return if limit.nil?
 
-      window = PgReports.config.raw_query_rate_limit_window_seconds
-      key = "pg_reports:rate_limit:#{request.remote_ip}:#{params[:action]}"
-
-      count = begin
-        current = (Rails.cache.read(key) || 0) + 1
-        Rails.cache.write(key, current, expires_in: window)
-        current
-      rescue => e
-        Rails.logger.warn("PgReports: Rate limit cache unavailable: #{e.message}") if defined?(Rails.logger)
-        return
-      end
-
-      return if count <= limit
+      retry_after = RateLimiter.instance.retry_after(
+        "#{request.remote_ip}:#{params[:action]}",
+        limit: limit,
+        window: PgReports.config.raw_query_rate_limit_window_seconds
+      )
+      return unless retry_after
 
+      response.set_header("Retry-After", retry_after.to_s)
       render json: {
         success: false,
         error: I18n.t("pg_reports.ui.errors.rate_limit_exceeded")
       }, status: :too_many_requests
     end
 
-    def on_primary_default_database?
-      return true if @target_default_database.nil?
+    def require_migration_creation
+      return if PgReports.config.allow_migration_creation
 
-      @selected_target == PgReports.connection_registry.default_name &&
-        @selected_database == @target_default_database
+      render json: {success: false, error: I18n.t("pg_reports.ui.errors.migration_dev_only")}, status: :forbidden
     end
 
-    def substitute_params(query, params_hash)
-      result = query.dup
+    # The migration for the index named in the request, or nil once a response has
+    # been rendered. A migration runs on the application's own database, so one
+    # built from an index elsewhere would drop nothing, or the wrong index.
+    def drop_index_migration
+      unless on_primary_default_database?
+        render json: {success: false, error: I18n.t("pg_reports.ui.errors.migration_primary_only")}, status: :unprocessable_entity
+        return
+      end
 
-      # Sort by param number descending to replace $10 before $1
-      params_hash.keys.map(&:to_i).sort.reverse_each do |num|
-        value = params_hash[num.to_s] || params_hash[num]
-        next if value.nil? || value.to_s.empty?
+      rows = select_rows(INDEX_LOOKUP, [params[:index_name].to_s, params[:schema].to_s])
 
-        # Quote the value appropriately
-        quoted_value = quote_param_value(value)
-        result = result.gsub("$#{num}", quoted_value)
+      # More than one means the same name in two schemas, and no way to tell which
+      unless rows.one?
+        render json: {success: false, error: I18n.t("pg_reports.ui.errors.index_not_found")}, status: :unprocessable_entity
+        return
       end
 
-      result
+      DropIndexMigration.new(rows.first, version: ActiveRecord::Migration.current_version)
     end
 
-    def quote_param_value(value)
-      str = value.to_s
+    def migration_timestamp
+      Time.now.utc.strftime("%Y%m%d%H%M%S")
+    end
 
-      # Check if it looks like NULL
-      if str.downcase == "null"
-        "NULL"
-      # Check if it looks like a boolean
-      elsif str.downcase.in?(["true", "false"])
-        str.downcase
-      else
-        # Quote as string by default - PostgreSQL will handle type casting
-        # This ensures compatibility with both text and numeric columns
-        "'#{str.gsub("'", "''")}'"
+    def on_primary_default_database?
+      return true if @target_default_database.nil?
+
+      @selected_target == PgReports.connection_registry.default_name &&
+        @selected_database == @target_default_database
+    end
+
+    # Values for the query's $n placeholders, in order, or nil if one is missing.
+    # They travel as bind parameters and are never written into the SQL: the text
+    # of a captured query can hold a `$1` anywhere, including inside a string
+    # literal, where a substituted and quoted value would end that literal.
+    def query_binds(query, params_hash)
+      numbers = query.scan(/\$(\d+)/).flatten.map(&:to_i).uniq
+      return [] if numbers.empty?
+      return nil if numbers.max > MAX_BIND_PARAMETERS
+
+      binds = Array.new(numbers.max)
+      numbers.each do |number|
+        value = params_hash[number.to_s].to_s
+        return nil if value.empty?
+
+        binds[number - 1] = (value.downcase == "null") ? nil : value
       end
+      binds
     end
 
-    def add_limit_if_missing(query, limit)
-      # Simple check - if query doesn't end with LIMIT clause, add one
-      normalized = query.strip.gsub(/\s+/, " ").downcase
+    # pg_stat_statements reduces `interval '1 day'` to `interval $1`, which is only
+    # valid for a literal. The cast form means the same and accepts a parameter.
+    def cast_typed_placeholders(query)
+      query.gsub(TYPED_PLACEHOLDER) { "$#{$2}::#{$1}" }
+    end
 
-      if normalized.match?(/\blimit\s+\d+\s*(?:offset\s+\d+\s*)?\z/i)
-        # Already has LIMIT
-        query
-      else
-        "#{query} LIMIT #{limit}"
+    # The extended protocol refuses more than one statement, which is what keeps a
+    # query to the single statement that was validated. connection.execute uses
+    # the simple protocol, where text after a `;` would simply run.
+    def select_rows(sql, binds = [])
+      PgReports.config.connection.raw_connection.exec_params(sql, binds).to_a
+    end
+
+    def run_limited_select(query, binds = [])
+      rows = nil
+      total_count = 0
+      truncated = false
+      execution_time = nil
+
+      in_read_only_transaction do
+        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        rows = select_rows("SELECT * FROM (#{wrapped(query)}) AS pg_reports_limited LIMIT #{MAX_RESULT_ROWS}", binds)
+        end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        execution_time = ((end_time - start_time) * 1000).round(2)
+
+        total_count = rows.size
+
+        if rows.size >= MAX_RESULT_ROWS
+          count = select_rows("SELECT COUNT(*) FROM (#{wrapped(query)}) AS count_query", binds)
+          total_count = count.first["count"].to_i
+          truncated = total_count > MAX_RESULT_ROWS
+        end
       end
+
+      {
+        success: true,
+        columns: rows.first&.keys || [],
+        rows: rows,
+        count: rows.size,
+        total_count: total_count,
+        truncated: truncated,
+        execution_time: execution_time
+      }
+    end
+
+    # On lines of its own, so that a query ending in a -- comment cannot comment out
+    # the closing parenthesis. As a subquery, the row limit holds whatever LIMIT the
+    # query itself asks for, and nothing has to be read out of its text.
+    def wrapped(query)
+      "\n#{query}\n"
     end
 
     # Generate a secure hash for a query and store it in cache
@@ -989,18 +1027,36 @@ module PgReports
           raise SecurityError, "Dangerous keyword detected: #{keyword.upcase}"
         end
       end
+
+      if (function = normalized[ADMIN_FUNCTIONS])
+        raise SecurityError, "Administrative function not allowed: #{function}"
+      end
+
+      # U&"pg\005fls_dir" names a function without ever spelling it
+      if normalized.include?('u&"')
+        raise SecurityError, "Unicode-escaped identifiers are not allowed"
+      end
     end
 
-    # Bounds how long a single raw-query execution (Execute Query / EXPLAIN
-    # ANALYZE / SQL Console) can run, so a runaway query can't hang the
-    # connection indefinitely. SET LOCAL only takes effect inside a
-    # transaction and reverts automatically at its end (commit or rollback) —
-    # safe here since every caller only ever runs SELECTs.
-    def with_statement_timeout
-      ActiveRecord::Base.transaction do
+    # The envelope of every raw query (Execute Query / EXPLAIN ANALYZE / SQL
+    # Console), on the connection for the selected target and database, which is
+    # the one #select_rows uses: settings only bind the query on that connection.
+    #
+    # READ ONLY makes PostgreSQL refuse writes that text checks cannot see, such as
+    # SELECT INTO or a volatile function. SET LOCAL bounds the run time.
+    #
+    # It always ends in ROLLBACK. Nothing here has anything to commit, and
+    # set_config(..., false) from a SELECT survives a COMMIT: the connection goes
+    # back to the pool, possibly the host application's, with that setting on it.
+    def in_read_only_transaction
+      connection = PgReports.config.connection
+
+      connection.transaction do
+        connection.execute("SET TRANSACTION READ ONLY")
         timeout_ms = PgReports.config.raw_query_statement_timeout_ms.to_i
-        ActiveRecord::Base.connection.execute("SET LOCAL statement_timeout = #{timeout_ms}") if timeout_ms.positive?
+        connection.execute("SET LOCAL statement_timeout = #{timeout_ms}") if timeout_ms.positive?
         yield
+        raise ActiveRecord::Rollback
       end
     end
 
@@ -1021,9 +1077,9 @@ module PgReports
           csv << [
             query[:timestamp],
             query[:duration_ms],
-            query[:name],
-            query[:sql],
-            query.dig(:source_location, :file),
+            CsvCell.safe(query[:name]),
+            CsvCell.safe(query[:sql]),
+            CsvCell.safe(query.dig(:source_location, :file)),
             query.dig(:source_location, :line)
           ]
         end