package postgres

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"time"

	"github.com/jackc/pgerrcode"
	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgconn"

	"telesrv/internal/domain"
	"telesrv/internal/store/postgres/sqlcgen"
)

type TelegramLoginStore struct {
	db sqlcgen.DBTX
}

func NewTelegramLoginStore(db sqlcgen.DBTX) *TelegramLoginStore {
	return &TelegramLoginStore{db: db}
}

type telegramLoginRowScanner interface {
	Scan(dest ...any) error
}

const telegramLoginClientColumns = `bot_user_id, client_id, client_secret_hash, secret_version, signing_algorithm, enabled, created_at, updated_at`

func scanTelegramLoginClient(row telegramLoginRowScanner) (domain.TelegramLoginClient, error) {
	var client domain.TelegramLoginClient
	var algorithm string
	if err := row.Scan(&client.BotUserID, &client.ClientID, &client.SecretHash, &client.SecretVersion, &algorithm, &client.Enabled, &client.CreatedAt, &client.UpdatedAt); err != nil {
		return domain.TelegramLoginClient{}, err
	}
	client.SigningAlgorithm = domain.TelegramLoginSigningAlgorithm(algorithm)
	return client, nil
}

func (s *TelegramLoginStore) CreateTelegramLoginClient(ctx context.Context, client domain.TelegramLoginClient) (domain.TelegramLoginClient, error) {
	if err := client.Validate(); err != nil {
		return domain.TelegramLoginClient{}, err
	}
	createdAt := client.CreatedAt
	if createdAt.IsZero() {
		createdAt = time.Now().UTC()
	}
	updatedAt := client.UpdatedAt
	if updatedAt.IsZero() {
		updatedAt = createdAt
	}
	client, err := scanTelegramLoginClient(s.db.QueryRow(ctx, `
INSERT INTO bot_login_clients (
  bot_user_id, client_id, client_secret_hash, secret_version, signing_algorithm,
  enabled, created_at, updated_at
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)
RETURNING `+telegramLoginClientColumns,
		client.BotUserID, client.ClientID, client.SecretHash, client.SecretVersion,
		string(client.SigningAlgorithm), client.Enabled, createdAt, updatedAt))
	if err != nil {
		return domain.TelegramLoginClient{}, mapTelegramLoginWriteError("create telegram login client", err)
	}
	return client, nil
}

func (s *TelegramLoginStore) UpsertTelegramLoginClient(ctx context.Context, client domain.TelegramLoginClient) (domain.TelegramLoginClient, error) {
	if err := client.Validate(); err != nil {
		return domain.TelegramLoginClient{}, err
	}
	createdAt := client.CreatedAt
	if createdAt.IsZero() {
		createdAt = time.Now().UTC()
	}
	updatedAt := client.UpdatedAt
	if updatedAt.IsZero() {
		updatedAt = createdAt
	}
	row := s.db.QueryRow(ctx, `
INSERT INTO bot_login_clients (
  bot_user_id, client_id, client_secret_hash, secret_version, signing_algorithm,
  enabled, created_at, updated_at
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)
ON CONFLICT (bot_user_id) DO UPDATE SET
  client_id = EXCLUDED.client_id,
  client_secret_hash = EXCLUDED.client_secret_hash,
  secret_version = EXCLUDED.secret_version,
  signing_algorithm = EXCLUDED.signing_algorithm,
  enabled = EXCLUDED.enabled,
  updated_at = EXCLUDED.updated_at
RETURNING `+telegramLoginClientColumns,
		client.BotUserID, client.ClientID, client.SecretHash, client.SecretVersion,
		string(client.SigningAlgorithm), client.Enabled, createdAt, updatedAt)
	out, err := scanTelegramLoginClient(row)
	if err != nil {
		return domain.TelegramLoginClient{}, mapTelegramLoginWriteError("upsert telegram login client", err)
	}
	return out, nil
}

func (s *TelegramLoginStore) GetTelegramLoginClient(ctx context.Context, clientID string) (domain.TelegramLoginClient, bool, error) {
	client, err := scanTelegramLoginClient(s.db.QueryRow(ctx, `SELECT `+telegramLoginClientColumns+` FROM bot_login_clients WHERE client_id = $1`, clientID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginClient{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginClient{}, false, fmt.Errorf("get telegram login client: %w", err)
	}
	return client, true, nil
}

func (s *TelegramLoginStore) GetTelegramLoginClientByBot(ctx context.Context, botUserID int64) (domain.TelegramLoginClient, bool, error) {
	client, err := scanTelegramLoginClient(s.db.QueryRow(ctx, `SELECT `+telegramLoginClientColumns+` FROM bot_login_clients WHERE bot_user_id = $1`, botUserID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginClient{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginClient{}, false, fmt.Errorf("get telegram login client by bot: %w", err)
	}
	return client, true, nil
}

func (s *TelegramLoginStore) RotateTelegramLoginClientSecret(ctx context.Context, botUserID, expectedVersion int64, secretHash []byte, now time.Time) (domain.TelegramLoginClient, error) {
	if botUserID <= 0 || expectedVersion <= 0 || len(secretHash) != 32 {
		return domain.TelegramLoginClient{}, domain.ErrTelegramLoginClientInvalid
	}
	client, err := scanTelegramLoginClient(s.db.QueryRow(ctx, `
UPDATE bot_login_clients
SET client_secret_hash = $3, secret_version = secret_version + 1, updated_at = $4
WHERE bot_user_id = $1 AND secret_version = $2
RETURNING `+telegramLoginClientColumns, botUserID, expectedVersion, secretHash, now))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginClient{}, domain.ErrTelegramLoginRequestConflict
	}
	if err != nil {
		return domain.TelegramLoginClient{}, fmt.Errorf("rotate telegram login client secret: %w", err)
	}
	return client, nil
}

func (s *TelegramLoginStore) SetTelegramLoginClientSigningAlgorithm(ctx context.Context, botUserID int64, algorithm domain.TelegramLoginSigningAlgorithm, now time.Time) (domain.TelegramLoginClient, error) {
	if botUserID <= 0 || !algorithm.Valid() {
		return domain.TelegramLoginClient{}, domain.ErrTelegramLoginClientInvalid
	}
	client, err := scanTelegramLoginClient(s.db.QueryRow(ctx, `
UPDATE bot_login_clients SET signing_algorithm = $2, updated_at = $3
WHERE bot_user_id = $1
RETURNING `+telegramLoginClientColumns, botUserID, string(algorithm), now))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginClient{}, domain.ErrTelegramLoginClientInvalid
	}
	if err != nil {
		return domain.TelegramLoginClient{}, fmt.Errorf("set telegram login client signing algorithm: %w", err)
	}
	return client, nil
}

func (s *TelegramLoginStore) SetTelegramLoginClientEnabled(ctx context.Context, botUserID int64, enabled bool, now time.Time) error {
	tag, err := s.db.Exec(ctx, `UPDATE bot_login_clients SET enabled = $2, updated_at = $3 WHERE bot_user_id = $1`, botUserID, enabled, now)
	if err != nil {
		return fmt.Errorf("set telegram login client enabled: %w", err)
	}
	if tag.RowsAffected() == 0 {
		return domain.ErrTelegramLoginClientInvalid
	}
	return nil
}

func scanTelegramLoginAllowedURL(row telegramLoginRowScanner) (domain.TelegramLoginAllowedURL, error) {
	var allowed domain.TelegramLoginAllowedURL
	var kind string
	if err := row.Scan(&allowed.ID, &allowed.BotUserID, &kind, &allowed.NormalizedURL, &allowed.CreatedAt); err != nil {
		return domain.TelegramLoginAllowedURL{}, err
	}
	allowed.Kind = domain.TelegramLoginAllowedURLKind(kind)
	return allowed, nil
}

func (s *TelegramLoginStore) AddTelegramLoginAllowedURL(ctx context.Context, allowed domain.TelegramLoginAllowedURL) (domain.TelegramLoginAllowedURL, error) {
	if allowed.BotUserID <= 0 || allowed.NormalizedURL == "" || (allowed.Kind != domain.TelegramLoginAllowedWebOrigin && allowed.Kind != domain.TelegramLoginAllowedRedirectURI) {
		return domain.TelegramLoginAllowedURL{}, domain.ErrTelegramLoginURLInvalid
	}
	createdAt := allowed.CreatedAt
	if createdAt.IsZero() {
		createdAt = time.Now().UTC()
	}
	row := s.db.QueryRow(ctx, `
INSERT INTO bot_login_allowed_urls (bot_user_id, kind, normalized_url, created_at)
VALUES ($1,$2,$3,$4)
ON CONFLICT (bot_user_id, kind, normalized_url) DO UPDATE
SET normalized_url = EXCLUDED.normalized_url
RETURNING id, bot_user_id, kind, normalized_url, created_at`,
		allowed.BotUserID, string(allowed.Kind), allowed.NormalizedURL, createdAt)
	out, err := scanTelegramLoginAllowedURL(row)
	if err != nil {
		return domain.TelegramLoginAllowedURL{}, mapTelegramLoginWriteError("add telegram login allowed url", err)
	}
	return out, nil
}

func (s *TelegramLoginStore) DeleteTelegramLoginAllowedURL(ctx context.Context, botUserID int64, kind domain.TelegramLoginAllowedURLKind, normalizedURL string) (bool, error) {
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return false, fmt.Errorf("delete telegram login allowed url: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return false, fmt.Errorf("delete telegram login allowed url: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	// Approval and code consumption lock this same client row before their
	// final allow-list recheck. Configuration removal therefore serializes
	// with those transitions across every server instance.
	var exists bool
	if err := tx.QueryRow(ctx, `SELECT true FROM bot_login_clients WHERE bot_user_id = $1 FOR UPDATE`, botUserID).Scan(&exists); err != nil {
		if errors.Is(err, pgx.ErrNoRows) {
			return false, domain.ErrTelegramLoginClientInvalid
		}
		return false, fmt.Errorf("delete telegram login allowed url: lock client: %w", err)
	}
	tag, err := tx.Exec(ctx, `DELETE FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = $2 AND normalized_url = $3`, botUserID, string(kind), normalizedURL)
	if err != nil {
		return false, fmt.Errorf("delete telegram login allowed url: %w", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return false, fmt.Errorf("delete telegram login allowed url: commit: %w", err)
	}
	return tag.RowsAffected() > 0, nil
}

func (s *TelegramLoginStore) ListTelegramLoginAllowedURLs(ctx context.Context, botUserID int64) ([]domain.TelegramLoginAllowedURL, error) {
	rows, err := s.db.Query(ctx, `SELECT id, bot_user_id, kind, normalized_url, created_at FROM bot_login_allowed_urls WHERE bot_user_id = $1 ORDER BY kind, id`, botUserID)
	if err != nil {
		return nil, fmt.Errorf("list telegram login allowed urls: %w", err)
	}
	defer rows.Close()
	out := make([]domain.TelegramLoginAllowedURL, 0)
	for rows.Next() {
		allowed, err := scanTelegramLoginAllowedURL(rows)
		if err != nil {
			return nil, fmt.Errorf("scan telegram login allowed url: %w", err)
		}
		out = append(out, allowed)
	}
	return out, rows.Err()
}

func (s *TelegramLoginStore) IsTelegramLoginURLAllowed(ctx context.Context, botUserID int64, kind domain.TelegramLoginAllowedURLKind, normalizedURL string) (bool, error) {
	var allowed bool
	err := s.db.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = $2 AND normalized_url = $3)`, botUserID, string(kind), normalizedURL).Scan(&allowed)
	if err != nil {
		return false, fmt.Errorf("check telegram login allowed url: %w", err)
	}
	return allowed, nil
}

func scanTelegramLoginNativeApp(row telegramLoginRowScanner) (domain.TelegramLoginNativeApp, error) {
	var app domain.TelegramLoginNativeApp
	var platform string
	if err := row.Scan(&app.ID, &app.BotUserID, &platform, &app.ApplicationID, &app.VerificationID, &app.CallbackURI, &app.VerifiedDisplayName, &app.Enabled, &app.CreatedAt, &app.UpdatedAt); err != nil {
		return domain.TelegramLoginNativeApp{}, err
	}
	app.Platform = domain.TelegramLoginNativePlatform(platform)
	return app, nil
}

const telegramLoginNativeAppColumns = `id, bot_user_id, platform, application_id, verification_id, callback_uri, verified_display_name, enabled, created_at, updated_at`

func (s *TelegramLoginStore) UpsertTelegramLoginNativeApp(ctx context.Context, app domain.TelegramLoginNativeApp) (domain.TelegramLoginNativeApp, error) {
	if err := app.Validate(); err != nil {
		return domain.TelegramLoginNativeApp{}, domain.ErrTelegramLoginClientInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return domain.TelegramLoginNativeApp{}, fmt.Errorf("upsert telegram login native app: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return domain.TelegramLoginNativeApp{}, fmt.Errorf("upsert telegram login native app: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	var exists bool
	if err := tx.QueryRow(ctx, `SELECT true FROM bot_login_clients WHERE bot_user_id = $1 FOR UPDATE`, app.BotUserID).Scan(&exists); err != nil {
		if errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginNativeApp{}, domain.ErrTelegramLoginClientInvalid
		}
		return domain.TelegramLoginNativeApp{}, fmt.Errorf("upsert telegram login native app: lock client: %w", err)
	}
	if app.ID == 0 {
		var current int
		if err := tx.QueryRow(ctx, `SELECT count(*) FROM bot_login_native_apps WHERE bot_user_id = $1`, app.BotUserID).Scan(&current); err != nil {
			return domain.TelegramLoginNativeApp{}, fmt.Errorf("upsert telegram login native app: capacity: %w", err)
		}
		if current >= domain.MaxTelegramLoginNativeApps {
			// A duplicate configuration remains an idempotent update at capacity.
			var duplicate bool
			if err := tx.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bot_login_native_apps WHERE bot_user_id=$1 AND platform=$2 AND application_id=$3 AND verification_id=$4)`, app.BotUserID, string(app.Platform), app.ApplicationID, app.VerificationID).Scan(&duplicate); err != nil {
				return domain.TelegramLoginNativeApp{}, fmt.Errorf("upsert telegram login native app: duplicate check: %w", err)
			}
			if !duplicate {
				return domain.TelegramLoginNativeApp{}, domain.ErrTelegramLoginRequestInvalid
			}
		}
	}
	var row telegramLoginRowScanner
	if app.ID == 0 {
		row = tx.QueryRow(ctx, `
INSERT INTO bot_login_native_apps (
  bot_user_id, platform, application_id, verification_id, callback_uri,
  verified_display_name, enabled, created_at, updated_at
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
ON CONFLICT (bot_user_id, platform, application_id, verification_id) DO UPDATE SET
  callback_uri = EXCLUDED.callback_uri,
  verified_display_name = EXCLUDED.verified_display_name,
  enabled = EXCLUDED.enabled,
  updated_at = EXCLUDED.updated_at
RETURNING `+telegramLoginNativeAppColumns,
			app.BotUserID, string(app.Platform), app.ApplicationID, app.VerificationID,
			app.CallbackURI, app.VerifiedDisplayName, app.Enabled, app.CreatedAt, app.UpdatedAt)
	} else {
		row = tx.QueryRow(ctx, `
UPDATE bot_login_native_apps SET
  platform = $3, application_id = $4, verification_id = $5,
  callback_uri = $6, verified_display_name = $7, enabled = $8, updated_at = $9
WHERE id = $1 AND bot_user_id = $2
RETURNING `+telegramLoginNativeAppColumns,
			app.ID, app.BotUserID, string(app.Platform), app.ApplicationID, app.VerificationID,
			app.CallbackURI, app.VerifiedDisplayName, app.Enabled, app.UpdatedAt)
	}
	out, err := scanTelegramLoginNativeApp(row)
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginNativeApp{}, domain.ErrTelegramLoginClientInvalid
	}
	if err != nil {
		return domain.TelegramLoginNativeApp{}, mapTelegramLoginWriteError("upsert telegram login native app", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return domain.TelegramLoginNativeApp{}, fmt.Errorf("upsert telegram login native app: commit: %w", err)
	}
	return out, nil
}

func (s *TelegramLoginStore) DeleteTelegramLoginNativeApp(ctx context.Context, botUserID, appID int64) (bool, error) {
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return false, fmt.Errorf("delete telegram login native app: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return false, fmt.Errorf("delete telegram login native app: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	var exists bool
	if err := tx.QueryRow(ctx, `SELECT true FROM bot_login_clients WHERE bot_user_id = $1 FOR UPDATE`, botUserID).Scan(&exists); err != nil {
		if errors.Is(err, pgx.ErrNoRows) {
			return false, domain.ErrTelegramLoginClientInvalid
		}
		return false, fmt.Errorf("delete telegram login native app: lock client: %w", err)
	}
	tag, err := tx.Exec(ctx, `DELETE FROM bot_login_native_apps WHERE id = $1 AND bot_user_id = $2`, appID, botUserID)
	if err != nil {
		return false, fmt.Errorf("delete telegram login native app: %w", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return false, fmt.Errorf("delete telegram login native app: commit: %w", err)
	}
	return tag.RowsAffected() > 0, nil
}

func (s *TelegramLoginStore) ListTelegramLoginNativeApps(ctx context.Context, botUserID int64) ([]domain.TelegramLoginNativeApp, error) {
	rows, err := s.db.Query(ctx, `SELECT `+telegramLoginNativeAppColumns+` FROM bot_login_native_apps WHERE bot_user_id = $1 ORDER BY id LIMIT $2`, botUserID, domain.MaxTelegramLoginNativeApps)
	if err != nil {
		return nil, fmt.Errorf("list telegram login native apps: %w", err)
	}
	defer rows.Close()
	out := make([]domain.TelegramLoginNativeApp, 0)
	for rows.Next() {
		app, err := scanTelegramLoginNativeApp(rows)
		if err != nil {
			return nil, fmt.Errorf("scan telegram login native app: %w", err)
		}
		out = append(out, app)
	}
	return out, rows.Err()
}

const telegramLoginRequestColumns = `
id, request_token_hash, browser_token_hash, bot_user_id, client_id,
signing_algorithm, source, response_type, redirect_uri, origin, domain,
requested_scopes, oauth_state, nonce, code_challenge, code_challenge_method,
browser, platform, ip, region, in_app_origin, is_app, verified_app_name,
match_codes, match_code, match_codes_first, user_id_hint,
peer_type, peer_id, message_id, button_id,
status, authorized_user_id, profile_name, given_name, family_name,
preferred_username, picture, phone_number, write_allowed, phone_shared,
created_at, expires_at, approved_at, declined_at`

func telegramLoginScopeStrings(scopes []domain.TelegramLoginScope) []string {
	out := make([]string, len(scopes))
	for i, scope := range scopes {
		out[i] = string(scope)
	}
	return out
}

func telegramLoginScopes(values []string) []domain.TelegramLoginScope {
	out := make([]domain.TelegramLoginScope, len(values))
	for i, value := range values {
		out[i] = domain.TelegramLoginScope(value)
	}
	return out
}

func scanTelegramLoginRequest(row telegramLoginRowScanner) (domain.TelegramLoginRequest, error) {
	var request domain.TelegramLoginRequest
	var algorithm, source, status, peerType string
	var scopes []string
	var authorizedUserID sql.NullInt64
	var approvedAt, declinedAt sql.NullTime
	var messageID, buttonID int32
	if err := row.Scan(
		&request.ID, &request.RequestTokenHash, &request.BrowserTokenHash, &request.BotUserID, &request.ClientID,
		&algorithm, &source, &request.ResponseType, &request.RedirectURI, &request.Origin, &request.Domain,
		&scopes, &request.State, &request.Nonce, &request.CodeChallenge, &request.CodeChallengeMethod,
		&request.Browser, &request.Platform, &request.IP, &request.Region, &request.InAppOrigin, &request.IsApp, &request.VerifiedAppName,
		&request.MatchCodes, &request.MatchCode, &request.MatchCodesFirst, &request.UserIDHint,
		&peerType, &request.PeerID, &messageID, &buttonID,
		&status, &authorizedUserID, &request.ProfileName, &request.GivenName, &request.FamilyName,
		&request.PreferredUsername, &request.Picture, &request.PhoneNumber, &request.WriteAllowed, &request.PhoneShared,
		&request.CreatedAt, &request.ExpiresAt, &approvedAt, &declinedAt,
	); err != nil {
		return domain.TelegramLoginRequest{}, err
	}
	request.SigningAlgorithm = domain.TelegramLoginSigningAlgorithm(algorithm)
	request.Source = domain.TelegramLoginRequestSource(source)
	request.Scopes = telegramLoginScopes(scopes)
	request.PeerType = domain.PeerType(peerType)
	request.MessageID = int(messageID)
	request.ButtonID = int(buttonID)
	request.Status = domain.TelegramLoginRequestState(status)
	if authorizedUserID.Valid {
		request.AuthorizedUserID = authorizedUserID.Int64
	}
	if approvedAt.Valid {
		request.ApprovedAt = approvedAt.Time
	}
	if declinedAt.Valid {
		request.DeclinedAt = declinedAt.Time
	}
	return request, nil
}

func (s *TelegramLoginStore) CreateTelegramLoginRequest(ctx context.Context, request domain.TelegramLoginRequest) (domain.TelegramLoginRequest, error) {
	if err := request.Validate(); err != nil {
		return domain.TelegramLoginRequest{}, err
	}
	row := s.db.QueryRow(ctx, `
INSERT INTO telegram_login_requests (
  request_token_hash, browser_token_hash, bot_user_id, client_id,
  signing_algorithm, source, response_type, redirect_uri, origin, domain,
  requested_scopes, oauth_state, nonce, code_challenge, code_challenge_method,
  browser, platform, ip, region, in_app_origin, is_app, verified_app_name,
  match_codes, match_code, match_codes_first, user_id_hint,
  peer_type, peer_id, message_id, button_id, status, created_at, expires_at
)
SELECT
  $1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,
  $21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33
FROM bot_login_clients c
WHERE c.bot_user_id = $3 AND c.client_id = $4 AND c.enabled
  AND c.signing_algorithm = $5
RETURNING `+telegramLoginRequestColumns,
		request.RequestTokenHash, request.BrowserTokenHash, request.BotUserID, request.ClientID,
		string(request.SigningAlgorithm), string(request.Source), request.ResponseType, request.RedirectURI, request.Origin, request.Domain,
		telegramLoginScopeStrings(request.Scopes), request.State, request.Nonce, request.CodeChallenge, request.CodeChallengeMethod,
		request.Browser, request.Platform, request.IP, request.Region, request.InAppOrigin, request.IsApp, request.VerifiedAppName,
		request.MatchCodes, request.MatchCode, request.MatchCodesFirst, request.UserIDHint,
		string(request.PeerType), request.PeerID, request.MessageID, request.ButtonID, string(request.Status), request.CreatedAt, request.ExpiresAt)
	out, err := scanTelegramLoginRequest(row)
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginRequest{}, domain.ErrTelegramLoginClientDisabled
	}
	if err != nil {
		return domain.TelegramLoginRequest{}, mapTelegramLoginWriteError("create telegram login request", err)
	}
	return out, nil
}

func (s *TelegramLoginStore) GetTelegramLoginRequest(ctx context.Context, requestID int64) (domain.TelegramLoginRequest, bool, error) {
	request, err := scanTelegramLoginRequest(s.db.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE id = $1`, requestID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginRequest{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginRequest{}, false, fmt.Errorf("get telegram login request: %w", err)
	}
	return request, true, nil
}

func (s *TelegramLoginStore) GetTelegramLoginRequestByTokenHash(ctx context.Context, tokenHash []byte) (domain.TelegramLoginRequest, bool, error) {
	request, err := scanTelegramLoginRequest(s.db.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE request_token_hash = $1`, tokenHash))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginRequest{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginRequest{}, false, fmt.Errorf("get telegram login request by token: %w", err)
	}
	return request, true, nil
}

func (s *TelegramLoginStore) GetTelegramLoginRequestByBrowserTokenHash(ctx context.Context, tokenHash []byte) (domain.TelegramLoginRequest, bool, error) {
	request, err := scanTelegramLoginRequest(s.db.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE browser_token_hash = $1`, tokenHash))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginRequest{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginRequest{}, false, fmt.Errorf("get telegram login request by browser token: %w", err)
	}
	return request, true, nil
}

func (s *TelegramLoginStore) ApproveTelegramLoginRequest(ctx context.Context, approval domain.TelegramLoginApproval, webAuthorizationHash int64) (domain.TelegramLoginRequest, domain.TelegramLoginWebAuthorization, error) {
	if approval.RequestID <= 0 || approval.Identity.UserID <= 0 || webAuthorizationHash == 0 || approval.ApprovedAt.IsZero() {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginRequestInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	request, err := scanTelegramLoginRequest(tx.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE id = $1 FOR UPDATE`, approval.RequestID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginRequestInvalid
	}
	if err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: lock: %w", err)
	}
	if request.Status != domain.TelegramLoginRequestPending {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginRequestConflict
	}
	if !approval.ApprovedAt.Before(request.ExpiresAt) {
		if _, err := tx.Exec(ctx, `UPDATE telegram_login_requests SET status = 'expired' WHERE id = $1 AND status = 'pending'`, request.ID); err != nil {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: mark expired: %w", err)
		}
		if err := tx.Commit(ctx); err != nil {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: commit expiry: %w", err)
		}
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginRequestExpired
	}
	var clientEnabled, redirectAllowed, originAllowed bool
	if err := tx.QueryRow(ctx, `SELECT enabled FROM bot_login_clients WHERE bot_user_id = $1 AND client_id = $2 AND signing_algorithm = $3 FOR UPDATE`, request.BotUserID, request.ClientID, string(request.SigningAlgorithm)).Scan(&clientEnabled); err != nil || !clientEnabled {
		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: client: %w", err)
		}
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginClientDisabled
	}
	redirectAllowed = request.ResponseType != "code"
	if request.ResponseType == "code" {
		if err := tx.QueryRow(ctx, `SELECT
  EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'redirect_uri' AND normalized_url = $2)
  OR ($3 = 'native' AND EXISTS(SELECT 1 FROM bot_login_native_apps WHERE bot_user_id = $1 AND callback_uri = $2 AND enabled))`, request.BotUserID, request.RedirectURI, string(request.Source)).Scan(&redirectAllowed); err != nil {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: redirect: %w", err)
		}
		if !redirectAllowed {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginRedirectNotAllowed
		}
	} else if request.ResponseType == "post_message" || request.ResponseType == "legacy_url" {
		if err := tx.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'web_origin' AND normalized_url = $2)`, request.BotUserID, request.Origin).Scan(&originAllowed); err != nil {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: post-message origin: %w", err)
		}
		if !originAllowed {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginOriginNotAllowed
		}
	} else {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginRequestInvalid
	}
	originAllowed = request.InAppOrigin == ""
	if !originAllowed {
		if err := tx.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'web_origin' AND normalized_url = $2)`, request.BotUserID, request.InAppOrigin).Scan(&originAllowed); err != nil {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: origin: %w", err)
		}
	}
	if !originAllowed {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginOriginNotAllowed
	}
	if len(request.MatchCodes) > 0 && approval.MatchCode != request.MatchCode {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginMatchCodeInvalid
	}
	scopes, err := grantedTelegramLoginScopesPG(request, approval)
	if err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, err
	}
	identity, err := approval.Identity.Sanitized(request.Requests(domain.TelegramLoginScopeProfile), approval.PhoneShared)
	if err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, err
	}
	// Serialize the per-user capacity check across requests and server
	// instances. This prevents unbounded account.getWebAuthorizations payloads.
	const telegramLoginAuthorizationLockNamespace int64 = 0x544c000000000000
	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock($1)`, identity.UserID^telegramLoginAuthorizationLockNamespace); err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: authorization capacity lock: %w", err)
	}
	var activeAuthorizations int
	if err := tx.QueryRow(ctx, `SELECT count(*) FROM web_authorizations WHERE user_id = $1 AND revoked_at IS NULL`, identity.UserID).Scan(&activeAuthorizations); err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: authorization capacity: %w", err)
	}
	if activeAuthorizations >= domain.MaxTelegramLoginWebAuthorizations {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginAuthorizationsTooMany
	}
	if approval.WriteAllowed {
		if _, err := tx.Exec(ctx, `
INSERT INTO bot_user_permissions (bot_user_id, user_id, from_request)
VALUES ($1,$2,true)
ON CONFLICT (bot_user_id, user_id) DO UPDATE SET
  from_request = true, updated_at = now()`, request.BotUserID, identity.UserID); err != nil {
			return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: grant bot access: %w", err)
		}
	}
	if _, err := tx.Exec(ctx, `
UPDATE telegram_login_requests SET
  status = 'approved', authorized_user_id = $2, write_allowed = $3,
  phone_shared = $4, approved_at = $5, profile_name = $6, given_name = $7,
  family_name = $8, preferred_username = $9, picture = $10, phone_number = $11
WHERE id = $1`, request.ID, identity.UserID, approval.WriteAllowed, approval.PhoneShared, approval.ApprovedAt,
		identity.Name, identity.GivenName, identity.FamilyName, identity.PreferredUsername, identity.Picture, identity.PhoneNumber); err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: update request: %w", err)
	}
	web := domain.TelegramLoginWebAuthorization{
		Hash: webAuthorizationHash, RequestID: request.ID, UserID: identity.UserID, BotUserID: request.BotUserID,
		Domain: request.Domain, Browser: request.Browser, Platform: request.Platform, IP: request.IP, Region: request.Region,
		Scopes: scopes, PhoneShared: approval.PhoneShared, BotAccessGranted: approval.WriteAllowed,
		CreatedAt: approval.ApprovedAt, LastActiveAt: approval.ApprovedAt,
	}
	if _, err := tx.Exec(ctx, `
INSERT INTO web_authorizations (
  hash, request_id, user_id, bot_user_id, domain, browser, platform, ip, region,
  granted_scopes, phone_shared, bot_access_granted, created_at, last_active_at
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)`,
		web.Hash, web.RequestID, web.UserID, web.BotUserID, web.Domain, web.Browser, web.Platform, web.IP, web.Region,
		telegramLoginScopeStrings(web.Scopes), web.PhoneShared, web.BotAccessGranted, web.CreatedAt, web.LastActiveAt); err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, mapTelegramLoginWriteError("approve telegram login request: insert web authorization", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("approve telegram login request: commit: %w", err)
	}
	request.Status = domain.TelegramLoginRequestApproved
	request.AuthorizedUserID = identity.UserID
	request.ProfileName = identity.Name
	request.GivenName = identity.GivenName
	request.FamilyName = identity.FamilyName
	request.PreferredUsername = identity.PreferredUsername
	request.Picture = identity.Picture
	request.PhoneNumber = identity.PhoneNumber
	request.WriteAllowed = approval.WriteAllowed
	request.PhoneShared = approval.PhoneShared
	request.ApprovedAt = approval.ApprovedAt
	return request, web, nil
}

func grantedTelegramLoginScopesPG(request domain.TelegramLoginRequest, approval domain.TelegramLoginApproval) ([]domain.TelegramLoginScope, error) {
	if approval.WriteAllowed && !request.Requests(domain.TelegramLoginScopeBotAccess) {
		return nil, domain.ErrTelegramLoginScopeInvalid
	}
	if approval.PhoneShared && !request.Requests(domain.TelegramLoginScopePhone) {
		return nil, domain.ErrTelegramLoginScopeInvalid
	}
	out := make([]domain.TelegramLoginScope, 0, len(request.Scopes))
	for _, scope := range request.Scopes {
		if scope == domain.TelegramLoginScopePhone && !approval.PhoneShared {
			continue
		}
		if scope == domain.TelegramLoginScopeBotAccess && !approval.WriteAllowed {
			continue
		}
		out = append(out, scope)
	}
	return out, nil
}

func (s *TelegramLoginStore) DeclineTelegramLoginRequest(ctx context.Context, requestID, userID int64, now time.Time) (domain.TelegramLoginRequest, error) {
	if requestID <= 0 || userID <= 0 || now.IsZero() {
		return domain.TelegramLoginRequest{}, domain.ErrTelegramLoginRequestInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	request, err := scanTelegramLoginRequest(tx.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE id = $1 FOR UPDATE`, requestID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginRequest{}, domain.ErrTelegramLoginRequestInvalid
	}
	if err != nil {
		return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: lock: %w", err)
	}
	if request.Status != domain.TelegramLoginRequestPending {
		return domain.TelegramLoginRequest{}, domain.ErrTelegramLoginRequestConflict
	}
	if !now.Before(request.ExpiresAt) {
		if _, err := tx.Exec(ctx, `UPDATE telegram_login_requests SET status = 'expired' WHERE id = $1`, request.ID); err != nil {
			return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: mark expired: %w", err)
		}
		if err := tx.Commit(ctx); err != nil {
			return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: commit expiry: %w", err)
		}
		return domain.TelegramLoginRequest{}, domain.ErrTelegramLoginRequestExpired
	}
	if _, err := tx.Exec(ctx, `UPDATE telegram_login_requests SET status = 'declined', declined_at = $2 WHERE id = $1`, request.ID, now); err != nil {
		return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: update: %w", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return domain.TelegramLoginRequest{}, fmt.Errorf("decline telegram login request: commit: %w", err)
	}
	request.Status = domain.TelegramLoginRequestDeclined
	request.DeclinedAt = now
	return request, nil
}

const telegramLoginCodeColumns = `id, request_id, code_hash, sealed_code, seal_nonce, seal_key_id, issued_at, expires_at, consumed_at`

func scanTelegramLoginAuthorizationCode(row telegramLoginRowScanner) (domain.TelegramLoginAuthorizationCode, error) {
	var code domain.TelegramLoginAuthorizationCode
	var consumedAt sql.NullTime
	if err := row.Scan(&code.ID, &code.RequestID, &code.CodeHash, &code.SealedCode, &code.SealNonce, &code.SealKeyID, &code.IssuedAt, &code.ExpiresAt, &consumedAt); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, err
	}
	if consumedAt.Valid {
		code.ConsumedAt = consumedAt.Time
	}
	return code, nil
}

func (s *TelegramLoginStore) PutTelegramLoginAuthorizationCode(ctx context.Context, code domain.TelegramLoginAuthorizationCode) (domain.TelegramLoginAuthorizationCode, error) {
	if code.RequestID <= 0 || len(code.CodeHash) != 32 || len(code.SealedCode) < 32 || len(code.SealNonce) < 12 || code.SealKeyID == "" || code.IssuedAt.IsZero() || !code.ExpiresAt.After(code.IssuedAt) {
		return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginCodeInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	request, err := scanTelegramLoginRequest(tx.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE id = $1 FOR UPDATE`, code.RequestID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginRequestInvalid
	} else if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: lock request: %w", err)
	}
	if request.Status != domain.TelegramLoginRequestApproved {
		return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginRequestConflict
	}
	var clientEnabled bool
	if err := tx.QueryRow(ctx, `SELECT enabled FROM bot_login_clients WHERE bot_user_id = $1 AND client_id = $2 AND signing_algorithm = $3 FOR UPDATE`,
		request.BotUserID, request.ClientID, string(request.SigningAlgorithm)).Scan(&clientEnabled); err != nil || !clientEnabled {
		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: client: %w", err)
		}
		return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginClientDisabled
	}
	switch request.ResponseType {
	case "code":
		var allowed bool
		if err := tx.QueryRow(ctx, `SELECT
  EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'redirect_uri' AND normalized_url = $2)
  OR ($3 = 'native' AND EXISTS(SELECT 1 FROM bot_login_native_apps WHERE bot_user_id = $1 AND callback_uri = $2 AND enabled))`,
			request.BotUserID, request.RedirectURI, string(request.Source)).Scan(&allowed); err != nil {
			return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: redirect: %w", err)
		}
		if !allowed {
			return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginRedirectNotAllowed
		}
	case "post_message":
		var allowed bool
		if err := tx.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'web_origin' AND normalized_url = $2)`,
			request.BotUserID, request.Origin).Scan(&allowed); err != nil {
			return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: origin: %w", err)
		}
		if !allowed {
			return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginOriginNotAllowed
		}
	default:
		return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginRequestConflict
	}
	web, err := scanTelegramLoginWebAuthorization(tx.QueryRow(ctx, `SELECT `+telegramLoginWebAuthorizationColumns+` FROM web_authorizations WHERE request_id = $1 FOR UPDATE`, code.RequestID))
	if errors.Is(err, pgx.ErrNoRows) || !web.RevokedAt.IsZero() {
		return domain.TelegramLoginAuthorizationCode{}, domain.ErrTelegramLoginRequestConflict
	}
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: web authorization: %w", err)
	}
	existing, err := scanTelegramLoginAuthorizationCode(tx.QueryRow(ctx, `SELECT `+telegramLoginCodeColumns+` FROM telegram_login_codes WHERE request_id = $1`, code.RequestID))
	if err == nil {
		if err := tx.Commit(ctx); err != nil {
			return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: commit existing: %w", err)
		}
		return existing, nil
	}
	if !errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: read existing: %w", err)
	}
	created, err := scanTelegramLoginAuthorizationCode(tx.QueryRow(ctx, `
INSERT INTO telegram_login_codes (
  request_id, code_hash, sealed_code, seal_nonce, seal_key_id, issued_at, expires_at
) VALUES ($1,$2,$3,$4,$5,$6,$7)
RETURNING `+telegramLoginCodeColumns,
		code.RequestID, code.CodeHash, code.SealedCode, code.SealNonce, code.SealKeyID, code.IssuedAt, code.ExpiresAt))
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, mapTelegramLoginWriteError("put telegram login code", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, fmt.Errorf("put telegram login code: commit: %w", err)
	}
	return created, nil
}

func (s *TelegramLoginStore) GetTelegramLoginAuthorizationCodeByRequest(ctx context.Context, requestID int64) (domain.TelegramLoginAuthorizationCode, bool, error) {
	code, err := scanTelegramLoginAuthorizationCode(s.db.QueryRow(ctx, `SELECT `+telegramLoginCodeColumns+` FROM telegram_login_codes WHERE request_id = $1`, requestID))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginAuthorizationCode{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, false, fmt.Errorf("get telegram login code by request: %w", err)
	}
	return code, true, nil
}

func (s *TelegramLoginStore) GetTelegramLoginAuthorizationCodeByHash(ctx context.Context, codeHash []byte) (domain.TelegramLoginAuthorizationCode, bool, error) {
	code, err := scanTelegramLoginAuthorizationCode(s.db.QueryRow(ctx, `SELECT `+telegramLoginCodeColumns+` FROM telegram_login_codes WHERE code_hash = $1`, codeHash))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginAuthorizationCode{}, false, nil
	}
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, false, fmt.Errorf("get telegram login code by hash: %w", err)
	}
	return code, true, nil
}

const telegramLoginWebAuthorizationColumns = `hash, request_id, user_id, bot_user_id, domain, browser, platform, ip, region, granted_scopes, phone_shared, bot_access_granted, created_at, last_active_at, revoked_at`

func scanTelegramLoginWebAuthorization(row telegramLoginRowScanner) (domain.TelegramLoginWebAuthorization, error) {
	var web domain.TelegramLoginWebAuthorization
	var scopes []string
	var revokedAt sql.NullTime
	if err := row.Scan(&web.Hash, &web.RequestID, &web.UserID, &web.BotUserID, &web.Domain, &web.Browser, &web.Platform, &web.IP, &web.Region, &scopes, &web.PhoneShared, &web.BotAccessGranted, &web.CreatedAt, &web.LastActiveAt, &revokedAt); err != nil {
		return domain.TelegramLoginWebAuthorization{}, err
	}
	web.Scopes = telegramLoginScopes(scopes)
	if revokedAt.Valid {
		web.RevokedAt = revokedAt.Time
	}
	return web, nil
}

func (s *TelegramLoginStore) ConsumeTelegramLoginAuthorizationCode(ctx context.Context, exchange domain.TelegramLoginCodeExchange) (domain.TelegramLoginAuthorizationCode, domain.TelegramLoginRequest, domain.TelegramLoginWebAuthorization, error) {
	if len(exchange.CodeHash) != 32 || exchange.ClientID == "" || exchange.ClientSecretVersion <= 0 || exchange.RedirectURI == "" || exchange.CodeChallenge == "" || exchange.Now.IsZero() {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	code, err := scanTelegramLoginAuthorizationCode(tx.QueryRow(ctx, `SELECT `+telegramLoginCodeColumns+` FROM telegram_login_codes WHERE code_hash = $1 FOR UPDATE`, exchange.CodeHash))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: lock code: %w", err)
	}
	if !code.ConsumedAt.IsZero() {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeConsumed
	}
	if !exchange.Now.Before(code.ExpiresAt) {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	request, err := scanTelegramLoginRequest(tx.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE id = $1 FOR UPDATE`, code.RequestID))
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: lock request: %w", err)
	}
	if request.Status != domain.TelegramLoginRequestApproved || request.ResponseType != "code" || request.ClientID != exchange.ClientID || request.RedirectURI != exchange.RedirectURI || request.CodeChallenge != exchange.CodeChallenge {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	var clientEnabled, redirectAllowed bool
	var secretVersion int64
	if err := tx.QueryRow(ctx, `SELECT enabled, secret_version FROM bot_login_clients WHERE client_id = $1 FOR UPDATE`, exchange.ClientID).Scan(&clientEnabled, &secretVersion); err != nil || !clientEnabled || secretVersion != exchange.ClientSecretVersion {
		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: client: %w", err)
		}
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	if err := tx.QueryRow(ctx, `SELECT
  EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'redirect_uri' AND normalized_url = $2)
  OR ($3 = 'native' AND EXISTS(SELECT 1 FROM bot_login_native_apps WHERE bot_user_id = $1 AND callback_uri = $2 AND enabled))`, request.BotUserID, exchange.RedirectURI, string(request.Source)).Scan(&redirectAllowed); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: redirect: %w", err)
	}
	if !redirectAllowed {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	web, err := scanTelegramLoginWebAuthorization(tx.QueryRow(ctx, `SELECT `+telegramLoginWebAuthorizationColumns+` FROM web_authorizations WHERE request_id = $1 FOR UPDATE`, request.ID))
	if err != nil || !web.RevokedAt.IsZero() {
		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: web authorization: %w", err)
		}
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	if _, err := tx.Exec(ctx, `UPDATE telegram_login_codes SET consumed_at = $2 WHERE id = $1`, code.ID, exchange.Now); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: mark consumed: %w", err)
	}
	if _, err := tx.Exec(ctx, `UPDATE web_authorizations SET last_active_at = $2 WHERE hash = $1`, web.Hash, exchange.Now); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: touch web authorization: %w", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login code: commit: %w", err)
	}
	code.ConsumedAt = exchange.Now
	web.LastActiveAt = exchange.Now
	return code, request, web, nil
}

func (s *TelegramLoginStore) ConsumeTelegramLoginDirectToken(ctx context.Context, tokenHash []byte, origin string, now time.Time) (domain.TelegramLoginAuthorizationCode, domain.TelegramLoginRequest, domain.TelegramLoginWebAuthorization, error) {
	if len(tokenHash) != 32 || origin == "" || now.IsZero() {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	code, err := scanTelegramLoginAuthorizationCode(tx.QueryRow(ctx, `SELECT `+telegramLoginCodeColumns+` FROM telegram_login_codes WHERE code_hash = $1 FOR UPDATE`, tokenHash))
	if errors.Is(err, pgx.ErrNoRows) {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: lock token: %w", err)
	}
	if !code.ConsumedAt.IsZero() {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeConsumed
	}
	if !now.Before(code.ExpiresAt) {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	request, err := scanTelegramLoginRequest(tx.QueryRow(ctx, `SELECT `+telegramLoginRequestColumns+` FROM telegram_login_requests WHERE id = $1 FOR UPDATE`, code.RequestID))
	if err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: lock request: %w", err)
	}
	if request.Status != domain.TelegramLoginRequestApproved || request.Source != domain.TelegramLoginRequestMiniApp ||
		request.ResponseType != "post_message" || request.Origin != origin || request.InAppOrigin != origin {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	var clientEnabled, originAllowed bool
	if err := tx.QueryRow(ctx, `SELECT enabled FROM bot_login_clients WHERE bot_user_id = $1 AND client_id = $2 FOR UPDATE`, request.BotUserID, request.ClientID).Scan(&clientEnabled); err != nil || !clientEnabled {
		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: client: %w", err)
		}
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	if err := tx.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bot_login_allowed_urls WHERE bot_user_id = $1 AND kind = 'web_origin' AND normalized_url = $2)`, request.BotUserID, origin).Scan(&originAllowed); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: origin: %w", err)
	}
	if !originAllowed {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	web, err := scanTelegramLoginWebAuthorization(tx.QueryRow(ctx, `SELECT `+telegramLoginWebAuthorizationColumns+` FROM web_authorizations WHERE request_id = $1 FOR UPDATE`, request.ID))
	if err != nil || !web.RevokedAt.IsZero() {
		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
			return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: web authorization: %w", err)
		}
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, domain.ErrTelegramLoginCodeInvalid
	}
	if _, err := tx.Exec(ctx, `UPDATE telegram_login_codes SET consumed_at = $2 WHERE id = $1`, code.ID, now); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: mark consumed: %w", err)
	}
	if _, err := tx.Exec(ctx, `UPDATE web_authorizations SET last_active_at = $2 WHERE hash = $1`, web.Hash, now); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: touch web authorization: %w", err)
	}
	if err := tx.Commit(ctx); err != nil {
		return domain.TelegramLoginAuthorizationCode{}, domain.TelegramLoginRequest{}, domain.TelegramLoginWebAuthorization{}, fmt.Errorf("consume telegram login direct token: commit: %w", err)
	}
	code.ConsumedAt = now
	web.LastActiveAt = now
	return code, request, web, nil
}

func (s *TelegramLoginStore) ListTelegramLoginWebAuthorizations(ctx context.Context, userID int64) ([]domain.TelegramLoginWebAuthorization, error) {
	rows, err := s.db.Query(ctx, `SELECT `+telegramLoginWebAuthorizationColumns+` FROM web_authorizations WHERE user_id = $1 AND revoked_at IS NULL ORDER BY last_active_at DESC, hash DESC LIMIT $2`, userID, domain.MaxTelegramLoginWebAuthorizations)
	if err != nil {
		return nil, fmt.Errorf("list telegram login web authorizations: %w", err)
	}
	defer rows.Close()
	out := make([]domain.TelegramLoginWebAuthorization, 0)
	for rows.Next() {
		web, err := scanTelegramLoginWebAuthorization(rows)
		if err != nil {
			return nil, fmt.Errorf("scan telegram login web authorization: %w", err)
		}
		out = append(out, web)
	}
	return out, rows.Err()
}

func (s *TelegramLoginStore) RevokeTelegramLoginWebAuthorization(ctx context.Context, userID, hash int64, now time.Time) (bool, error) {
	tag, err := s.db.Exec(ctx, `UPDATE web_authorizations SET revoked_at = $3 WHERE user_id = $1 AND hash = $2 AND revoked_at IS NULL`, userID, hash, now)
	if err != nil {
		return false, fmt.Errorf("revoke telegram login web authorization: %w", err)
	}
	return tag.RowsAffected() > 0, nil
}

func (s *TelegramLoginStore) RevokeAllTelegramLoginWebAuthorizations(ctx context.Context, userID int64, now time.Time) (int64, error) {
	tag, err := s.db.Exec(ctx, `UPDATE web_authorizations SET revoked_at = $2 WHERE user_id = $1 AND revoked_at IS NULL`, userID, now)
	if err != nil {
		return 0, fmt.Errorf("revoke all telegram login web authorizations: %w", err)
	}
	return tag.RowsAffected(), nil
}

func (s *TelegramLoginStore) DeleteExpiredTelegramLoginArtifacts(ctx context.Context, before time.Time, limit int) (int64, error) {
	if limit <= 0 || limit > 1000 {
		return 0, domain.ErrTelegramLoginRequestInvalid
	}
	beginner, ok := s.db.(txBeginner)
	if !ok {
		return 0, fmt.Errorf("delete expired telegram login artifacts: db does not support transactions")
	}
	tx, err := beginner.Begin(ctx)
	if err != nil {
		return 0, fmt.Errorf("delete expired telegram login artifacts: begin: %w", err)
	}
	defer func() { _ = tx.Rollback(ctx) }()
	var deletedCodes int64
	if err := tx.QueryRow(ctx, `
WITH doomed AS (
  SELECT id FROM telegram_login_codes
  WHERE expires_at < $1 OR (consumed_at IS NOT NULL AND consumed_at < $1)
  ORDER BY expires_at, id
  LIMIT $2
  FOR UPDATE SKIP LOCKED
), deleted AS (
  DELETE FROM telegram_login_codes c USING doomed d WHERE c.id = d.id RETURNING c.id
)
SELECT count(*) FROM deleted`, before, limit).Scan(&deletedCodes); err != nil {
		return 0, fmt.Errorf("delete expired telegram login codes: %w", err)
	}
	remaining := int64(limit) - deletedCodes
	var deletedRequests int64
	if remaining > 0 {
		if err := tx.QueryRow(ctx, `
WITH doomed AS (
  SELECT r.id FROM telegram_login_requests r
  WHERE (r.status IN ('pending','declined','expired') AND r.expires_at < $1)
     OR (r.status = 'approved' AND r.approved_at < $1
         AND EXISTS (
           SELECT 1 FROM web_authorizations w
           WHERE w.request_id = r.id AND w.revoked_at < $1
         )
         AND NOT EXISTS (
           SELECT 1 FROM telegram_login_codes c WHERE c.request_id = r.id
         ))
  ORDER BY COALESCE(r.approved_at, r.expires_at), r.id
  LIMIT $2
  FOR UPDATE OF r SKIP LOCKED
), deleted AS (
  DELETE FROM telegram_login_requests r USING doomed d WHERE r.id = d.id RETURNING r.id
)
SELECT count(*) FROM deleted`, before, remaining).Scan(&deletedRequests); err != nil {
			return 0, fmt.Errorf("delete expired telegram login requests: %w", err)
		}
	}
	if err := tx.Commit(ctx); err != nil {
		return 0, fmt.Errorf("delete expired telegram login artifacts: commit: %w", err)
	}
	return deletedCodes + deletedRequests, nil
}

func mapTelegramLoginWriteError(op string, err error) error {
	var pgErr *pgconn.PgError
	if errors.As(err, &pgErr) {
		switch pgErr.Code {
		case pgerrcode.UniqueViolation:
			return fmt.Errorf("%s: %w", op, domain.ErrTelegramLoginRequestConflict)
		case pgerrcode.ForeignKeyViolation, pgerrcode.CheckViolation:
			return fmt.Errorf("%s: %w", op, domain.ErrTelegramLoginRequestInvalid)
		}
	}
	return fmt.Errorf("%s: %w", op, err)
}