```ini
[SECURITY]
; Ativa ou desativa o bloqueio de comandos
EnableBlocking=1
; Modo: 0=Bloquear, 1=Avisar apenas, 2=Log apenas
BlockMode=0
; Ativar log de tentativas
EnableLogging=1
; Caminho do arquivo de log
LogFile=C:\ProgramData\PostgreSQL\security.log

[BLOCKED_COMMANDS]
; Comandos completamente bloqueados
DELETE=1
TRUNCATE=1
DROP=1
ALTER=1
UPDATE=1
GRANT=1
REVOKE=1
INSERT=1

[WHITELIST]
; Queries permitidas mesmo com comandos bloqueados
; Use hashes MD5 das queries completas
Query1=5d41402abc4b2a76b9719d911017c592
Query2=098f6bcd4621d373cade4e832627b4f6

[EXCEPTIONS]
; Usuários com permissão total
AdminUsers=postgres,admin_sistema
; IPs com permissão total
TrustedIPs=127.0.0.1,192.168.1.100
; Aplicações com permissão total
TrustedApps=pgAdmin.exe,maintenance.exe
```

```wlanguage
// Classe para gerenciar segurança PostgreSQL
CLASS PgSecurityManager
PRIVATE
m_sIniPath is string
m_bEnabled is boolean
m_nBlockMode is int
m_bLogging is boolean
m_sLogFile is string
m_arrBlockedCommands is array of string
m_arrWhitelistHashes is array of string
m_arrAdminUsers is array of string
m_arrTrustedIPs is array of string
m_arrTrustedApps is array of string

PUBLIC
// Constructor
CONSTRUCTOR()
// Buscar o diretório das DLLs do PostgreSQL
m_sIniPath = GetPostgreSQLPath() + "\pgsql_security.ini"
LoadConfiguration()
END

// Obter caminho do PostgreSQL
PROCEDURE PRIVATE GetPostgreSQLPath(): string
sPath is string

// Tentar localizar via registro do Windows
sPath = RegistryQueryValue("HKEY_LOCAL_MACHINE\SOFTWARE\PostgreSQL\Installations\postgresql-14", "Base Directory")
IF sPath = "" THEN
// Tentar caminhos padrão
IF fDirectoryExist("C:\Program Files\PostgreSQL\14") THEN
sPath = "C:\Program Files\PostgreSQL\14\bin"
ELSE IF fDirectoryExist("C:\Program Files\PostgreSQL\13") THEN
sPath = "C:\Program Files\PostgreSQL\13\bin"
ELSE
// Usar diretório da aplicação como fallback
sPath = fExeDir()
END
ELSE
sPath += "\bin"
END

RETURN sPath
END

// Carregar configuração do INI
PROCEDURE PRIVATE LoadConfiguration()
// Verificar se o arquivo existe
IF NOT fFileExist(m_sIniPath) THEN
m_bEnabled = False
RETURN
END

// Carregar configurações gerais
m_bEnabled = (INIRead("SECURITY", "EnableBlocking", "1", m_sIniPath) = "1")
m_nBlockMode = Val(INIRead("SECURITY", "BlockMode", "0", m_sIniPath))
m_bLogging = (INIRead("SECURITY", "EnableLogging", "1", m_sIniPath) = "1")
m_sLogFile = INIRead("SECURITY", "LogFile", fExeDir() + "\pgsql_security.log", m_sIniPath)

// Carregar comandos bloqueados
DeleteAll(m_arrBlockedCommands)
arrCommands is array of string = ["DELETE", "TRUNCATE", "DROP", "ALTER", "UPDATE", "GRANT", "REVOKE", "INSERT"]
FOR EACH sCmd OF arrCommands
IF INIRead("BLOCKED_COMMANDS", sCmd, "0", m_sIniPath) = "1" THEN
Add(m_arrBlockedCommands, sCmd)
END
END

// Carregar whitelist
DeleteAll(m_arrWhitelistHashes)
i is int = 1
sHash is string
LOOP
sHash = INIRead("WHITELIST", "Query" + i, "", m_sIniPath)
IF sHash = "" THEN BREAK
Add(m_arrWhitelistHashes, sHash)
i++
END

// Carregar exceções
LoadExceptions()
END

// Carregar lista de exceções
PROCEDURE PRIVATE LoadExceptions()
sValue is string

// Usuários admin
sValue = INIRead("EXCEPTIONS", "AdminUsers", "", m_sIniPath)
IF sValue <> "" THEN
StringToArray(sValue, m_arrAdminUsers, ",")
END

// IPs confiáveis
sValue = INIRead("EXCEPTIONS", "TrustedIPs", "", m_sIniPath)
IF sValue <> "" THEN
StringToArray(sValue, m_arrTrustedIPs, ",")
END

// Aplicações confiáveis
sValue = INIRead("EXCEPTIONS", "TrustedApps", "", m_sIniPath)
IF sValue <> "" THEN
StringToArray(sValue, m_arrTrustedApps, ",")
END
END

// Verificar se query é permitida
PROCEDURE ValidateQuery(sQuery is string, sUser is string = "", sIP is string = ""): boolean
// Se segurança desabilitada, permitir tudo
IF NOT m_bEnabled THEN RETURN True

// Verificar exceções
IF IsException(sUser, sIP) THEN RETURN True

// Verificar whitelist (hash MD5 da query)
sQueryHash is string = HashString(HA_MD5, Upper(NoSpace(sQuery)))
IF Seek(m_arrWhitelistHashes, sQueryHash) > 0 THEN
RETURN True
END

// Verificar comandos bloqueados
sQueryUpper is string = Upper(sQuery)
FOR EACH sCmd OF m_arrBlockedCommands
IF StringContains(sQueryUpper, sCmd) THEN
// Verificar se é realmente o comando (não parte de string)
IF IsActualCommand(sQueryUpper, sCmd) THEN
HandleBlockedCommand(sQuery, sCmd, sUser, sIP)
RETURN (m_nBlockMode = 1) // Retorna True se modo for "Avisar apenas"
END
END
END

RETURN True
END

// Verificar se é realmente um comando SQL
PROCEDURE PRIVATE IsActualCommand(sQuery is string, sCommand is string): boolean
// Remover comentários SQL
sClean is string = RemoveSQLComments(sQuery)

// Padrões para identificar comandos reais
arrPatterns is array of string
Add(arrPatterns, "^" + sCommand + "\s") // Início da query
Add(arrPatterns, ";\s*" + sCommand + "\s") // Após ponto e vírgula

// Verificar padrões
FOR EACH sPattern OF arrPatterns
IF RegexMatch(sClean, sPattern) THEN
RETURN True
END
END

RETURN False
END

// Remover comentários SQL
PROCEDURE PRIVATE RemoveSQLComments(sQuery is string): string
sResult is string = sQuery

// Remover comentários de linha (--)
sResult = RegexReplace(sResult, "--.*?$", "", RegexMultiline)

// Remover comentários de bloco (/* */)
sResult = RegexReplace(sResult, "/\*.*?\*/", "", RegexDotAll)

RETURN sResult
END

// Verificar exceções
PROCEDURE PRIVATE IsException(sUser is string, sIP is string): boolean
// Verificar usuário admin
IF sUser <> "" AND Seek(m_arrAdminUsers, sUser) > 0 THEN
RETURN True
END

// Verificar IP confiável
IF sIP <> "" AND Seek(m_arrTrustedIPs, sIP) > 0 THEN
RETURN True
END

// Verificar aplicação confiável
sAppName is string = fExtractPath(ExeInfo(exeName), fFileName + fExtension)
IF Seek(m_arrTrustedApps, sAppName) > 0 THEN
RETURN True
END

RETURN False
END

// Tratar comando bloqueado
PROCEDURE PRIVATE HandleBlockedCommand(sQuery is string, sCommand is string, sUser is string, sIP is string)
sMessage is string

SWITCH m_nBlockMode
CASE 0: // Bloquear
sMessage = StringBuild("BLOQUEADO: Comando %1 não permitido", sCommand)
Error(sMessage)

CASE 1: // Avisar
sMessage = StringBuild("AVISO: Comando %1 detectado mas executado", sCommand)
Warning(sMessage)

CASE 2: // Log apenas
sMessage = StringBuild("LOG: Comando %1 executado", sCommand)
END

// Registrar no log
IF m_bLogging THEN
LogCommand(sQuery, sCommand, sUser, sIP, sMessage)
END
END

// Registrar no log
PROCEDURE PRIVATE LogCommand(sQuery is string, sCommand is string, sUser is string, sIP is string, sMessage is string)
sLogEntry is string
sLogEntry = DateToString(Today(), maskDateSystem) + " " + TimeToString(Now(), "HH:MM:SS") + TAB
sLogEntry += sUser + TAB + sIP + TAB + sCommand + TAB
sLogEntry += sMessage + TAB + Left(sQuery, 200) + CR

fSaveText(m_sLogFile, sLogEntry, foAdd)
END

// Recarregar configuração
PROCEDURE ReloadConfiguration()
LoadConfiguration()
END

// Obter status
PROCEDURE GetStatus(): string
IF NOT m_bEnabled THEN RETURN "Segurança desabilitada"

sStatus is string = "Segurança ativa - "
SWITCH m_nBlockMode
CASE 0: sStatus += "Modo: Bloquear"
CASE 1: sStatus += "Modo: Avisar"
CASE 2: sStatus += "Modo: Log apenas"
END

RETURN sStatus
END
END
```

```wlanguage
// Classe wrapper para conexão PostgreSQL com segurança
CLASS SecurePostgreSQLConnection
PRIVATE
m_Connection is Connection
m_Security is PgSecurityManager
m_sCurrentUser is string
m_sClientIP is string

PUBLIC
// Constructor
CONSTRUCTOR(sServer is string, sDatabase is string, sUser is string, sPassword is string)
// Inicializar gerenciador de segurança
m_Security = new PgSecurityManager()

// Configurar conexão
m_Connection..Provider = hAccessNativePostgreSQL
m_Connection..Server = sServer
m_Connection..Database = sDatabase
m_Connection..User = sUser
m_Connection..Password = sPassword

m_sCurrentUser = sUser
m_sClientIP = NetIPAddress()

// Abrir conexão
IF NOT HOpenConnection(m_Connection) THEN
Error("Erro ao conectar: " + HErrorInfo())
END
END

// Executar query com validação
PROCEDURE ExecuteQuery(sQuery is string, sDataSource is string = "QueryResult"): boolean
// Validar query antes de executar
IF NOT m_Security.ValidateQuery(sQuery, m_sCurrentUser, m_sClientIP) THEN
RETURN False
END

// Executar query
RETURN HExecuteSQLQuery(sDataSource, m_Connection, hQueryWithoutCorrection, sQuery)
END

// Executar query parametrizada (mais segura)
PROCEDURE ExecuteParameterizedQuery(sQuery is string, ...): boolean
// Validar query base
IF NOT m_Security.ValidateQuery(sQuery, m_sCurrentUser, m_sClientIP) THEN
RETURN False
END

// Montar query com parâmetros
sFullQuery is string = StringBuild(sQuery, MyParameters)

RETURN HExecuteSQLQuery("QueryResult", m_Connection, hQueryWithoutCorrection, sFullQuery)
END

// Adicionar query à whitelist
PROCEDURE AddToWhitelist(sQuery is string, sDescription is string = "")
sHash is string = HashString(HA_MD5, Upper(NoSpace(sQuery)))

// Encontrar próximo índice disponível
i is int = 1
WHILE INIRead("WHITELIST", "Query" + i, "", m_Security.m_sIniPath) <> ""
i++
END

// Adicionar ao INI
INIWrite("WHITELIST", "Query" + i, sHash, m_Security.m_sIniPath)
IF sDescription <> "" THEN
INIWrite("WHITELIST", "Query" + i + "_Desc", sDescription, m_Security.m_sIniPath)
END

// Recarregar configuração
m_Security.ReloadConfiguration()
END

// Obter status de segurança
PROCEDURE GetSecurityStatus(): string
RETURN m_Security.GetStatus()
END
END
```

```wlanguage
// Inicializar conexão segura
MyDB is SecurePostgreSQLConnection("localhost", "meu_banco", "usuario", "senha")

// Queries permitidas
IF MyDB.ExecuteQuery("SELECT * FROM clientes WHERE ativo = true") THEN
// Processar resultados
WHILE NOT HOut()
Info(QueryResult.nome)
HReadNext()
END
END

// Esta query será bloqueada
IF NOT MyDB.ExecuteQuery("DELETE FROM clientes WHERE id = 1") THEN
// Mensagem de erro já foi exibida
END

// Adicionar uma query específica à whitelist
sQueryEspecial is string = "UPDATE configuracoes SET valor = 'novo' WHERE chave = 'versao'"
MyDB.AddToWhitelist(sQueryEspecial, "Atualização de versão do sistema")

// Verificar status
Info(MyDB.GetSecurityStatus())
```

```wlanguage
// Window para gerenciar configurações de segurança
PROCEDURE WIN_SecurityConfig()
// Carregar configurações atuais
sIniPath is string = fExeDir() + "\pgsql_security.ini"

// Interface para editar configurações
EDT_EnableBlocking = INIRead("SECURITY", "EnableBlocking", "1", sIniPath)
COMBO_BlockMode = Val(INIRead("SECURITY", "BlockMode", "0", sIniPath)) + 1
EDT_LogFile = INIRead("SECURITY", "LogFile", "", sIniPath)

// Carregar comandos bloqueados
TABLE_Commands.DeleteAll()
arrCommands is array of string = ["DELETE", "TRUNCATE", "DROP", "ALTER", "UPDATE", "GRANT", "REVOKE", "INSERT"]
FOR EACH sCmd OF arrCommands
nRow is int = TABLE_Commands.AddLine(sCmd, INIRead("BLOCKED_COMMANDS", sCmd, "0", sIniPath) = "1")
END
END

// Botão Salvar
PROCEDURE BTN_Save_Click()
sIniPath is string = fExeDir() + "\pgsql_security.ini"

// Salvar configurações gerais
INIWrite("SECURITY", "EnableBlocking", EDT_EnableBlocking, sIniPath)
INIWrite("SECURITY", "BlockMode", COMBO_BlockMode - 1, sIniPath)
INIWrite("SECURITY", "LogFile", EDT_LogFile, sIniPath)

// Salvar comandos bloqueados
FOR nRow = 1 TO TABLE_Commands.Count
sCommand is string = TABLE_Commands[nRow].COL_Command
bBlocked is boolean = TABLE_Commands[nRow].COL_Blocked
INIWrite("BLOCKED_COMMANDS", sCommand, bBlocked ? "1" : "0", sIniPath)
END

Info("Configurações salvas com sucesso!")
END
```

```wlanguage
// Procedure para analisar logs de segurança
PROCEDURE AnalyzeSecurityLogs(sLogFile is string): string
sReport is string
mapCommandCount is associative array of int
mapUserViolations is associative array of int

// Ler arquivo de log
sContent is string = fLoadText(sLogFile)
arrLines is array of string
StringToArray(sContent, arrLines, CR)

// Analisar cada linha
FOR EACH sLine OF arrLines
arrFields is array of string
StringToArray(sLine, arrFields, TAB)

IF Count(arrFields) >= 5 THEN
sCommand is string = arrFields[4]
sUser is string = arrFields[2]

// Contar por comando
IF mapCommandCount[sCommand] = 0 THEN
mapCommandCount[sCommand] = 0
END
mapCommandCount[sCommand]++

// Contar por usuário
IF mapUserViolations[sUser] = 0 THEN
mapUserViolations[sUser] = 0
END
mapUserViolations[sUser]++
END
END

// Gerar relatório
sReport = "=== RELATÓRIO DE SEGURANÇA ===" + CR + CR
sReport += "Comandos bloqueados:" + CR
FOR EACH sCmd, nCount OF mapCommandCount
sReport += StringBuild(" %1: %2 tentativas", sCmd, nCount) + CR
END

sReport += CR + "Violações por usuário:" + CR
FOR EACH sUser, nCount OF mapUserViolations
sReport += StringBuild(" %1: %2 tentativas", sUser, nCount) + CR
END

RETURN sReport
END
```

```c
// src/interfaces/libpq/fe-exec.c
// Este arquivo contém as funções principais de execução de queries
PGresult *PQexec(PGconn *conn, const char *query)
PGresult *PQexecParams(PGconn *conn, const char *command, ...)
PGresult *PQexecPrepared(PGconn *conn, const char *stmtName, ...)

// src/interfaces/libpq/libpq-fe.h
// Header principal da libpq - interface cliente

// src/backend/tcop/postgres.c
// Loop principal de processamento de comandos
static void exec_simple_query(const char *query_string)
```

```ini
[GLOBAL]
; Configurações globais
EnableSecurity=1
DefaultMode=0
LogPath=C:\PostgreSQL\logs\security\
; DLL de segurança customizada
SecurityDLL=pgsql_security.dll

[DATABASE:producao]
; Banco de produção - somente leitura
BlockMode=0
AllowedCommands=SELECT
BlockedCommands=DELETE,TRUNCATE,DROP,ALTER,UPDATE,GRANT,REVOKE,INSERT
LogFile=producao_security.log

[DATABASE:desenvolvimento]
; Banco de desenvolvimento - acesso completo
BlockMode=2
AllowedCommands=ALL
LogFile=dev_security.log

[DATABASE:relatorios]
; Banco de relatórios - leitura + views
BlockMode=0
AllowedCommands=SELECT,CREATE VIEW,DROP VIEW
BlockedCommands=DELETE,TRUNCATE,DROP TABLE,ALTER,UPDATE,INSERT
LogFile=relatorios_security.log

[WHITELIST:producao]
; Queries permitidas por hash MD5 para o banco producao
Query1=5d41402abc4b2a76b9719d911017c592
Query1_Desc=Update de status de pedidos pelo sistema

[EXCEPTIONS:producao]
AdminUsers=postgres,dba_master
TrustedIPs=192.168.1.10,192.168.1.11
TrustedApps=maintenance.exe,backup_tool.exe
```

```c
// pgsql_security.h
#ifndef PGSQL_SECURITY_H
#define PGSQL_SECURITY_H

#include <windows.h>
#include <stdbool.h>

// Estrutura de configuração por banco
typedef struct DatabaseConfig {
char dbname[128];
int block_mode; // 0=Block, 1=Warn, 2=Log only
char allowed_commands[1024];
char blocked_commands[1024];
char log_file[256];
struct DatabaseConfig *next;
} DatabaseConfig;

// Estrutura principal de segurança
typedef struct SecurityContext {
bool enabled;
char ini_path[256];
char log_path[256];
DatabaseConfig *db_configs;
CRITICAL_SECTION cs;
} SecurityContext;

// Funções exportadas
__declspec(dllexport) bool InitializeSecurity(const char *ini_path);
__declspec(dllexport) bool ValidateQuery(const char *dbname, const char *query, const char *user, const char *ip);
__declspec(dllexport) void CleanupSecurity(void);
__declspec(dllexport) void ReloadConfiguration(void);

#endif
```

```c
// pgsql_security.c
#include "pgsql_security.h"
#include <stdio.h>
#include <string.h>
#include <time.h>

static SecurityContext g_security = {0};

// Função para carregar configuração do INI
static void LoadINIConfiguration(const char *ini_path) {
char section[256];
char key[256];
char value[1024];

// Carregar configurações globais
GetPrivateProfileString("GLOBAL", "EnableSecurity", "1", value, sizeof(value), ini_path);
g_security.enabled = (atoi(value) == 1);

GetPrivateProfileString("GLOBAL", "LogPath", "C:\\PostgreSQL\\logs\\",
g_security.log_path, sizeof(g_security.log_path), ini_path);

// Limpar configurações antigas
DatabaseConfig *current = g_security.db_configs;
while (current) {
DatabaseConfig *next = current->next;
free(current);
current = next;
}
g_security.db_configs = NULL;

// Carregar seções de banco de dados
char sections[8192];
GetPrivateProfileSectionNames(sections, sizeof(sections), ini_path);

char *section_ptr = sections;
while (*section_ptr) {
if (strncmp(section_ptr, "DATABASE:", 9) == 0) {
// Extrair nome do banco
char *dbname = section_ptr + 9;

// Criar nova configuração
DatabaseConfig *config = (DatabaseConfig*)calloc(1, sizeof(DatabaseConfig));
strcpy(config->dbname, dbname);

// Carregar configurações do banco
sprintf(section, "DATABASE:%s", dbname);

GetPrivateProfileString(section, "BlockMode", "0", value, sizeof(value), ini_path);
config->block_mode = atoi(value);

GetPrivateProfileString(section, "AllowedCommands", "",
config->allowed_commands, sizeof(config->allowed_commands), ini_path);

GetPrivateProfileString(section, "BlockedCommands", "",
config->blocked_commands, sizeof(config->blocked_commands), ini_path);

GetPrivateProfileString(section, "LogFile", "security.log",
config->log_file, sizeof(config->log_file), ini_path);

// Adicionar à lista
config->next = g_security.db_configs;
g_security.db_configs = config;
}

section_ptr += strlen(section_ptr) + 1;
}
}

// Inicializar sistema de segurança
bool InitializeSecurity(const char *ini_path) {
InitializeCriticalSection(&g_security.cs);

if (ini_path) {
strcpy(g_security.ini_path, ini_path);
} else {
// Caminho padrão
GetModuleFileName(NULL, g_security.ini_path, sizeof(g_security.ini_path));
char *last_slash = strrchr(g_security.ini_path, '\\');
if (last_slash) {
strcpy(last_slash + 1, "pgsql_security.ini");
}
}

LoadINIConfiguration(g_security.ini_path);
return g_security.enabled;
}

// Encontrar configuração para um banco específico
static DatabaseConfig* FindDatabaseConfig(const char *dbname) {
DatabaseConfig *current = g_security.db_configs;
while (current) {
if (strcmp(current->dbname, dbname) == 0) {
return current;
}
current = current->next;
}
return NULL;
}

// Verificar se comando está na lista
static bool IsCommandInList(const char *command, const char *command_list) {
if (strcmp(command_list, "ALL") == 0) return true;

char list_copy[1024];
strcpy(list_copy, command_list);

char *token = strtok(list_copy, ",");
while (token) {
// Remover espaços
while (*token == ' ') token++;
char *end = token + strlen(token) - 1;
while (end > token && *end == ' ') *end-- = '\0';

if (strcasecmp(token, command) == 0) {
return true;
}
token = strtok(NULL, ",");
}

return false;
}

// Extrair comando principal da query
static void ExtractCommand(const char *query, char *command, size_t cmd_size) {
// Pular espaços iniciais
while (*query && isspace(*query)) query++;

// Copiar até encontrar espaço ou fim
size_t i = 0;
while (*query && !isspace(*query) && i < cmd_size - 1) {
command[i++] = toupper(*query++);
}
command[i] = '\0';
}

// Registrar no log
static void LogSecurityEvent(const char *dbname, const char *query, const char *user,
const char *ip, const char *action, const char *log_file) {
EnterCriticalSection(&g_security.cs);

char full_path[512];
sprintf(full_path, "%s%s", g_security.log_path, log_file);

FILE *fp = fopen(full_path, "a");
if (fp) {
time_t now = time(NULL);
struct tm *tm_info = localtime(&now);
char timestamp[64];
strftime(timestamp, sizeof(timestamp), "%Y-%m-%d %H:%M:%S", tm_info);

fprintf(fp, "%s|%s|%s|%s|%s|%.200s\n",
timestamp, dbname, user, ip, action, query);
fclose(fp);
}

LeaveCriticalSection(&g_security.cs);
}

// Validar query
bool ValidateQuery(const char *dbname, const char *query, const char *user, const char *ip) {
if (!g_security.enabled) return true;

EnterCriticalSection(&g_security.cs);

// Encontrar configuração do banco
DatabaseConfig *config = FindDatabaseConfig(dbname);
if (!config) {
// Se não há configuração específica, permitir
LeaveCriticalSection(&g_security.cs);
return true;
}

// Extrair comando
char command[64];
ExtractCommand(query, command, sizeof(command));

bool allowed = true;
char action[64] = "ALLOWED";

// Verificar se comando está bloqueado
if (strlen(config->blocked_commands) > 0) {
if (IsCommandInList(command, config->blocked_commands)) {
switch (config->block_mode) {
case 0: // Block
allowed = false;
strcpy(action, "BLOCKED");
break;
case 1: // Warn
strcpy(action, "WARNING");
break;
case 2: // Log only
strcpy(action, "LOGGED");
break;
}
}
}

// Verificar se comando está permitido (override blocked)
if (strlen(config->allowed_commands) > 0) {
if (!IsCommandInList(command, config->allowed_commands)) {
if (config->block_mode == 0) {
allowed = false;
strcpy(action, "BLOCKED");
}
}
}

// Registrar evento
if (!allowed || config->block_mode > 0) {
LogSecurityEvent(dbname, query, user, ip, action, config->log_file);
}

LeaveCriticalSection(&g_security.cs);

return allowed;
}

// Limpar recursos
void CleanupSecurity(void) {
EnterCriticalSection(&g_security.cs);

DatabaseConfig *current = g_security.db_configs;
while (current) {
DatabaseConfig *next = current->next;
free(current);
current = next;
}
g_security.db_configs = NULL;

LeaveCriticalSection(&g_security.cs);
DeleteCriticalSection(&g_security.cs);
}

// Recarregar configuração
void ReloadConfiguration(void) {
EnterCriticalSection(&g_security.cs);
LoadINIConfiguration(g_security.ini_path);
LeaveCriticalSection(&g_security.cs);
}
```

```c
// Adicionar no início do arquivo fe-exec.c
#include "pgsql_security.h"

typedef bool (*ValidateQueryFunc)(const char*, const char*, const char*, const char*);
static ValidateQueryFunc g_validateQuery = NULL;
static HMODULE g_securityDll = NULL;

// Função para carregar DLL de segurança
static void LoadSecurityDLL() {
if (g_securityDll) return;

char dll_path[MAX_PATH];
GetModuleFileName(NULL, dll_path, sizeof(dll_path));
char *last_slash = strrchr(dll_path, '\\');
if (last_slash) {
strcpy(last_slash + 1, "pgsql_security.dll");
}

g_securityDll = LoadLibrary(dll_path);
if (g_securityDll) {
g_validateQuery = (ValidateQueryFunc)GetProcAddress(g_securityDll, "ValidateQuery");

// Inicializar segurança
typedef bool (*InitFunc)(const char*);
InitFunc initSecurity = (InitFunc)GetProcAddress(g_securityDll, "InitializeSecurity");
if (initSecurity) {
initSecurity(NULL); // Usa caminho padrão
}
}
}

// Modificar PQexec para incluir validação
PGresult *
PQexec(PGconn *conn, const char *query)
{
// Carregar DLL na primeira vez
static int dll_loaded = 0;
if (!dll_loaded) {
LoadSecurityDLL();
dll_loaded = 1;
}

// Validar query se DLL está carregada
if (g_validateQuery && conn && conn->dbName) {
char client_ip[64] = "";
if (conn->pghostaddr) {
strcpy(client_ip, conn->pghostaddr);
}

if (!g_validateQuery(conn->dbName, query, conn->pguser, client_ip)) {
// Criar resultado de erro
PGresult *res = PQmakeEmptyPGresult(conn, PGRES_FATAL_ERROR);
if (res) {
res->errMsg = strdup("Query blocked by security policy");
}
return res;
}
}

// Continuar com execução normal
if (!PQexecStart(conn))
return NULL;
if (!PQsendQuery(conn, query))
return NULL;
return PQexecFinish(conn);
}
```

```batch
@echo off
REM build_security_dll.bat

set PGSQL_SRC=C:\postgresql-source
set PGSQL_INSTALL=C:\Program Files\PostgreSQL\14

REM Compilar DLL de segurança
cl /LD /MT /I"%PGSQL_SRC%\src\include" ^
/I"%PGSQL_SRC%\src\interfaces\libpq" ^
pgsql_security.c ^
/link /DEF:pgsql_security.def ^
/OUT:pgsql_security.dll

REM Copiar para diretório do PostgreSQL
copy pgsql_security.dll "%PGSQL_INSTALL%\bin\"
copy pgsql_security.ini "%PGSQL_INSTALL%\bin\"

echo Build concluído!
```

```def
; pgsql_security.def
LIBRARY pgsql_security
EXPORTS
InitializeSecurity
ValidateQuery
CleanupSecurity
ReloadConfiguration
```

```wlanguage
// Classe para gerenciar segurança multi-banco
CLASS PostgreSQLMultiDBSecurity
PRIVATE
m_sIniPath is string
m_mapDatabaseConfigs is associative array of DatabaseSecurityConfig

PUBLIC
// Constructor
CONSTRUCTOR(sIniPath is string = "")
IF sIniPath = "" THEN
m_sIniPath = CompleteDir(fExeDir()) + "pgsql_security.ini"
ELSE
m_sIniPath = sIniPath
END

LoadAllConfigurations()
END

// Carregar todas as configurações
PROCEDURE PRIVATE LoadAllConfigurations()
// Obter todas as seções DATABASE:*
sSections is string = INISectionList(m_sIniPath)
arrSections is array of string
StringToArray(sSections, arrSections, CR)

FOR EACH sSection OF arrSections
IF sSection.StartsWith("DATABASE:") THEN
sDBName is string = sSection[[10 TO]]
LoadDatabaseConfig(sDBName)
END
END
END

// Carregar configuração de um banco específico
PROCEDURE PRIVATE LoadDatabaseConfig(sDBName is string)
config is DatabaseSecurityConfig
config.DatabaseName = sDBName

sSection is string = "DATABASE:" + sDBName
config.BlockMode = Val(INIRead(sSection, "BlockMode", "0", m_sIniPath))
config.AllowedCommands = INIRead(sSection, "AllowedCommands", "", m_sIniPath)
config.BlockedCommands = INIRead(sSection, "BlockedCommands", "", m_sIniPath)
config.LogFile = INIRead(sSection, "LogFile", sDBName + "_security.log", m_sIniPath)

m_mapDatabaseConfigs[sDBName] = config
END

// Adicionar nova configuração de banco
PROCEDURE AddDatabaseConfig(sDBName is string, nMode is int = 0,
sAllowed is string = "SELECT",
sBlocked is string = "DELETE,UPDATE,INSERT,DROP,ALTER,TRUNCATE")
sSection is string = "DATABASE:" + sDBName

INIWrite(sSection, "BlockMode", nMode, m_sIniPath)
INIWrite(sSection, "AllowedCommands", sAllowed, m_sIniPath)
INIWrite(sSection, "BlockedCommands", sBlocked, m_sIniPath)
INIWrite(sSection, "LogFile", sDBName + "_security.log", m_sIniPath)

// Recarregar
LoadDatabaseConfig(sDBName)
END

// Obter configuração de um banco
PROCEDURE GetDatabaseConfig(sDBName is string): DatabaseSecurityConfig
IF m_mapDatabaseConfigs[sDBName]..Empty THEN
RESULT DatabaseSecurityConfig
END
RESULT m_mapDatabaseConfigs[sDBName]
END

// Listar todos os bancos configurados
PROCEDURE ListConfiguredDatabases(): array of string
arrDatabases is array of string
FOR EACH config, sDBName OF m_mapDatabaseConfigs
arrDatabases.Add(sDBName)
END
RESULT arrDatabases
END

// Gerar relatório de configuração
PROCEDURE GenerateConfigReport(): string
sReport is string = "=== CONFIGURAÇÃO DE SEGURANÇA POSTGRESQL ===" + CR + CR

FOR EACH config, sDBName OF m_mapDatabaseConfigs
sReport += "Banco: " + sDBName + CR
sReport += " Modo: "
SWITCH config.BlockMode
CASE 0: sReport += "Bloquear"
CASE 1: sReport += "Avisar"
CASE 2: sReport += "Log apenas"
END
sReport += CR
sReport += " Comandos permitidos: " + config.AllowedCommands + CR
sReport += " Comandos bloqueados: " + config.BlockedCommands + CR
sReport += " Arquivo de log: " + config.LogFile + CR + CR
END

RESULT sReport
END
END

// Estrutura de configuração
STRUCTURE DatabaseSecurityConfig
DatabaseName is string
BlockMode is int
AllowedCommands is string
BlockedCommands is string
LogFile is string
END
```

```wlanguage
// Window de configuração multi-banco
PROCEDURE WIN_MultiDBSecurity()
// Carregar gerenciador
gclSecurityManager is PostgreSQLMultiDBSecurity()

// Preencher tabela de bancos
TABLE_Databases.DeleteAll()
arrDatabases is array of string = gclSecurityManager.ListConfiguredDatabases()

FOR EACH sDB OF arrDatabases
config is DatabaseSecurityConfig = gclSecurityManager.GetDatabaseConfig(sDB)
TABLE_Databases.AddLine(sDB, config.BlockMode, config.AllowedCommands)
END
END

// Adicionar novo banco
PROCEDURE BTN_AddDatabase_Click()
sDBName is string = Input("Nome do banco de dados:")
IF sDBName = "" THEN RETURN

// Configuração padrão para novo banco
gclSecurityManager.AddDatabaseConfig(sDBName)

// Atualizar interface
WIN_MultiDBSecurity()
END

// Editar configuração selecionada
PROCEDURE BTN_EditDatabase_Click()
IF TABLE_Databases..Empty THEN RETURN

sDBName is string = TABLE_Databases.COL_Database
config is DatabaseSecurityConfig = gclSecurityManager.GetDatabaseConfig(sDBName)

// Abrir janela de edição
Open(WIN_EditDBConfig, config)

// Atualizar após edição
WIN_MultiDBSecurity()
END
```