use std::collections::HashSet;
use std::sync::Arc;
use tauri::State;

pub use dbx_core::agent_connection::{
    agent_connect_params, mongo_legacy_error_with_auth_hint, mongo_uses_legacy_driver, oracle_alternate_connect_config,
    oracle_error_with_driver_hint, should_retry_mongo_with_legacy_driver,
};
pub use dbx_core::connection::{
    agent_connect_timeout, connect_bare_metadata_pool, connect_mysql_metadata_pool, connection_url_for_endpoint,
    gaussdb_m_jdbc_config_for_endpoint, gaussdb_uses_m_jdbc_driver, metadata_connection_config,
    prestosql_jdbc_config_for_endpoint, probe_connection_endpoint, redacted_connection_url_for_endpoint, AppState,
    MysqlMode, PoolKind,
};
use dbx_core::database_capabilities;
use dbx_core::db;
use dbx_core::db::agent_driver::AgentMethod;
use dbx_core::models::connection::{
    database_info_from_protocol_value, rewrite_jdbc_url_host, ConnectionConfig, ConnectionTestResult,
    DatabaseConnectionInfo, DatabaseType,
};
pub use dbx_core::path_utils::expand_tilde;

const MONGO_LEGACY_DRIVER_PROFILE: &str = "mongodb-legacy";
const MONGO_LEGACY_DRIVER_LABEL: &str = "MongoDB (Legacy)";

fn gaussdb_m_jdbc_command_config(config: &ConnectionConfig, host: &str, port: u16) -> Option<ConnectionConfig> {
    gaussdb_uses_m_jdbc_driver(config).then(|| gaussdb_m_jdbc_config_for_endpoint(config, host, port))
}

fn mongo_legacy_connect_params(config: &ConnectionConfig, host: &str, port: u16) -> serde_json::Value {
    serde_json::json!({
        "connection": agent_connect_params(config, host, port, config.effective_database().unwrap_or(""))
    })
}

fn mark_mongo_legacy_driver(config: &mut ConnectionConfig) -> bool {
    if config.db_type != DatabaseType::MongoDb {
        return false;
    }
    let changed = config.driver_profile.as_deref() != Some(MONGO_LEGACY_DRIVER_PROFILE)
        || config.driver_label.as_deref() != Some(MONGO_LEGACY_DRIVER_LABEL);
    config.driver_profile = Some(MONGO_LEGACY_DRIVER_PROFILE.to_string());
    config.driver_label = Some(MONGO_LEGACY_DRIVER_LABEL.to_string());
    changed
}

async fn persist_mongo_legacy_driver_profile(state: &AppState, config: &ConnectionConfig) -> Result<(), String> {
    if config.one_time {
        return Ok(());
    }

    let mut configs: Vec<ConnectionConfig> =
        state.storage.load_connections().await?.into_iter().map(|config| config.canonicalized()).collect();
    let Some(saved_config) = configs.iter_mut().find(|saved_config| saved_config.id == config.id) else {
        return Ok(());
    };
    if !mark_mongo_legacy_driver(saved_config) {
        return Ok(());
    }
    save_connection_configs(state, &configs).await
}

async fn test_agent_connection(
    state: &Arc<AppState>,
    config: &ConnectionConfig,
    host: &str,
    port: u16,
) -> Result<ConnectionTestResult, String> {
    let connect_params = agent_connect_params(config, host, port, config.database.as_deref().unwrap_or(""));
    let result = state
        .agent_manager
        .call_daemon_method_with_timeout::<serde_json::Value>(
            &config.db_type,
            config.driver_profile.as_deref(),
            AgentMethod::TestConnection,
            connect_params,
            Some(agent_connect_timeout(config)),
        )
        .await;

    let response = match result {
        Ok(response) => response,
        Err(err) => {
            if let Some(alternate_config) = oracle_alternate_connect_config(config, &err) {
                state
                    .agent_manager
                    .call_daemon_method_with_timeout::<serde_json::Value>(
                        &alternate_config.db_type,
                        alternate_config.driver_profile.as_deref(),
                        AgentMethod::TestConnection,
                        agent_connect_params(
                            &alternate_config,
                            host,
                            port,
                            alternate_config.database.as_deref().unwrap_or(""),
                        ),
                        Some(agent_connect_timeout(&alternate_config)),
                    )
                    .await
                    .map_err(|alternate_err| {
                        format!("{err}\n\nFallback with alternate Oracle descriptor failed: {alternate_err}")
                    })?
            } else {
                return Err(oracle_error_with_driver_hint(config, &err));
            }
        }
    };

    Ok(ConnectionTestResult::success("Connection successful")
        .with_database_info(database_info_from_protocol_value(&response)))
}

async fn optional_mysql_database_info(
    pool: &db::mysql::MySqlPool,
    config: &ConnectionConfig,
) -> Option<DatabaseConnectionInfo> {
    match db::mysql::database_connection_info(pool, db::mysql::protocol_product_name(config)).await {
        Ok(info) => Some(info),
        Err(error) => {
            log::warn!("Failed to read optional MySQL database information: {error}");
            None
        }
    }
}

async fn connect_agent_pool(
    state: &Arc<AppState>,
    config: &ConnectionConfig,
    host: &str,
    port: u16,
) -> Result<PoolKind, String> {
    let connect_params = agent_connect_params(config, host, port, config.effective_database().unwrap_or(""));
    let mut client = state.agent_manager.spawn(&config.db_type, config.driver_profile.as_deref()).await?;
    let connect_result = client
        .call_method_with_timeout::<serde_json::Value>(
            AgentMethod::Connect,
            connect_params,
            Some(agent_connect_timeout(config)),
        )
        .await;

    if let Err(err) = connect_result {
        if let Some(alternate_config) = oracle_alternate_connect_config(config, &err) {
            client
                .call_method_with_timeout::<serde_json::Value>(
                    AgentMethod::Connect,
                    agent_connect_params(
                        &alternate_config,
                        host,
                        port,
                        alternate_config.effective_database().unwrap_or(""),
                    ),
                    Some(agent_connect_timeout(&alternate_config)),
                )
                .await
                .map_err(|alternate_err| {
                    format!("{err}\n\nFallback with alternate Oracle descriptor failed: {alternate_err}")
                })?;
        } else {
            return Err(oracle_error_with_driver_hint(config, &err));
        }
    }

    Ok(PoolKind::agent(client))
}

#[cfg(test)]
mod tests {
    #[cfg(feature = "mq-admin")]
    use super::load_connection_configs;
    use super::{
        connect_sqlite_from_config, gaussdb_m_jdbc_command_config, mark_mongo_legacy_driver,
        mongo_legacy_connect_params, save_connection_configs, MONGO_LEGACY_DRIVER_LABEL, MONGO_LEGACY_DRIVER_PROFILE,
    };
    use dbx_core::connection::{AppState, PoolKind};
    use dbx_core::models::connection::{AttachedDatabaseConfig, ConnectionConfig, DatabaseType};
    use dbx_core::storage::Storage;

    fn mongodb_config() -> ConnectionConfig {
        ConnectionConfig {
            id: "mongo".to_string(),
            name: "MongoDB".to_string(),
            note: String::new(),
            db_type: DatabaseType::MongoDb,
            driver_profile: Some("mongodb".to_string()),
            driver_label: Some("MongoDB".to_string()),
            url_params: Some("authSource=admin&authMechanism=SCRAM-SHA-1".to_string()),
            agent_java_options: Vec::new(),
            host: "172.22.4.42".to_string(),
            port: 27017,
            username: "mongouser".to_string(),
            password: "secret".to_string(),
            database: Some("RestCloud_V45PUB_Gateway".to_string()),
            visible_databases: None,
            visible_schemas: None,
            show_system_schemas: false,
            attached_databases: Vec::new(),
            init_script: None,
            color: None,
            transport_layers: Vec::new(),
            connect_timeout_secs: dbx_core::models::connection::default_connect_timeout_secs(),
            query_timeout_secs: dbx_core::models::connection::default_query_timeout_secs(),
            idle_timeout_secs: dbx_core::models::connection::default_idle_timeout_secs(),
            keepalive_interval_secs: dbx_core::models::connection::default_keepalive_interval_secs(),
            ssl: false,
            ca_cert_path: String::new(),
            client_cert_path: String::new(),
            client_key_path: String::new(),
            sysdba: false,
            oracle_connection_type: None,
            connection_string: Some(
                "mongodb://mongouser:secret@172.22.4.42:27017/RestCloud_V45PUB_Gateway?authSource=admin".to_string(),
            ),
            redis_connection_mode: None,
            redis_sentinel_master: String::new(),
            redis_sentinel_nodes: String::new(),
            redis_sentinel_username: String::new(),
            redis_sentinel_password: String::new(),
            redis_sentinel_tls: false,
            redis_cluster_nodes: String::new(),
            redis_key_separator: dbx_core::models::connection::default_redis_key_separator(),
            redis_scan_page_size: None,
            redis_database_aliases: Default::default(),
            etcd_endpoints: String::new(),
            gbase_server: String::new(),
            informix_server: String::new(),
            external_config: None,
            jdbc_driver_class: None,
            jdbc_driver_paths: Vec::new(),
            one_time: false,
            read_only: false,
            is_production: false,
            production_databases: vec![],
            database_info: None,
        }
    }

    fn sqlite_config(path: &std::path::Path, password: &str) -> ConnectionConfig {
        let mut config = mongodb_config();
        config.id = "sqlite".to_string();
        config.name = "SQLite".to_string();
        config.db_type = DatabaseType::Sqlite;
        config.driver_profile = None;
        config.driver_label = None;
        config.url_params = None;
        config.host = path.to_string_lossy().to_string();
        config.port = 0;
        config.username = String::new();
        config.password = password.to_string();
        config.database = None;
        config.connection_string = None;
        config
    }

    #[tokio::test]
    async fn sqlite_connect_from_config_restores_attached_databases() {
        let dir = std::env::temp_dir().join(format!("dbx-tauri-sqlite-attach-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&dir).unwrap();
        let main_path = dir.join("main.sqlite");
        let attached_path = dir.join("analytics.sqlite");
        drop(dbx_core::db::sqlite::connect_path_create_if_missing(main_path.to_str().unwrap()).await.unwrap());
        let attached =
            dbx_core::db::sqlite::connect_path_create_if_missing(attached_path.to_str().unwrap()).await.unwrap();
        dbx_core::db::sqlite::execute_query(&attached, "CREATE TABLE events(id INTEGER PRIMARY KEY);").await.unwrap();
        drop(attached);

        let mut config = sqlite_config(&main_path, "");
        config.attached_databases.push(AttachedDatabaseConfig {
            name: "analytics".to_string(),
            path: attached_path.to_string_lossy().to_string(),
        });

        let pool = connect_sqlite_from_config(&config).await.expect("open SQLite connection with attachments");
        let count = pool
            .with_connection(|conn| {
                conn.query_row(
                    "SELECT count(*) FROM analytics.sqlite_master WHERE type = 'table' AND name = 'events'",
                    [],
                    |row| row.get::<_, i64>(0),
                )
                .map_err(|error| error.to_string())
            })
            .expect("query attached SQLite database");
        assert_eq!(count, 1);

        drop(pool);
        let _ = std::fs::remove_dir_all(dir);
    }

    #[tokio::test]
    async fn sqlite_connect_from_config_rejects_sqlcipher_attachments_before_opening_files() {
        let mut config = sqlite_config(std::path::Path::new("/missing/main.sqlite"), "secret");
        config.attached_databases.push(AttachedDatabaseConfig {
            name: "analytics".to_string(),
            path: "/missing/analytics.sqlite".to_string(),
        });

        let error = match connect_sqlite_from_config(&config).await {
            Ok(_) => panic!("SQLCipher attachments must be rejected"),
            Err(error) => error,
        };
        assert!(error.contains("SQLCipher"), "{error}");
    }

    #[tokio::test]
    async fn saving_memory_sqlite_attachments_keeps_the_live_pool_intact() {
        let dir = std::env::temp_dir().join(format!("dbx-tauri-sqlite-memory-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&dir).unwrap();
        let storage = Storage::open(&dir.join("storage.db")).await.unwrap();
        let state = AppState::new_with_plugin_dir(storage, dir.join("plugins"));
        let initial = sqlite_config(std::path::Path::new(":memory:"), "");
        let pool = dbx_core::db::sqlite::connect_path(":memory:").await.unwrap();
        dbx_core::db::sqlite::execute_query(
            &pool,
            "CREATE TABLE retained(value TEXT); INSERT INTO retained VALUES ('yes');",
        )
        .await
        .unwrap();
        state.configs.write().await.insert(initial.id.clone(), initial.clone());
        state.connections.write().await.insert(initial.id.clone(), PoolKind::Sqlite(pool.clone()));

        let mut invalid = initial.clone();
        invalid.attached_databases.push(AttachedDatabaseConfig {
            name: "analytics".to_string(),
            path: dir.join("analytics.sqlite").to_string_lossy().to_string(),
        });
        let error = save_connection_configs(&state, &[invalid]).await.unwrap_err();

        assert!(error.contains("in-memory main database"), "{error}");
        assert!(state.connections.read().await.contains_key(&initial.id));
        assert_eq!(state.configs.read().await.get(&initial.id), Some(&initial));
        let retained = dbx_core::db::sqlite::execute_query(&pool, "SELECT value FROM retained;").await.unwrap();
        assert_eq!(retained.rows[0][0], serde_json::json!("yes"));

        drop(pool);
        drop(state);
        let _ = std::fs::remove_dir_all(dir);
    }

    #[cfg(feature = "mq-admin")]
    fn mq_config(id: &str, admin_url: &str) -> ConnectionConfig {
        let mut config = mongodb_config();
        config.id = id.to_string();
        config.name = "Pulsar".to_string();
        config.db_type = DatabaseType::MessageQueue;
        config.driver_profile = None;
        config.driver_label = None;
        config.url_params = None;
        config.host = String::new();
        config.port = 0;
        config.username = String::new();
        config.password = String::new();
        config.database = None;
        config.connection_string = None;
        config.external_config = Some(serde_json::json!({
            "systemKind": "pulsar",
            "adminUrl": admin_url,
            "auth": { "kind": "none" },
            "pinnedVersion": "3.1"
        }));
        config
    }

    #[test]
    fn gaussdb_m_commands_select_vendor_jdbc_config() {
        let mut config = mongodb_config();
        config.db_type = DatabaseType::Gaussdb;
        config.driver_profile = Some("gaussdb-m".to_string());
        config.host = "gaussdb.internal".to_string();
        config.port = 8000;
        config.database = Some("app".to_string());
        config.url_params = None;
        config.connection_string = None;

        let jdbc = gaussdb_m_jdbc_command_config(&config, "127.0.0.1", 18000).unwrap();
        assert_eq!(
            jdbc.connection_string.as_deref(),
            Some("jdbc:gaussdb://127.0.0.1:18000/app?sslmode=prefer&ssl=true")
        );
        assert_eq!(jdbc.jdbc_driver_class.as_deref(), Some("com.huawei.gaussdb.jdbc.Driver"));

        config.driver_profile = Some("gaussdb".to_string());
        assert!(gaussdb_m_jdbc_command_config(&config, "127.0.0.1", 18000).is_none());
    }

    #[test]
    fn mongo_legacy_connect_params_preserve_auth_options() {
        let config = mongodb_config();

        let params = mongo_legacy_connect_params(&config, "172.22.4.42", 27017);

        assert_eq!(params["connection"]["database"], "RestCloud_V45PUB_Gateway");
        assert_eq!(params["connection"]["url_params"], "authSource=admin&authMechanism=SCRAM-SHA-1");
        assert_eq!(
            params["connection"]["connection_string"],
            "mongodb://mongouser:secret@172.22.4.42:27017/RestCloud_V45PUB_Gateway?authSource=admin"
        );
    }

    #[test]
    fn mark_mongo_legacy_driver_updates_profile_and_label() {
        let mut config = mongodb_config();

        assert!(mark_mongo_legacy_driver(&mut config));
        assert_eq!(config.driver_profile.as_deref(), Some(MONGO_LEGACY_DRIVER_PROFILE));
        assert_eq!(config.driver_label.as_deref(), Some(MONGO_LEGACY_DRIVER_LABEL));
        assert!(!mark_mongo_legacy_driver(&mut config));
    }

    #[cfg(feature = "sqlite-sqlcipher")]
    #[tokio::test]
    async fn sqlite_connect_from_config_uses_sqlcipher_key() {
        let path = std::env::temp_dir().join(format!("dbx-tauri-sqlcipher-{}.db", uuid::Uuid::new_v4()));
        let key = "dbx-pass";

        {
            let pool =
                dbx_core::db::sqlite::connect_path_create_if_missing_with_cipher_key(path.to_str().unwrap(), key)
                    .await
                    .expect("create encrypted sqlite");
            pool.with_connection(|conn| {
                conn.execute_batch(
                    "CREATE TABLE users(id INTEGER PRIMARY KEY, name TEXT); INSERT INTO users(name) VALUES ('Ada'), ('Grace');",
                )
                .map_err(|err| err.to_string())
            })
            .expect("write encrypted sqlite");
        }

        let config = sqlite_config(&path, key);
        let pool = connect_sqlite_from_config(&config).await.expect("open encrypted sqlite");
        let count = pool
            .with_connection(|conn| {
                conn.query_row("SELECT count(*) FROM users", [], |row| row.get::<_, i64>(0))
                    .map_err(|err| err.to_string())
            })
            .expect("read encrypted sqlite");
        assert_eq!(count, 2);

        let wrong_key = match connect_sqlite_from_config(&sqlite_config(&path, "wrong-key")).await {
            Ok(_) => panic!("wrong SQLCipher key must fail"),
            Err(err) => err,
        };
        assert!(wrong_key.contains("SQLCipher database unlock failed"));

        let missing_key = match connect_sqlite_from_config(&sqlite_config(&path, "")).await {
            Ok(_) => panic!("missing SQLCipher key must fail"),
            Err(err) => err,
        };
        assert!(missing_key.contains("not a valid SQLite database"));

        let _ = std::fs::remove_file(path);
    }

    #[cfg(feature = "mq-admin")]
    #[tokio::test]
    async fn save_connection_configs_updates_runtime_cache_and_drops_mq_adapter() {
        let dir = std::env::temp_dir().join(format!("dbx-tauri-conn-test-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&dir).unwrap();
        let storage = Storage::open(&dir.join("storage.db")).await.unwrap();
        let state = AppState::new_with_plugin_dir(storage, dir.join("plugins"));
        let initial = mq_config("mq-conn", "http://127.0.0.1:8080");
        state.configs.write().await.insert(initial.id.clone(), initial.clone());
        state.connections.write().await.insert(initial.id.clone(), PoolKind::MessageQueue);
        let first = state.mq_registry.get_or_build(&initial).await.unwrap();

        let updated = mq_config("mq-conn", "http://127.0.0.1:8081");
        save_connection_configs(&state, std::slice::from_ref(&updated)).await.unwrap();

        let cached_admin_url = state
            .configs
            .read()
            .await
            .get("mq-conn")
            .and_then(|config| config.external_config.as_ref())
            .and_then(|external| external.get("adminUrl"))
            .and_then(serde_json::Value::as_str)
            .map(str::to_string);
        assert_eq!(cached_admin_url.as_deref(), Some("http://127.0.0.1:8081"));

        let second = state.mq_registry.get_or_build(&updated).await.unwrap();
        assert!(!std::sync::Arc::ptr_eq(&first, &second));
        assert!(!state.connections.read().await.contains_key(&initial.id));

        let _ = std::fs::remove_dir_all(dir);
    }

    #[cfg(feature = "mq-admin")]
    #[tokio::test]
    async fn load_connection_configs_syncs_runtime_cache_and_drops_stale_pool() {
        let dir = std::env::temp_dir().join(format!("dbx-tauri-conn-test-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&dir).unwrap();
        let storage = Storage::open(&dir.join("storage.db")).await.unwrap();
        let state = AppState::new_with_plugin_dir(storage, dir.join("plugins"));
        let initial = mq_config("mq-conn", "http://127.0.0.1:8080");
        let updated = mq_config("mq-conn", "http://127.0.0.1:8081");
        state.storage.save_connections(std::slice::from_ref(&updated)).await.unwrap();
        state.configs.write().await.insert(initial.id.clone(), initial.clone());
        state.connections.write().await.insert(initial.id.clone(), PoolKind::MessageQueue);

        let loaded = load_connection_configs(&state).await.unwrap();

        assert_eq!(loaded.len(), 1);
        let cached_admin_url = state
            .configs
            .read()
            .await
            .get("mq-conn")
            .and_then(|config| config.external_config.as_ref())
            .and_then(|external| external.get("adminUrl"))
            .and_then(serde_json::Value::as_str)
            .map(str::to_string);
        assert_eq!(cached_admin_url.as_deref(), Some("http://127.0.0.1:8081"));
        assert!(!state.connections.read().await.contains_key(&initial.id));

        let _ = std::fs::remove_dir_all(dir);
    }

    #[cfg(feature = "mq-admin")]
    #[tokio::test]
    async fn save_connection_configs_removes_deleted_runtime_config_and_mq_adapter() {
        let dir = std::env::temp_dir().join(format!("dbx-tauri-conn-test-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&dir).unwrap();
        let storage = Storage::open(&dir.join("storage.db")).await.unwrap();
        let state = AppState::new_with_plugin_dir(storage, dir.join("plugins"));
        let kept = mongodb_config();
        let removed = mq_config("removed-mq", "http://127.0.0.1:8080");
        {
            let mut configs = state.configs.write().await;
            configs.insert(kept.id.clone(), kept.clone());
            configs.insert(removed.id.clone(), removed.clone());
        }
        let stale = state.mq_registry.get_or_build(&removed).await.unwrap();

        save_connection_configs(&state, std::slice::from_ref(&kept)).await.unwrap();

        let configs = state.configs.read().await;
        assert!(configs.contains_key(&kept.id));
        assert!(!configs.contains_key("removed-mq"));
        drop(configs);

        let rebuilt = state.mq_registry.get_or_build(&removed).await.unwrap();
        assert!(!std::sync::Arc::ptr_eq(&stale, &rebuilt));

        let _ = std::fs::remove_dir_all(dir);
    }

    #[cfg(feature = "mq-admin")]
    #[tokio::test]
    async fn save_connection_configs_removes_deleted_connection_pools() {
        let dir = std::env::temp_dir().join(format!("dbx-tauri-conn-test-{}", uuid::Uuid::new_v4()));
        std::fs::create_dir_all(&dir).unwrap();
        let storage = Storage::open(&dir.join("storage.db")).await.unwrap();
        let state = AppState::new_with_plugin_dir(storage, dir.join("plugins"));
        let kept = mongodb_config();
        let removed = mq_config("removed-mq", "http://127.0.0.1:8080");
        {
            let mut configs = state.configs.write().await;
            configs.insert(kept.id.clone(), kept.clone());
            configs.insert(removed.id.clone(), removed.clone());
        }
        state.connections.write().await.insert(removed.id.clone(), PoolKind::MessageQueue);

        save_connection_configs(&state, std::slice::from_ref(&kept)).await.unwrap();

        assert!(!state.connections.read().await.contains_key(&removed.id));

        let _ = std::fs::remove_dir_all(dir);
    }
}

#[tauri::command]
pub async fn save_connections(state: State<'_, Arc<AppState>>, configs: Vec<ConnectionConfig>) -> Result<(), String> {
    let configs: Vec<ConnectionConfig> = configs.into_iter().map(|config| config.canonicalized()).collect();
    save_connection_configs(state.inner(), &configs).await
}

async fn save_connection_configs(state: &AppState, configs: &[ConnectionConfig]) -> Result<(), String> {
    for config in configs {
        if config.db_type == DatabaseType::Sqlite {
            db::sqlite::validate_persistent_attachments(
                &config.host,
                &config.password,
                !config.attached_databases.is_empty(),
            )?;
        }
    }
    state.storage.save_connections(configs).await?;
    let sync = sync_connection_configs(state, configs).await;
    remove_connection_pools_for_connection_ids(state, &sync.connection_pool_ids_to_drop).await;
    drop_nacos_adapters_for_connection_ids(state, &sync.nacos_adapter_ids_to_drop).await;
    drop_mq_adapters_for_connection_ids(state, &sync.mq_adapter_ids_to_drop).await;
    Ok(())
}

struct ConnectionConfigSync {
    nacos_adapter_ids_to_drop: Vec<String>,
    mq_adapter_ids_to_drop: Vec<String>,
    connection_pool_ids_to_drop: Vec<String>,
}

async fn sync_connection_configs(state: &AppState, configs: &[ConnectionConfig]) -> ConnectionConfigSync {
    let saved_ids: HashSet<&str> = configs.iter().map(|config| config.id.as_str()).collect();
    let mut nacos_adapter_ids_to_drop = HashSet::new();
    let mut mq_adapter_ids_to_drop = HashSet::new();
    let mut connection_pool_ids_to_drop = HashSet::new();
    let mut runtime_configs = state.configs.write().await;
    runtime_configs.retain(|id, existing| {
        if saved_ids.contains(id.as_str()) || is_transient_runtime_config_id(id) {
            true
        } else {
            connection_pool_ids_to_drop.insert(id.clone());
            if existing.db_type == DatabaseType::Nacos {
                nacos_adapter_ids_to_drop.insert(id.clone());
            }
            if existing.db_type == DatabaseType::MessageQueue {
                mq_adapter_ids_to_drop.insert(id.clone());
            }
            false
        }
    });
    for config in configs {
        if config.db_type == DatabaseType::Nacos {
            nacos_adapter_ids_to_drop.insert(config.id.clone());
        }
        if config.db_type == DatabaseType::MessageQueue {
            mq_adapter_ids_to_drop.insert(config.id.clone());
        }
        if let Some(previous) = runtime_configs.insert(config.id.clone(), config.clone()) {
            if previous.db_type == DatabaseType::Nacos {
                nacos_adapter_ids_to_drop.insert(config.id.clone());
            }
            if previous.db_type == DatabaseType::MessageQueue {
                mq_adapter_ids_to_drop.insert(config.id.clone());
            }
            if &previous != config {
                connection_pool_ids_to_drop.insert(config.id.clone());
            }
        }
    }
    ConnectionConfigSync {
        nacos_adapter_ids_to_drop: nacos_adapter_ids_to_drop.into_iter().collect(),
        mq_adapter_ids_to_drop: mq_adapter_ids_to_drop.into_iter().collect(),
        connection_pool_ids_to_drop: connection_pool_ids_to_drop.into_iter().collect(),
    }
}

fn is_transient_runtime_config_id(id: &str) -> bool {
    id.starts_with("__test_") || id.starts_with("__visible_draft_") || id.starts_with("__visible_schema_draft_")
}

async fn drop_nacos_adapters_for_connection_ids(state: &AppState, connection_ids: &[String]) {
    for connection_id in connection_ids {
        state.nacos_registry.drop_connection(connection_id).await;
    }
}

#[cfg(feature = "mq-admin")]
async fn drop_mq_adapters_for_connection_ids(state: &AppState, connection_ids: &[String]) {
    for connection_id in connection_ids {
        state.mq_registry.drop_connection(connection_id).await;
    }
}

#[cfg(not(feature = "mq-admin"))]
async fn drop_mq_adapters_for_connection_ids(_state: &AppState, _connection_ids: &[String]) {}

async fn remove_connection_pools_for_connection_ids(state: &AppState, connection_ids: &[String]) {
    for connection_id in connection_ids {
        state.remove_connection_pools_detached(connection_id).await;
    }
}

#[tauri::command]
pub async fn load_connections(state: State<'_, Arc<AppState>>) -> Result<Vec<ConnectionConfig>, String> {
    load_connection_configs(state.inner()).await
}

async fn load_connection_configs(state: &AppState) -> Result<Vec<ConnectionConfig>, String> {
    let configs: Vec<ConnectionConfig> =
        state.storage.load_connections().await?.into_iter().map(|config| config.canonicalized()).collect();
    let sync = sync_connection_configs(state, &configs).await;
    remove_connection_pools_for_connection_ids(state, &sync.connection_pool_ids_to_drop).await;
    drop_nacos_adapters_for_connection_ids(state, &sync.nacos_adapter_ids_to_drop).await;
    drop_mq_adapters_for_connection_ids(state, &sync.mq_adapter_ids_to_drop).await;
    Ok(configs)
}

#[tauri::command]
pub async fn save_sidebar_layout(state: State<'_, Arc<AppState>>, layout: serde_json::Value) -> Result<(), String> {
    state.storage.save_sidebar_layout(&layout).await
}

#[tauri::command]
pub async fn load_sidebar_layout(state: State<'_, Arc<AppState>>) -> Result<Option<serde_json::Value>, String> {
    state.storage.load_sidebar_layout().await
}

fn sqlite_extension_specs_from_config(config: &ConnectionConfig) -> Vec<db::sqlite::SqliteExtensionSpec> {
    db::sqlite::sqlite_extension_specs_from_url_params(config.url_params.as_deref())
        .into_iter()
        .map(|mut extension| {
            extension.path = expand_tilde(&extension.path);
            extension
        })
        .collect()
}

async fn connect_sqlite_from_config(config: &ConnectionConfig) -> Result<db::sqlite::SqliteHandle, String> {
    let sqlite_path = expand_tilde(&config.host);
    db::sqlite::validate_persistent_attachments(&sqlite_path, &config.password, !config.attached_databases.is_empty())?;
    let pool = db::sqlite::connect_path_with_cipher_key_and_extensions(
        &sqlite_path,
        &config.password,
        sqlite_extension_specs_from_config(config),
    )
    .await?;
    for attached in &config.attached_databases {
        db::sqlite::attach_database(&pool, &attached.name, &expand_tilde(&attached.path))?;
    }
    Ok(pool)
}

async fn test_redis_connection(
    state: &Arc<AppState>,
    tunnel_id: &str,
    config: &ConnectionConfig,
    host: &str,
    port: u16,
    connect_timeout: std::time::Duration,
) -> Result<String, String> {
    // Connection tests must exercise the same Redis lifecycle as a saved connection,
    // including compatibility auth, TLS, and database selection.
    if config.uses_redis_cluster() {
        drop(state.connect_redis_cluster(tunnel_id, config).await?);
    } else if config.uses_redis_sentinel() {
        drop(state.connect_redis_sentinel(tunnel_id, config).await?);
    } else {
        drop(db::redis_driver::connect_standalone(config, host, port, connect_timeout).await?);
    }
    Ok("Connection successful".to_string())
}

#[tauri::command]
pub async fn test_connection(state: State<'_, Arc<AppState>>, config: ConnectionConfig) -> Result<String, String> {
    test_connection_with_info_inner(state.inner(), config).await.map(|result| result.message)
}

#[tauri::command]
pub async fn test_connection_with_info(
    state: State<'_, Arc<AppState>>,
    config: ConnectionConfig,
) -> Result<ConnectionTestResult, String> {
    test_connection_with_info_inner(state.inner(), config).await
}

async fn test_connection_with_info_inner(
    state: &Arc<AppState>,
    config: ConnectionConfig,
) -> Result<ConnectionTestResult, String> {
    let tunnel_id = format!("{}:test", config.id);
    let has_transport_layers = config.has_effective_transport_layers();
    let connection_id = if has_transport_layers { tunnel_id.as_str() } else { config.id.as_str() };
    let (host, port) = state.connection_host_port(connection_id, &config).await?;
    let probe_result = probe_connection_endpoint(&config, &host, port).await;
    let url = connection_url_for_endpoint(&config, &host, port);
    let target = redacted_connection_url_for_endpoint(&config, &host, port);
    let connect_timeout = std::time::Duration::from_secs(config.effective_connect_timeout_secs());
    let idle_timeout = std::time::Duration::from_secs(config.idle_timeout_secs);
    let gaussdb_m_jdbc_config = gaussdb_m_jdbc_command_config(&config, &host, port);
    log::info!("[test_connection] db_type={:?} target={}", config.db_type, target);
    let mut database_info = None;
    let result = match probe_result {
        Err(e) => Err(e),
        Ok(()) => match config.db_type {
            DatabaseType::Mysql if config.needs_bare_mysql() && !config.bare_mysql_uses_tls() => {
                match db::mysql::connect_bare(&url, connect_timeout).await {
                    Ok(pool) => {
                        database_info = optional_mysql_database_info(&pool, &config).await;
                        let _ = pool.disconnect().await;
                        Ok("Connection successful".to_string())
                    }
                    Err(e) => Err(e),
                }
            }
            DatabaseType::Mysql if config.needs_bare_mysql() && config.bare_mysql_uses_tls() => {
                match db::mysql::connect_compatible_with_ca_cert_pool_limit_idle_and_setup(
                    &url,
                    Some(&config.ca_cert_path),
                    connect_timeout,
                    10,
                    None,
                    &[],
                )
                .await
                {
                    Ok(pool) => {
                        database_info = optional_mysql_database_info(&pool, &config).await;
                        let _ = pool.disconnect().await;
                        Ok("Connection successful".to_string())
                    }
                    Err(e) => Err(e),
                }
            }
            DatabaseType::Mysql => {
                match db::mysql::connect_with_ca_cert(&url, Some(&config.ca_cert_path), connect_timeout).await {
                    Ok(pool) => {
                        database_info = optional_mysql_database_info(&pool, &config).await;
                        let _ = pool.disconnect().await;
                        Ok("Connection successful".to_string())
                    }
                    Err(e) => Err(e),
                }
            }
            DatabaseType::Doris | DatabaseType::ManticoreSearch => {
                match db::mysql::connect_bare(&url, connect_timeout).await {
                    Ok(pool) => {
                        database_info = optional_mysql_database_info(&pool, &config).await;
                        let _ = pool.disconnect().await;
                        Ok("Connection successful".to_string())
                    }
                    Err(e) => Err(e),
                }
            }
            DatabaseType::StarRocks => {
                let connect = if config.bare_mysql_uses_tls() {
                    db::mysql::connect_compatible_with_ca_cert_pool_limit_idle_and_setup(
                        &url,
                        Some(&config.ca_cert_path),
                        connect_timeout,
                        10,
                        None,
                        &[],
                    )
                    .await
                } else {
                    db::mysql::connect_bare(&url, connect_timeout).await
                };
                match connect {
                    Ok(pool) => {
                        database_info = optional_mysql_database_info(&pool, &config).await;
                        let _ = pool.disconnect().await;
                        Ok("Connection successful".to_string())
                    }
                    Err(e) => Err(e),
                }
            }
            DatabaseType::Gaussdb if gaussdb_m_jdbc_config.is_some() => {
                match state
                    .test_external_driver_with_info("jdbc", gaussdb_m_jdbc_config.as_ref().expect("checked above"))
                    .await
                {
                    Ok(details) => {
                        database_info = details.database_info;
                        Ok(details.message)
                    }
                    Err(err) => Err(err),
                }
            }
            DatabaseType::Postgres
            | DatabaseType::Redshift
            | DatabaseType::Gaussdb
            | DatabaseType::Kwdb
            | DatabaseType::Questdb
            | DatabaseType::OpenGauss => match db::postgres::connect(&url, connect_timeout).await {
                Ok(pool) => {
                    pool.close();
                    Ok("Connection successful".to_string())
                }
                Err(e) => Err(e),
            },
            DatabaseType::Sqlite => match connect_sqlite_from_config(&config).await {
                Ok(_) => Ok("Connection successful".to_string()),
                Err(e) => Err(e),
            },
            DatabaseType::Redis => {
                // Keep the result inside the outer lifecycle so temporary transports
                // are reset after both successful and failed Redis tests.
                test_redis_connection(state, &tunnel_id, &config, &host, port, connect_timeout).await
            }
            #[cfg(feature = "duckdb-sidecar")]
            DatabaseType::DuckDb => {
                state.test_duckdb_connection_config(&config).await?;
                Ok("Connection successful".to_string())
            }
            #[cfg(not(feature = "duckdb-sidecar"))]
            DatabaseType::DuckDb => Err("DuckDB support is not compiled in this build".to_string()),
            DatabaseType::MongoDb => {
                if mongo_uses_legacy_driver(&config) {
                    let am = &state.agent_manager;
                    let mut client = am.spawn(&config.db_type, config.driver_profile.as_deref()).await?;
                    client
                        .connect(mongo_legacy_connect_params(&config, &host, port))
                        .await
                        .map_err(|err| mongo_legacy_error_with_auth_hint(&err))?;
                    client.disconnect().await.ok();
                    return Ok(ConnectionTestResult::success("Connection successful (via legacy driver)"));
                }

                let native_err = match db::mongo_driver::connect(&url, connect_timeout, idle_timeout).await {
                    Ok(client) => {
                        match db::mongo_driver::test_connection(&client, connect_timeout, config.effective_database())
                            .await
                        {
                            Ok(()) => return Ok(ConnectionTestResult::success("Connection successful")),
                            Err(e) => e,
                        }
                    }
                    Err(e) => e,
                };
                if should_retry_mongo_with_legacy_driver(&native_err) {
                    let am = &state.agent_manager;
                    let mut client = am.spawn(&config.db_type, Some("mongodb-legacy")).await?;
                    client.connect(mongo_legacy_connect_params(&config, &host, port)).await.map_err(|err| {
                        format!(
                            "{native_err}\n\nFallback with MongoDB (Legacy) driver failed: {}",
                            mongo_legacy_error_with_auth_hint(&err)
                        )
                    })?;
                    client.disconnect().await.ok();
                    Ok("Connection successful (via legacy driver)".to_string())
                } else {
                    Err(native_err)
                }
            }
            DatabaseType::ClickHouse => {
                let username = if config.username.is_empty() { None } else { Some(config.username.clone()) };
                let password = if config.password.is_empty() { None } else { Some(config.password.clone()) };
                let client = db::clickhouse_driver::ChClient::new_with_ca_cert(
                    &url,
                    username,
                    password,
                    Some(&config.ca_cert_path),
                    config.url_params.as_deref(),
                    connect_timeout,
                )?;
                db::clickhouse_driver::test_connection(&client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::SqlServer => {
                match state.test_sqlserver_connection_with_info(&config, &host, port, connect_timeout).await {
                    Ok(details) => {
                        database_info = details.database_info;
                        Ok(details.message)
                    }
                    Err(err) => Err(err),
                }
            }
            DatabaseType::Elasticsearch => {
                let mut client = db::elasticsearch_driver::EsClient::from_config(
                    &url,
                    Some(&config.username),
                    Some(&config.password),
                    config.ssl,
                    config.url_params.as_deref(),
                    config.external_config.as_ref(),
                    connect_timeout,
                );
                db::elasticsearch_driver::test_connection(&mut client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::Easysearch => {
                let mut client = db::easysearch_driver::EasysearchClient::from_config(
                    &url,
                    Some(&config.username),
                    Some(&config.password),
                    config.ssl,
                    config.url_params.as_deref(),
                    config.external_config.as_ref(),
                    connect_timeout,
                );
                db::easysearch_driver::test_connection(&mut client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::Hbase => {
                let client = db::hbase_driver::HBaseClient::new(
                    &url,
                    Some(&config.username),
                    Some(&config.password),
                    false,
                    connect_timeout,
                )?;
                db::hbase_driver::test_connection(&client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::Qdrant | DatabaseType::Milvus | DatabaseType::Weaviate | DatabaseType::ChromaDb => {
                let kind = match config.db_type {
                    DatabaseType::Qdrant => db::vector_driver::VectorDbKind::Qdrant,
                    DatabaseType::Milvus => db::vector_driver::VectorDbKind::Milvus,
                    DatabaseType::Weaviate => db::vector_driver::VectorDbKind::Weaviate,
                    DatabaseType::ChromaDb => db::vector_driver::VectorDbKind::ChromaDb,
                    _ => unreachable!(),
                };
                let client = db::vector_driver::VectorClient::new(
                    kind,
                    &url,
                    Some(&config.username),
                    Some(&config.password),
                    config.ssl,
                    connect_timeout,
                );
                db::vector_driver::test_connection(&client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::Rqlite => {
                let client = db::rqlite_driver::RqliteClient::new(
                    &url,
                    config.url_params.as_deref(),
                    &config.username,
                    &config.password,
                    config.ssl,
                    connect_timeout,
                )?;
                db::rqlite_driver::test_connection(&client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::Turso => {
                let auth_token = if !config.password.is_empty() {
                    config.password.clone()
                } else {
                    config
                        .url_params
                        .as_deref()
                        .and_then(|p| {
                            p.trim()
                                .trim_start_matches('?')
                                .split('&')
                                .filter_map(|pair| pair.split_once('='))
                                .find(|(key, _)| {
                                    let k = key.trim().to_ascii_lowercase();
                                    k == "auth_token" || k == "authtoken" || k == "auth-token"
                                })
                                .map(|(_, value)| value.trim().to_string())
                        })
                        .unwrap_or_default()
                };
                let client = db::turso_driver::TursoClient::new(&url, &auth_token, config.ssl, connect_timeout)?;
                db::turso_driver::test_connection(&client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::CloudflareD1 => db::cloudflare_d1_driver::connect(&config, connect_timeout)
                .await
                .map(|_| "Connection successful".to_string()),
            DatabaseType::InfluxDb => {
                let client = db::influxdb_driver::InfluxdbClient::new_for_config(&url, &config, connect_timeout)?;
                db::influxdb_driver::test_connection(&client, connect_timeout)
                    .await
                    .map(|_| "Connection successful".to_string())
            }
            DatabaseType::Nacos => {
                let admin_config = state.nacos_admin_config_for_connection(connection_id, &config).await?;
                let adapter = state.nacos_registry.build_transient_config(admin_config).await?;
                adapter.test_connection().await?;
                Ok("Connection successful".to_string())
            }
            #[cfg(feature = "mq-admin")]
            DatabaseType::MessageQueue => {
                let mqc = state.mq_admin_config_for_connection(connection_id, &config).await?;
                let agent_launch = dbx_core::mq::service::resolve_mq_agent_launch_spec(&mqc, state);
                let adapter = match state.mq_registry.get_or_build_config(connection_id, mqc, agent_launch).await {
                    Ok(adapter) => adapter,
                    Err(err) => {
                        state.mq_registry.drop_connection(connection_id).await;
                        return Err(err);
                    }
                };
                if let Err(err) = adapter.test_connection().await {
                    state.mq_registry.drop_connection(connection_id).await;
                    return Err(err);
                }
                Ok("Connection successful".to_string())
            }
            #[cfg(not(feature = "mq-admin"))]
            DatabaseType::MessageQueue => {
                Err("Message queue admin support is not compiled in this build. Rebuild with the 'mq-admin' feature."
                    .to_string())
            }
            db_type if database_capabilities::is_agent_type(&db_type) => {
                match test_agent_connection(state, &config, &host, port).await {
                    Ok(details) => {
                        database_info = details.database_info;
                        Ok(details.message)
                    }
                    Err(err) => Err(err),
                }
            }
            DatabaseType::PrestoSql => {
                let jdbc_config = prestosql_jdbc_config_for_endpoint(&config, &host, port);
                match state.test_external_driver_with_info("jdbc", &jdbc_config).await {
                    Ok(details) => {
                        database_info = details.database_info;
                        Ok(details.message)
                    }
                    Err(err) => Err(err),
                }
            }
            DatabaseType::Jdbc => {
                let mut jdbc_config = config.clone();
                if host != config.host || port != config.port {
                    if let Some(ref url) = jdbc_config.connection_string {
                        jdbc_config.connection_string = Some(rewrite_jdbc_url_host(url, &host, port));
                    }
                }
                match state.test_external_driver_with_info("jdbc", &jdbc_config).await {
                    Ok(details) => {
                        database_info = details.database_info;
                        Ok(details.message)
                    }
                    Err(err) => Err(err),
                }
            }
            db_type => Err(format!("Unsupported database type: {db_type:?}")),
        },
    };

    if has_transport_layers {
        state.reset_connection_transport_for_config(&tunnel_id, &config).await;
    }

    result.map(|message| ConnectionTestResult::success(message).with_database_info(database_info))
}

#[tauri::command]
pub async fn connect_db(
    state: State<'_, Arc<AppState>>,
    config: ConnectionConfig,
    client_attempt: Option<u64>,
) -> Result<String, String> {
    let config = config.canonicalized();
    if config.db_type == DatabaseType::Sqlite {
        db::sqlite::validate_persistent_attachments(
            &config.host,
            &config.password,
            !config.attached_databases.is_empty(),
        )?;
    }
    let id = config.id.clone();
    let db_config = metadata_connection_config(&config);
    let attempt = state.begin_connection_attempt_with_client_attempt(&id, client_attempt).await;
    let mut connected_config = config.clone();
    let mut connected_db_config = db_config.clone();

    state.remove_connection_pools_detached(&id).await;
    state.reset_connection_transport_for_config(&id, &db_config).await;

    let (host, port) = state.connection_host_port(&id, &db_config).await?;
    if let Err(err) = state.ensure_current_connection_attempt(&id, Some(attempt)).await {
        state.reset_connection_transport_for_config(&id, &db_config).await;
        return Err(err);
    }
    probe_connection_endpoint(&db_config, &host, port).await?;
    if let Err(err) = state.ensure_current_connection_attempt(&id, Some(attempt)).await {
        state.reset_connection_transport_for_config(&id, &db_config).await;
        return Err(err);
    }
    let url = connection_url_for_endpoint(&db_config, &host, port);
    let connect_timeout = std::time::Duration::from_secs(db_config.effective_connect_timeout_secs());
    let idle_timeout = std::time::Duration::from_secs(db_config.idle_timeout_secs);
    let gaussdb_m_jdbc_config = gaussdb_m_jdbc_command_config(&db_config, &host, port);

    let pool = match db_config.db_type {
        DatabaseType::Mysql => {
            let (pool, mode) =
                connect_mysql_metadata_pool(&config, &db_config, &host, port, connect_timeout, 3).await?;
            PoolKind::Mysql(pool, mode)
        }
        DatabaseType::Doris | DatabaseType::StarRocks | DatabaseType::ManticoreSearch => PoolKind::Mysql(
            connect_bare_metadata_pool(&db_config, &host, port, connect_timeout, 3).await?,
            MysqlMode::Bare,
        ),
        DatabaseType::Gaussdb if gaussdb_m_jdbc_config.is_some() => {
            state.external_driver_pool("jdbc", gaussdb_m_jdbc_config.as_ref().expect("checked above")).await?
        }
        DatabaseType::Postgres
        | DatabaseType::Redshift
        | DatabaseType::Gaussdb
        | DatabaseType::Kwdb
        | DatabaseType::Questdb
        | DatabaseType::OpenGauss => PoolKind::Postgres(db::postgres::connect(&url, connect_timeout).await?),
        DatabaseType::Sqlite => PoolKind::Sqlite(connect_sqlite_from_config(&db_config).await?),
        DatabaseType::Redis => {
            let con = if db_config.uses_redis_cluster() {
                PoolKind::Redis(db::redis_driver::RedisConnection::Cluster(
                    state.connect_redis_cluster(&id, &db_config).await?,
                ))
            } else if db_config.uses_redis_sentinel() {
                PoolKind::Redis(db::redis_driver::RedisConnection::Direct(tokio::sync::Mutex::new(
                    state.connect_redis_sentinel(&id, &db_config).await?,
                )))
            } else {
                PoolKind::Redis(db::redis_driver::RedisConnection::Direct(tokio::sync::Mutex::new(
                    db::redis_driver::connect_standalone(&db_config, &host, port, connect_timeout).await?,
                )))
            };
            con
        }
        #[cfg(feature = "duckdb-sidecar")]
        DatabaseType::DuckDb => state.create_duckdb_pool(&db_config).await?,
        #[cfg(not(feature = "duckdb-sidecar"))]
        DatabaseType::DuckDb => return Err("DuckDB support is not compiled in this build".to_string()),
        DatabaseType::MongoDb => {
            if mongo_uses_legacy_driver(&db_config) {
                let mut client =
                    state.agent_manager.spawn(&db_config.db_type, Some(MONGO_LEGACY_DRIVER_PROFILE)).await?;
                state.ensure_current_connection_attempt(&id, Some(attempt)).await?;
                client
                    .connect(mongo_legacy_connect_params(&db_config, &host, port))
                    .await
                    .map_err(|err| mongo_legacy_error_with_auth_hint(&err))?;
                state.ensure_current_connection_attempt(&id, Some(attempt)).await?;
                PoolKind::agent(client)
            } else {
                let native_err = match db::mongo_driver::connect(&url, connect_timeout, idle_timeout).await {
                    Ok(client) => {
                        state.ensure_current_connection_attempt(&id, Some(attempt)).await?;
                        match db::mongo_driver::test_connection(
                            &client,
                            connect_timeout,
                            db_config.effective_database(),
                        )
                        .await
                        {
                            Ok(()) => {
                                state.ensure_current_connection_attempt(&id, Some(attempt)).await?;
                                if let Err(err) = state
                                    .insert_connection_pool_for_attempt(
                                        &id,
                                        attempt,
                                        id.clone(),
                                        PoolKind::MongoDb(client),
                                        &db_config,
                                    )
                                    .await
                                {
                                    state.reset_connection_transport_for_config(&id, &db_config).await;
                                    return Err(err);
                                }
                                state.configs.write().await.insert(id.clone(), config);
                                return Ok(id);
                            }
                            Err(e) => e,
                        }
                    }
                    Err(e) => e,
                };
                if should_retry_mongo_with_legacy_driver(&native_err) {
                    log::info!("Native MongoDB driver failed ({native_err}), falling back to agent driver");
                    let mut client =
                        state.agent_manager.spawn(&db_config.db_type, Some(MONGO_LEGACY_DRIVER_PROFILE)).await?;
                    state.ensure_current_connection_attempt(&id, Some(attempt)).await?;
                    client.connect(mongo_legacy_connect_params(&db_config, &host, port)).await.map_err(|err| {
                        format!(
                            "{native_err}\n\nFallback with MongoDB (Legacy) driver failed: {}",
                            mongo_legacy_error_with_auth_hint(&err)
                        )
                    })?;
                    state.ensure_current_connection_attempt(&id, Some(attempt)).await?;
                    mark_mongo_legacy_driver(&mut connected_config);
                    connected_db_config = metadata_connection_config(&connected_config);
                    persist_mongo_legacy_driver_profile(state.inner(), &connected_config).await?;
                    PoolKind::agent(client)
                } else {
                    return Err(native_err);
                }
            }
        }
        DatabaseType::ClickHouse => {
            let username = if db_config.username.is_empty() { None } else { Some(db_config.username.clone()) };
            let password = if db_config.password.is_empty() { None } else { Some(db_config.password.clone()) };
            log::info!("[connect_db] ClickHouse url={url} user={:?} has_pass={}", username, password.is_some());
            let client = db::clickhouse_driver::ChClient::new_with_ca_cert(
                &url,
                username,
                password,
                Some(&db_config.ca_cert_path),
                db_config.url_params.as_deref(),
                connect_timeout,
            )?;
            db::clickhouse_driver::test_connection(&client, connect_timeout).await?;
            PoolKind::ClickHouse(client)
        }
        DatabaseType::SqlServer => state.connect_sqlserver_pool(&db_config, &host, port, connect_timeout).await?,
        DatabaseType::Elasticsearch => {
            let mut client = db::elasticsearch_driver::EsClient::from_config(
                &url,
                Some(&db_config.username),
                Some(&db_config.password),
                db_config.ssl,
                db_config.url_params.as_deref(),
                db_config.external_config.as_ref(),
                connect_timeout,
            );
            db::elasticsearch_driver::test_connection(&mut client, connect_timeout).await?;
            PoolKind::Elasticsearch(client)
        }
        DatabaseType::Easysearch => {
            let mut client = db::easysearch_driver::EasysearchClient::from_config(
                &url,
                Some(&db_config.username),
                Some(&db_config.password),
                db_config.ssl,
                db_config.url_params.as_deref(),
                db_config.external_config.as_ref(),
                connect_timeout,
            );
            db::easysearch_driver::test_connection(&mut client, connect_timeout).await?;
            PoolKind::Easysearch(client)
        }
        DatabaseType::Hbase => {
            let client = db::hbase_driver::HBaseClient::new(
                &url,
                Some(&db_config.username),
                Some(&db_config.password),
                false,
                connect_timeout,
            )?;
            db::hbase_driver::test_connection(&client, connect_timeout).await?;
            PoolKind::HBase(client)
        }
        DatabaseType::Qdrant | DatabaseType::Milvus | DatabaseType::Weaviate | DatabaseType::ChromaDb => {
            let kind = match db_config.db_type {
                DatabaseType::Qdrant => db::vector_driver::VectorDbKind::Qdrant,
                DatabaseType::Milvus => db::vector_driver::VectorDbKind::Milvus,
                DatabaseType::Weaviate => db::vector_driver::VectorDbKind::Weaviate,
                DatabaseType::ChromaDb => db::vector_driver::VectorDbKind::ChromaDb,
                _ => unreachable!(),
            };
            let client = db::vector_driver::VectorClient::new(
                kind,
                &url,
                Some(&db_config.username),
                Some(&db_config.password),
                db_config.ssl,
                connect_timeout,
            );
            db::vector_driver::test_connection(&client, connect_timeout).await?;
            PoolKind::VectorDb(client)
        }
        DatabaseType::Rqlite => {
            let client = db::rqlite_driver::RqliteClient::new(
                &url,
                db_config.url_params.as_deref(),
                &db_config.username,
                &db_config.password,
                db_config.ssl,
                connect_timeout,
            )?;
            db::rqlite_driver::test_connection(&client, connect_timeout).await?;
            PoolKind::Rqlite(client)
        }
        DatabaseType::Turso => {
            let auth_token = if !db_config.password.is_empty() {
                db_config.password.clone()
            } else {
                db_config
                    .url_params
                    .as_deref()
                    .and_then(|p| {
                        p.trim()
                            .trim_start_matches('?')
                            .split('&')
                            .filter_map(|pair| pair.split_once('='))
                            .find(|(key, _)| {
                                let k = key.trim().to_ascii_lowercase();
                                k == "auth_token" || k == "authtoken" || k == "auth-token"
                            })
                            .map(|(_, value)| value.trim().to_string())
                    })
                    .unwrap_or_default()
            };
            let client = db::turso_driver::TursoClient::new(&url, &auth_token, db_config.ssl, connect_timeout)?;
            db::turso_driver::test_connection(&client, connect_timeout).await?;
            PoolKind::Turso(client)
        }
        DatabaseType::CloudflareD1 => {
            PoolKind::CloudflareD1(db::cloudflare_d1_driver::connect(&db_config, connect_timeout).await?)
        }
        DatabaseType::InfluxDb => {
            let client = db::influxdb_driver::InfluxdbClient::new_for_config(&url, &db_config, connect_timeout)?;
            db::influxdb_driver::test_connection(&client, connect_timeout).await?;
            PoolKind::InfluxDb(client)
        }
        DatabaseType::Nacos => {
            let admin_config = state.nacos_admin_config_for_connection(&id, &config).await?;
            let adapter = state.nacos_registry.build_transient_config(admin_config).await?;
            adapter.test_connection().await?;
            PoolKind::Nacos
        }
        #[cfg(feature = "mq-admin")]
        DatabaseType::MessageQueue => {
            let mqc = state.mq_admin_config_for_connection(&id, &config).await?;
            let agent_launch = dbx_core::mq::service::resolve_mq_agent_launch_spec(&mqc, &state);
            let adapter = match state.mq_registry.get_or_build_config(&id, mqc, agent_launch).await {
                Ok(adapter) => adapter,
                Err(err) => {
                    state.mq_registry.drop_connection(&id).await;
                    return Err(err);
                }
            };
            if let Err(err) = state.ensure_current_connection_attempt(&id, Some(attempt)).await {
                state.mq_registry.drop_connection(&id).await;
                return Err(err);
            }
            if let Err(err) = adapter.test_connection().await {
                state.mq_registry.drop_connection(&id).await;
                return Err(err);
            }
            if let Err(err) = state.ensure_current_connection_attempt(&id, Some(attempt)).await {
                state.mq_registry.drop_connection(&id).await;
                return Err(err);
            }
            PoolKind::MessageQueue
        }
        #[cfg(not(feature = "mq-admin"))]
        DatabaseType::MessageQueue => {
            return Err(
                "Message queue admin support is not compiled in this build. Rebuild with the 'mq-admin' feature."
                    .to_string(),
            );
        }
        db_type if database_capabilities::is_agent_type(&db_type) => {
            connect_agent_pool(state.inner(), &db_config, &host, port).await?
        }
        DatabaseType::PrestoSql => {
            let jdbc_config = prestosql_jdbc_config_for_endpoint(&db_config, &host, port);
            state.external_driver_pool("jdbc", &jdbc_config).await?
        }
        DatabaseType::Jdbc => state.external_driver_pool("jdbc", &db_config).await?,
        db_type => return Err(format!("Unsupported database type: {db_type:?}")),
    };

    if let Err(err) =
        state.insert_connection_pool_for_attempt(&id, attempt, id.clone(), pool, &connected_db_config).await
    {
        state.reset_connection_transport_for_config(&id, &connected_db_config).await;
        return Err(err);
    }
    state.configs.write().await.insert(id.clone(), connected_config);

    Ok(id)
}

#[tauri::command]
pub async fn connection_final_proxy_port(
    state: State<'_, Arc<AppState>>,
    config: ConnectionConfig,
) -> Result<u16, String> {
    let runtime_config = config.canonicalized();
    if !runtime_config.has_effective_transport_layers() {
        return Err("Connection has no configured transport layers".to_string());
    }
    if runtime_config.db_type == DatabaseType::Sqlite {
        db::sqlite::validate_persistent_attachments(
            &runtime_config.host,
            &runtime_config.password,
            !runtime_config.attached_databases.is_empty(),
        )?;
    }

    let connection_id = runtime_config.id.clone();
    let db_config = metadata_connection_config(&runtime_config);
    state.configs.write().await.insert(connection_id.clone(), runtime_config);

    let (_, port) = state.connection_host_port(&connection_id, &db_config).await?;
    Ok(port)
}

#[tauri::command]
pub async fn disconnect_db(
    state: State<'_, Arc<AppState>>,
    connection_id: String,
    client_attempt: Option<u64>,
) -> Result<(), String> {
    let should_disconnect = if let Some(client_attempt) = client_attempt {
        state.supersede_connection_attempt_if_client_attempt(&connection_id, client_attempt).await
    } else {
        state.supersede_connection_attempt(&connection_id).await;
        true
    };
    if !should_disconnect {
        return Ok(());
    }
    state.running_queries.cancel_connection(&connection_id);
    state.remove_connection_pools_detached(&connection_id).await;
    drop_nacos_adapters_for_connection_ids(state.inner(), std::slice::from_ref(&connection_id)).await;
    drop_mq_adapters_for_connection_ids(state.inner(), std::slice::from_ref(&connection_id)).await;
    state.reset_connection_transport(&connection_id).await;
    if connection_id.starts_with("__visible_draft_") || connection_id.starts_with("__visible_schema_draft_") {
        state.configs.write().await.remove(&connection_id);
    }
    Ok(())
}

#[tauri::command]
pub async fn close_database_connection(
    state: State<'_, Arc<AppState>>,
    connection_id: String,
    database: String,
) -> Result<bool, String> {
    let database = database.trim();
    let database = if database.is_empty() { None } else { Some(database) };
    state.close_database_pool(&connection_id, database).await
}

#[tauri::command]
pub async fn refresh_connections(state: State<'_, Arc<AppState>>) -> Result<(), String> {
    state.refresh_connections().await;
    Ok(())
}

#[tauri::command]
pub async fn check_connection_health(state: State<'_, Arc<AppState>>, connection_id: String) -> Result<(), String> {
    state.check_connection_health(&connection_id).await
}

#[tauri::command]
pub async fn connection_identifier_quote(
    state: State<'_, Arc<AppState>>,
    connection_id: String,
    database: Option<String>,
) -> Result<Option<String>, String> {
    state.connection_identifier_quote(&connection_id, database.as_deref()).await
}

#[tauri::command]
pub async fn connection_database_info(
    state: State<'_, Arc<AppState>>,
    connection_id: String,
    database: Option<String>,
) -> Result<Option<DatabaseConnectionInfo>, String> {
    state.connection_database_info(&connection_id, database.as_deref()).await
}

#[tauri::command]
pub async fn save_connection_database_info(
    state: State<'_, Arc<AppState>>,
    connection_id: String,
    database_info: Option<DatabaseConnectionInfo>,
) -> Result<(), String> {
    state.save_connection_database_info(&connection_id, database_info).await
}

/// Check whether a connection has read-only protection enabled.
/// Returns an error if the connection is read-only, preventing write operations.
pub async fn ensure_connection_writable(
    state: &Arc<AppState>,
    connection_id: &str,
    action: &str,
) -> Result<(), String> {
    if let Some(name) = dbx_core::query::connection_readonly_name(state, connection_id).await {
        return Err(format!(
            "Read-only mode: connection '{}' has read-only protection enabled. {} blocked.",
            name, action
        ));
    }
    Ok(())
}