-- broker.broker_set
-- Minimal whitelist of session options. The previous SET SESSION AUTHORIZATION
-- and search_path branches were removed: they let a caller assume an arbitrary
-- Postgres role or schema search order from inside a plpgsql function with no
-- identity model behind it, which is unsafe and was unused.

CREATE OR REPLACE FUNCTION broker.broker_set(
    p_option_name TEXT,
    p_option_value TEXT,
    OUT p_retval INTEGER,
    OUT p_errmsg TEXT
)
RETURNS RECORD
LANGUAGE plpgsql
AS $$
DECLARE
    v_sql TEXT;
BEGIN
    p_retval := 0;
    p_errmsg := '';

    IF p_option_name IS NULL OR p_option_name = '' THEN
        p_retval := 1;
        p_errmsg := 'Option name is required';
        RETURN;
    END IF;

    CASE LOWER(p_option_name)
        WHEN 'application_name' THEN
            BEGIN
                v_sql := format('SET LOCAL application_name TO %L', p_option_value);
                EXECUTE v_sql;
            EXCEPTION
                WHEN OTHERS THEN
                    p_retval := 3;
                    p_errmsg := format('Failed to set application_name: %s', SQLERRM);
                    RETURN;
            END;

        WHEN 'timezone' THEN
            BEGIN
                v_sql := format('SET LOCAL timezone TO %L', p_option_value);
                EXECUTE v_sql;
            EXCEPTION
                WHEN OTHERS THEN
                    p_retval := 5;
                    p_errmsg := format('Failed to set timezone: %s', SQLERRM);
                    RETURN;
            END;

        ELSE
            p_retval := 10;
            p_errmsg := format('Unknown option: %s', p_option_name);
            RETURN;
    END CASE;

EXCEPTION
    WHEN OTHERS THEN
        p_retval := 99;
        p_errmsg := SQLERRM;
        RAISE WARNING 'broker_set error: %', SQLERRM;
END;
$$;

COMMENT ON FUNCTION broker.broker_set IS 'Sets a whitelisted session-local option (application_name, timezone)';