Method handleQuery

server/conn.go:1194–1506

(body []byte)

			c.sendError("FATAL", "28000", "no user specified")
			return fmt.Errorf("no user specified")
		}

		break
	}

	// Request password
	if err := wire.WriteAuthCleartextPassword(c.writer); err != nil {
		return err
	}
	if err := c.flushWriter(); err != nil {
		return fmt.Errorf("failed to flush writer: %w", err)
	}

	// Read password response
	msgType, body, err := wire.ReadMessage(c.reader)
	if err != nil {
		return err
	}

	if msgType != wire.MsgPassword {
		c.sendError("FATAL", "28000", "expected password message")
		return fmt.Errorf("expected password message, got %c", msgType)
	}

	// Password is null-terminated
	password := string(bytes.TrimRight(body, "\x00"))

	// Validate password (constant-time; does not leak whether the user exists)
	if !auth.ValidateUserPassword(c.server.cfg.Users, c.username, password) {
		// Record failed authentication attempt
		banned := c.server.rateLimiter.RecordFailedAuth(c.conn.RemoteAddr())
		if banned {
			c.logger().Warn("IP banned after too many failed auth attempts.", "remote_addr", c.conn.RemoteAddr())
		}
		c.sendError("FATAL", "28P01", "password authentication failed")
		return fmt.Errorf("authentication failed for user %q", c.username)
	}

	// Record successful authentication (clears failed attempt counter)
	c.server.rateLimiter.RecordSuccessfulAuth(c.conn.RemoteAddr())

	// Send auth OK
	if err := wire.WriteAuthOK(c.writer); err != nil {
		return err
	}

	c.logger().Info("User authenticated.", "remote_addr", c.conn.RemoteAddr())
	return nil
}

func (c *clientConn) sendInitialParams() {
	params := map[string]string{
		"server_version":              "15.0 (Duckgres)",
		"server_encoding":             "UTF8",
		"client_encoding":             "UTF8",
		"DateStyle":                   "ISO, MDY",
		"TimeZone":                    "UTC",
		"integer_datetimes":           "on",