Add pluggable storage backend abstraction (vtable) to the database layer,
allowing selection between SQLite (default) and a new flat-file backend
that stores messages as human-readable plain text files.

New files:
- database_sqlite.c: extracted SQLite backend from database.c
- database_flatfile.c: plain text backend with tolerant parser,
  LMC correction chains, UTF-8/BOM/CRLF handling, integrity checks

Commands:
- /privacy logging flatfile — switch to flat-file backend
- /history verify [<jid>] — check integrity of stored history

Fixes:
- Add missing 'off' guard in flatfile backend
- Enable CHLOG/HISTORY prefs when switching to flatfile mode

Logs stored in ~/.local/share/profanity/flatlog/{account}/{contact}/{date}.log
Format: {ISO8601} [{type}|{enc}|id:{id}|corrects:{id}] {sender}: {message}

Updated: CHANGELOG, CONTRIBUTING.md, profrc.example, man page, cmd_defs,
Makefile.am, test stubs, functional test support (PROF_FLATFILE=1)

@@ -188,3 +197,2 @@
 	tests/functionaltests/test_lastactivity.c tests/functionaltests/test_lastactivity.h \
-	tests/functionaltests/test_autoping.c tests/functionaltests/test_autoping.h \
-	tests/functionaltests/test_disco.c tests/functionaltests/test_disco.h \
+        tests/functionaltests/test_autoping.c tests/functionaltests/test_autoping.h \

@@ -97,2 +97,2 @@
-PKG_CHECK_MODULES([SQLITE], [sqlite3 >= 3.22.0], [],
-    [AC_MSG_ERROR([sqlite3 3.22.0 or higher is required])])
+### sqlite (optional — can be disabled with --without-sqlite)
+AC_ARG_WITH([sqlite],

@@ -198,3 +198,3 @@
 is stored in
 .I $XDG_CONFIG_HOME/profanity/profrc
-, details on commands for configuring Profanity can be found at <https://profanity-im.github.io/reference.html> or the respective built\-in help or man pages.
+, details on commands for configuring Profanity can be found at <https://profanity-im.github.io/reference.html> or the respective built\-in help or man pages..SS Message History Storage

@@ -49,6 +49,13 @@ grlog=true
 maxsize=1048580
 rotate=true
 shared=true
+# Database backend for message history:

@@ -1888,2 +1896,3 @@
       CMD_ARGS(
-              { "on|off", "Enable or disable showing chat history." })
+              { "on|off", "Enable or disable showing chat history." },
+              { "switch sqlite|flatfile", "Switch the active database backend at runtime." },

@@ -1889,1 +1897,3 @@
-              { "on|off", "Enable or disable showing chat history." })
+              { "on|off", "Enable or disable showing chat history." },
+              { "switch sqlite|flatfile", "Switch the active database backend at runtime." },
+              { "verify [<jid>]", "Verify integrity of message history. Optionally specify a JID to check only one contact." },

@@ -2719,3 +2731,3 @@
               CMD_TAG_DISCOVERY)
       CMD_SYN(
-              "/privacy logging on|redact|off",
+              "/privacy logging on|redact|off|flatfile",

@@ -6687,2 +6687,4 @@
             cons_show("Messages are going to be redacted.");
             prefs_set_string(PREF_DBLOG, arg);
+        } else if (g_strcmp0(arg, "flatfile") == 0) {
+            cons_show("Using flat-file backend for message logging. Takes effect on next connection.");

@@ -6733,0 +6738,4 @@
+    if (g_strcmp0(args[0], "switch") == 0) {
+        jabber_conn_status_t conn_status = connection_get_status();
+        if (conn_status != JABBER_CONNECTED) {
+            cons_show_error("You must be connected to switch database backend.");

@@ -6733,0 +6747,4 @@
+            return TRUE;
+        }
+
+        if (g_strcmp0(args[1], "sqlite") != 0 && g_strcmp0(args[1], "flatfile") != 0) {

@@ -6733,0 +6795,4 @@
+            }
+            if (issue->line > 0) {
+                if (issue->level == INTEGRITY_ERROR) {
+                    cons_show_error("[%s] %s:%d — %s", level_str, issue->file, issue->line, issue->message);

@@ -252,0 +75,4 @@
+        active_db_backend = db_backend_sqlite();
+        log_info("Using SQLite database backend");
+#else
+        log_info("SQLite not compiled in, falling back to flat-file backend");

@@ -262,0 +105,4 @@
+
+    // Update preference
+    prefs_set_string(PREF_DBLOG, new_backend);
+    prefs_save();

@@ -269,2 +131,2 @@
-    } else {
-        _add_to_db(message, NULL, message->from_jid, connection_get_jid());
+    if (active_db_backend && active_db_backend->add_incoming) {
+        active_db_backend->add_incoming(message);

@@ -0,0 +2,4 @@
+ * database_export.c
+ * vim: expandtab:ts=4:sts=4:sw=4
+ *
+ * Copyright (C) 2026 Profanity Contributors

@@ -0,0 +106,4 @@
+    GDir* dir = g_dir_open(base_dir, 0, &err);
+    if (!dir) {
+        if (err) {
+            log_debug("export: cannot open flatlog dir %s: %s", base_dir, err->message);

@@ -0,0 +109,4 @@
+            log_debug("export: cannot open flatlog dir %s: %s", base_dir, err->message);
+            g_error_free(err);
+        }
+        return NULL;

@@ -0,0 +146,4 @@
+
+    while (1) {
+        gboolean truncated = FALSE;
+        char* buf = ff_readline(fp, &truncated);

@@ -0,0 +334,4 @@
+
+            char* key = _make_dedup_key(sid, ts, from_jid, body);
+            if (g_hash_table_contains(seen_keys, key)) {
+                g_free(key);

@@ -0,0 +387,4 @@
+        if (rename(tmp_path, log_path) != 0) {
+            log_error("export: rename %s -> %s failed: %s", tmp_path, log_path, strerror(errno));
+            unlink(tmp_path);
+        }

@@ -0,0 +401,4 @@
+
+    g_slist_free_full(contacts, g_free);
+    return total_exported;
+}

@@ -0,0 +480,4 @@
+            if (!pl || !pl->timestamp)
+                continue;
+
+            auto_gchar gchar* ts = g_date_time_format_iso8601(pl->timestamp);

@@ -0,0 +520,4 @@
+                }
+            }
+
+            sqlite_be->add_incoming(msg);

@@ -0,0 +531,4 @@
+            }
+            contact_imported++;
+
+            if (contact_imported % 500 == 0) {

@@ -0,0 +546,4 @@
+        cons_show("Imported %s: %d new, %d skipped (already in SQLite)",
+                  contact, contact_imported, contact_skipped);
+        total_imported += contact_imported;
+        total_skipped += contact_skipped;

@@ -0,0 +2,4 @@
+ * database_flatfile.c
+ * vim: expandtab:ts=4:sts=4:sw=4
+ *
+ * Copyright (C) 2026 Profanity Contributors

@@ -0,0 +86,4 @@
+    g_free(state);
+}
+
+// Lightweight ID extraction from a raw log line for the dedup/LMC cache.

@@ -0,0 +115,4 @@
+            } else if (g_str_has_prefix(parts[i], "aid:") && !archive_id) {
+                archive_id = ff_unescape_meta_value(parts[i] + 4);
+            }
+        }

@@ -0,0 +121,4 @@
+
+    // Extract from_jid (needed for stanza_senders map): after "] " before "/" or ": "
+    char* from_jid = NULL;
+    if (stanza_id && *(close + 1) == ' ') {

@@ -0,0 +122,4 @@
+    // Extract from_jid (needed for stanza_senders map): after "] " before "/" or ": "
+    char* from_jid = NULL;
+    if (stanza_id && *(close + 1) == ' ') {
+        const char* sender_start = close + 2;

@@ -0,0 +126,4 @@
+        const char* colonspace = ff_find_unescaped_colonspace(sender_start);
+        if (colonspace) {
+            const char* jid_end = colonspace;
+            for (const char* p = sender_start; p < colonspace; p++) {

@@ -0,0 +160,4 @@
+    int c1 = fgetc(fp);
+    int c2 = fgetc(fp);
+    int c3 = fgetc(fp);
+    if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF) {

@@ -0,0 +196,4 @@
+        // Extract IDs for O(1) dedup/LMC cache
+        _ff_cache_line_ids(state, buf);
+
+        if (msg_count % FF_INDEX_STEP == 0) {

@@ -0,0 +201,4 @@
+            if (space) {
+                char* ts_str = g_strndup(buf, space - buf);
+                GDateTime* dt = g_date_time_new_from_iso8601(ts_str, NULL);
+                if (dt) {

@@ -0,0 +203,4 @@
+                GDateTime* dt = g_date_time_new_from_iso8601(ts_str, NULL);
+                if (dt) {
+                    if (state->n_entries >= state->cap_entries) {
+                        state->cap_entries = state->cap_entries ? state->cap_entries * 2 : 64;

@@ -0,0 +283,4 @@
+        // Extract IDs for O(1) dedup/LMC cache
+        _ff_cache_line_ids(state, buf);
+
+        if (new_count % FF_INDEX_STEP == 0) {

@@ -0,0 +405,4 @@
+{
+    auto_gchar gchar* pref_dblog = prefs_get_string(PREF_DBLOG);
+
+    if (g_strcmp0(pref_dblog, "off") == 0) {

@@ -0,0 +448,4 @@
+    // Open the file with O_NOFOLLOW to prevent symlink attacks,
+    // and O_APPEND for safe concurrent appends.
+    // Try O_CREAT|O_EXCL first to detect new files atomically (no TOCTOU).
+    int fd = open(log_path, O_WRONLY | O_APPEND | O_CREAT | O_EXCL | O_NOFOLLOW,

@@ -0,0 +591,4 @@
+        return;
+
+    const Jid* to_jid = message->to_jid ? message->to_jid : connection_get_jid();
+    const char* type = ff_get_message_type_str(message->type);

@@ -0,0 +604,4 @@
+    // MAM dedup: skip if this stanza-id already exists in the log (XEP-0313 replay)
+    if (message->stanzaid && !message->is_mam) {
+        if (_ff_has_archive_id(contact, message->stanzaid)) {
+            log_error("flatfile: duplicate stanza-id '%s' from %s, skipping",

@@ -0,0 +666,4 @@
+
+// Apply LMC: for messages with corrects:X, find original and replace its text
+static void
+_ff_apply_lmc(GSList* parsed_lines, GSList** result)

@@ -0,0 +2,4 @@
+ * database_flatfile.h
+ * vim: expandtab:ts=4:sts=4:sw=4
+ *
+ * Copyright (C) 2026 Profanity Contributors

@@ -0,0 +120,4 @@
+        int c1 = fgetc(fp);
+        int c2 = fgetc(fp);
+        int c3 = fgetc(fp);
+        if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF) {

@@ -0,0 +114,4 @@
+// This prevents a malicious federated JID like "../../../tmp/pwned" from
+// escaping the log directory tree.
+char*
+ff_jid_to_dir(const char* jid)

@@ -0,0 +424,4 @@
+    // Determine which JID to use for the log file path (the "other" party)
+    const char* contact = NULL;
+    const Jid* myjid = connection_get_jid();
+    if (myjid && myjid->barejid && g_strcmp0(from_barejid, myjid->barejid) == 0) {

@@ -0,0 +187,4 @@
+    if (g_file_test(path, G_FILE_TEST_IS_DIR)) {
+        // Verify it's not a symlink
+        struct stat st;
+        if (g_lstat(path, &st) == 0 && S_ISLNK(st.st_mode)) {

@@ -0,0 +308,4 @@
+        return NULL;
+    GString* out = g_string_sized_new(strlen(val));
+    for (const char* p = val; *p; p++) {
+        if (*p == '\\' && *(p + 1)) {

@@ -0,0 +346,4 @@
+// newline, or NULL on EOF. Sets *truncated=TRUE if the line had no trailing
+// newline at EOF (partial write detection).
+char*
+ff_readline(FILE* fp, gboolean* truncated)

@@ -0,0 +371,4 @@
+            *truncated = FALSE;
+        // Return empty string so caller's loop continues (parse will reject it).
+        // Use malloc() so callers can always use free() consistently.
+        char* empty = malloc(1);

@@ -0,0 +459,4 @@
+    }
+
+    // Escape message body to prevent log injection
+    char* safe_msg = ff_escape_message(message_text);

@@ -0,0 +470,4 @@
+    size_t written = fwrite(full_line->str, 1, to_write, fp);
+    if (written != to_write) {
+        log_error("flatfile: partial write (%zu/%zu)", written, to_write);
+    }

@@ -0,0 +646,4 @@
+
+        // Parse metadata section [...]
+        const char* bracket_end = ff_find_unescaped_char(bracket_start + 1, ']');
+        if (bracket_end) {

@@ -0,0 +652,4 @@
+            // Split by unescaped '|'
+            char** parts = ff_split_meta(meta_content);
+            if (parts) {
+                int i = 0;

@@ -0,0 +38,4 @@
+#include "database_flatfile.h"
+
+GSList*
+ff_verify_integrity(const gchar* const contact_barejid)

@@ -0,0 +43,4 @@
+    GSList* issues = NULL;
+
+    if (!g_flatfile_account_jid) {
+        integrity_issue_t* issue = g_malloc0(sizeof(integrity_issue_t));

@@ -0,0 +95,4 @@
+
+        auto_gchar gchar* filepath = g_strdup_printf("%s/history.log", cdir_path);
+        if (!g_file_test(filepath, G_FILE_TEST_EXISTS))
+            continue;

@@ -0,0 +134,4 @@
+        char* buf = NULL;
+        int lineno = 0;
+        GDateTime* prev_ts = NULL;
+        GHashTable* seen_ids = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);

@@ -0,0 +264,4 @@
+            int b1 = fgetc(fp);
+            int b2 = fgetc(fp);
+            int b3 = fgetc(fp);
+            if (!(b1 == 0xEF && b2 == 0xBB && b3 == 0xBF))

@@ -0,0 +1,966 @@
+/*

@@ -0,0 +128,4 @@
+
+    auto_char char* filename = _get_db_filename(account);
+    if (!filename) {
+        sqlite3_shutdown();

@@ -0,0 +144,4 @@
+
+    int db_version = _get_db_version();
+    if (db_version == latest_version) {
+        return TRUE;

@@ -0,0 +147,4 @@
+        return TRUE;
+    }
+
+    const char* query = "CREATE TABLE IF NOT EXISTS `ChatLogs` ("

@@ -0,0 +7,4 @@
+ *
+ * These tests only exercise the public log_database API through normal
+ * profanity UI operations, so they work with any storage backend.
+ */

@@ -0,0 +1,721 @@
+/*

@@ -0,0 +1104,4 @@
+    int corrections_found = 0;
+
+    while (1) {
+        char* buf = ff_readline(fp, NULL);

@@ -0,0 +1107,4 @@
+        char* buf = ff_readline(fp, NULL);
+        if (!buf)
+            break;
+        if (buf[0] == '#' || buf[0] == '\0') {

@@ -431,3 +173,1 @@
-    sqlite3_finalize(stmt);
-
-    return g_slist_length(*result) != 0 ? DB_RESPONSE_SUCCESS : DB_RESPONSE_EMPTY;
+    return DB_RESPONSE_ERROR;

@@ -448,2 +181,3 @@
     }
-    return NULL;
+    // Fallback: return an empty message with sane defaults
+    ProfMessage* msg = message_init();

@@ -0,0 +63,4 @@
+    // bombs) — second occurrence was silently dropped on import. Hashing
+    // whole body is microseconds of extra work per row.
+    GChecksum* sum = g_checksum_new(G_CHECKSUM_SHA256);
+    g_checksum_update(sum, (const guchar*)(timestamp ? timestamp : ""), -1);

@@ -0,0 +199,4 @@
+Jid*
+jid_create(const gchar* const fulljid)
+{
+    if (!fulljid)