* Added posibility to bypass oidc authentication for certain endpoints
* fixxed missing .clone()
* Fixxed oidc_skip_endpoints not being optional
* feat(oidc): Introduce protected path prefixes
This commit replaces the OIDC endpoint blacklist with a path prefix whitelist. This is a more intuitive and secure approach for managing protected routes.
The new `oidc_protected_paths` configuration option allows users to specify a list of URL prefixes that require OIDC authentication. By default, all paths are protected.
The documentation has been updated to reflect this change, with clear examples and more user-friendly language.
* docs(oidc): Improve OIDC documentation and examples
This commit improves the OIDC documentation and the "single sign on"
example to better demonstrate how to create a selective login system.
The main documentation now includes a section on creating a public
login page and the "single sign on" example has been updated to
reflect this pattern.
* Simplify OIDC middleware request handling for unprotected paths
* docs(oidc): Improve single sign on example
This commit improves the "single sign on" example to better
demonstrate a public information page that adapts to the users
login status and a separate protected page.
* docs(oidc): Document oidc_protected_paths in configuration.md
This commit updates the main configuration documentation to reflect the
new `oidc_protected_paths` option. It removes the outdated
`oidc_skip_endpoints` and provides a more detailed explanation of how
to create a mix of public and private pages.
* Improve SSO demo UX
- Update docker compose command to use `--watch` flag - Add watch
configuration for SQLPage development - Enhance login page with hero
component and better styling - Simplify protected page welcome message -
Fix OIDC middleware path check logic - Update protected paths in config
to use `/protected` instead of `/protected.sql`
* Skip OIDC auth for non-protected paths later in middleware
We still want to be able to access authenticated user's info in
non-authenticated parts of the app.
We crucially need to check request.path() == SQLPAGE_REDIRECT_URI before
the protected_paths check
* Added whitelist option
* Update configuration.md
* Improve OIDC public paths documentation
The documentation now provides clearer examples and explains the
interaction between public and protected paths more precisely. Also
removes the now-unused default_oidc_public_paths function since the
field's default is handled by serde's default for Vec.
* Add OidcConfig method to check public paths
The new `is_public_path` method consolidates the logic for checking if a
path should bypass OIDC authentication. This replaces the previous
inline checks for public and protected paths.
* fix default empty public paths
* Update SSO example with new image path and public access rules
- Change hero image path in login page - Remove protected.sql as it's no
longer needed - Update sqlpage.yaml to allow public access to
/protected/public
---------
Co-authored-by: Lenardt Gerhardts <lenardt.gerhardts@obi.de>
Co-authored-by: lovasoa <contact@ophir.dev>
* Extend CSP Configuration to handle user-supplied values that can contain {NONCE}
* fix RequestContext to use CSP value from AppConfig
* update documentation to describe usage
* generate nonce per request; config is a string (again); added playwright test to verify subsequent requests return a different nonce.
* fix js lint `let` -> `const`
* format
* remove some useless string copies
we are still re-parsing the csp template on every request
* implement a proper csp template struct
* parse the content-security-policy just once
* fix merge issue.
* fix docs
* fix docs
* clippy
---------
Co-authored-by: lovasoa <contact@ophir.dev>
* add oidc config variables
* setup a basic middleware
* implement an async http client that uses oidc
* initialize provider_metadata in OidcService
* better error handling in oidc config
* HTTP client initialization in oidc now follows global config
* oidc: implement redirects
- Add `host` configuration option for specifying the application's web address in configuration.md and app_config.rs.
- Update docker-compose.yaml to include SQLPAGE_HOST and SQLPAGE_OIDC_ISSUER_URL environment variables.
- Enhance OIDC middleware to utilize the new `host` setting for redirect URLs and improve cookie handling in oidc.rs.
* improve local oidc configurability
* log
* Update warning message in OIDC configuration to clarify how to disable it by providing a host setting
* Update OIDC redirect logging to use info level with client ID
* Refactor unauthenticated request handling in OIDC service
- Extracted logic for handling unauthenticated requests into a separate method `handle_unauthenticated_request`.
- Updated the main request handling flow to utilize the new method for improved readability and maintainability.
* Enhance OIDC service with callback handling and token processing
- Introduced `handle_oidc_callback` method to manage OIDC callback requests.
- Added `process_oidc_callback` and `exchange_code_for_token` methods for token exchange logic.
- Updated `handle_unauthenticated_request` to check for callback URL and redirect accordingly.
- Refactored `build_redirect_response` to improve clarity in response handling.
* in handle_oidc_callback use service_request.into_response
* fmt
* Implement oidc code exchange and token storage
* validate oidc cookies
- Updated `get_sqlpage_auth_cookie` to return a result for better error handling and validation of the SQLPage auth cookie.
- Improved logging throughout the OIDC service for better traceability of requests and responses.
- Adjusted the handling of OIDC callback parameters to include context in error messages.
* OIDC callback: redirect to the auth URL on failure.
* oidc use localhost for redirect config instead of 0.0.0.0 by default
* Enhance OIDC provider metadata discovery with improved logging and error context
* maintain the initial URL during OIDC authentication
- Added state cookie handling to maintain the initial URL during OIDC authentication.
- Refactored `build_auth_url` to accept the initial URL as a parameter.
- Enhanced `process_oidc_callback` to retrieve the state from the cookie and redirect accordingly.
* implement csrf token
* update deps
* update sso examples
* nonce verification
- Improved error logging for invalid auth cookies and ID token verification.
- Introduced nonce verification logic to ensure security during OIDC authentication.
- Adjusted parameters for nonce hashing to optimize for short-lived tokens.
* Refactor OIDC logging and improve documentation
- Updated logging statements for better clarity and context.
- Refactored code for nonce verification and error handling.
- Enhanced documentation in `app_config.rs` for clarity on `https_domain` usage.
* Remove unused app_state field from OidcService struct
* Enhance OIDC client error handling and refactor HTTP request types
- Added context to OIDC client creation error handling.
- Updated HTTP request and response types for better integration with the openidconnect library.
- Introduced AwcWrapperError for improved error management in HTTP calls.
* clippy fixes
- Changed http_client from Arc to Rc in OidcService for improved memory efficiency.
- Updated related code to reflect the new ownership model for the HTTP client.
* initialize the oidc and http clients only once
- Added OidcState struct to encapsulate OIDC configuration and client.
- Refactored OidcMiddleware to utilize OidcState for improved state management.
- Updated HTTP client handling in OIDC service methods for better integration with app data.
- Enhanced logging for OIDC middleware initialization and request processing.
* functions for accessing user claims from OIDC tokens + documentation
- Updated SQLPage authentication component documentation for clarity on usage and options.
- Removed deprecated login and redirect handler scripts to streamline the SSO implementation.
- Enhanced logout functionality to properly clear session cookies and redirect users.
- Improved request handling to include OIDC claims in the request context for better user information retrieval.
* better sso troubleshooting info
* fmt
* add sso to the changelog
This specifies a path to a UNIX socket file to listen on instead of the TCP port.
If specified, SQLPage will accept HTTP connections only on this socket and not on any TCP port. This option is mutually exclusive with the `listen_on` and `port` options.
Useful when running SQLpage behind a proxy server like Nginx, as the overhead for communication using Unix Domain Sockets is less than when using the TCP stack.
* Fix typo
* Add default values for different RDBMS
I optimized for a nicer looking rendered table, but the not rendered
one looks slightly less beautiful now.
* document future file functions
* make forms multipart when they contain a file field
* extract http request data reading logic
* start work on file upload
* multipart post data parsing
* millisecond precision in logs
* implement customizable upload file size limits
* wip: add file handling functions
* file handling pseudo-functions
* clippy
* fmt
add the ability to create a `sqlpage/on_connect.sql` file that will be run every time a new database connection is opened.
This has many interesting applications, see configuration.md
See https://github.com/lovasoa/SQLpage/discussions/48
This is a game changer and allows many new usecases that were previously impossible:
sending emails, querying external APIs, integrating with external providers, launching custom scripts, and much more.
lovasoa