* get_path_segment and is_path_matching sqlpage functions
* Fix for an error in example.
* If a segment in the pattern is ''%d'', it will match any non-empty segment that is an integer. If a segment in the pattern is ''%s'', it will match any non-empty segment in the path
---------
Co-authored-by: Olivier Auverlot <olivier.auverlot@icloud.com>
* add OpenTelemetry distributed tracing support
When OTEL_EXPORTER_OTLP_ENDPOINT is set, enables full tracing pipeline
with OTLP export, W3C traceparent propagation, and spans for HTTP
requests, SQL file execution, DB pool acquire, and query execution.
Falls back to env_logger when unset.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix OTel example: tracing init, Dockerfile, Tempo config
- Fix tracing-log bridge initialization order (set subscriber first,
then LogTracer) to avoid double-set panic
- Add dedicated Dockerfile for example using release profile (avoids
OOM with superoptimized LTO in Docker)
- Use debian:trixie-slim runtime for glibc compatibility
- Fix nginx image to nginx:otel (official image with OTel module)
- Fix nginx.conf: move otel_trace directives into location block
- Pin Tempo to 2.6.1 (latest has partition ring issues in single-node)
- Fix otel-collector exporter alias (otlp → otlp_grpc)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* propagate trace context to PostgreSQL via application_name
After acquiring a DB connection, set the W3C traceparent as the
PostgreSQL application_name (or MySQL session variable). This makes
trace IDs visible in pg_stat_activity and PostgreSQL logs, enabling
direct correlation between Grafana Tempo traces and database-side
monitoring.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* rewrite OTel example README with setup guides for all major providers
Comprehensive documentation covering:
- Step-by-step quick start for the Docker Compose example
- How OpenTelemetry works (spans, collectors, backends)
- Setup guides for Grafana Tempo, Jaeger, Grafana Cloud, Datadog,
Honeycomb, New Relic, and Axiom with exact env vars and doc links
- PostgreSQL trace correlation via application_name
- Environment variable reference
- Troubleshooting section
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix todo example: use :title (POST variable) instead of $title
The form submits via POST, so the title field must be referenced with
the : prefix (POST parameter) rather than $ (GET parameter).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* set code.filepath and code.lineno span attributes to user SQL files
OTel span attributes now reference the user's .sql file path and line
number instead of the SQLPage Rust source code. Also improves span
naming, adds JSON log formatting, custom root span builder, and
Grafana dashboard provisioning for the OTel example.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* npm run fix
* use stable OTel semantic convention attribute names
- code.filepath → code.file.path, code.lineno → code.line.number
- db.statement → db.query.text, db.system → db.system.name
- Disable auto code location (.with_location(false)) so spans
reference user SQL files, not SQLPage Rust source
- Remove redundant sqlpage.file attribute (code.file.path suffices)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* use OTel semantic convention values for db.system.name
Use well-known values from the OpenTelemetry registry instead of raw
DBMS name strings. Cast line numbers to i64 for correct span recording.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* remove json-subscriber dependency
The custom logfmt layer in telemetry.rs replaces it with zero extra
dependencies and precise control over field selection and ordering.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add Loki + Promtail log aggregation to OTel example
Adds two new services (Loki, Promtail) to scrape SQLPage container logs
and display them in Grafana alongside traces. The home dashboard now
shows a logs panel with trace_id derived fields linking to Tempo.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add OTel spans for request parsing, rendering, sqlpage functions, and OIDC
Add targeted spans to account for previously untraced time:
- http.parse_request: request/form parsing before SQL execution
- render: template rendering and response streaming
- subprocess: sqlpage.exec() with process.command attribute
- http.client: sqlpage.fetch()/fetch_with_meta() with OTel HTTP client
semantic conventions (http.request.method, url.full, http.response.status_code)
- sqlpage.file: sqlpage.run_sql() nested file execution
- oidc.callback + http.client: OIDC token exchange
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add oidc.jwt.verify span for OIDC token verification
This span covers JWT signature verification and claims validation,
which runs on every authenticated request via get_token_claims().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add enduser.id attribute to oidc.jwt.verify span
Records the OIDC subject claim (sub) as enduser.id after successful
JWT verification, following OTel semantic conventions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add OTel user.* attributes to oidc.jwt.verify span
Record user.id (sub), user.name (preferred_username), user.full_name
(name), and user.email from OIDC claims after JWT verification.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add sqlpage.file.load span and attributes to http.parse_request
The gap before http.parse_request was the SQL file cache lookup -
now covered by the sqlpage.file.load span with code.file.path.
http.parse_request now records http.request.method and content_type,
which helps identify slow multipart/form-data parsing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix clippy pedantic warnings
* unify log format: logfmt with colors, no OTel noise
Use the custom logfmt layer for both OTel and non-OTel modes instead
of falling back to env_logger. This eliminates the tracing→log bridge
dumping all span fields (user agents, otel.kind, request_id, etc.)
and only shows: ts, level, target, msg, method, path, status,
file, client_ip, and trace_id (when valid).
Adds terminal color support (bold red for errors, green for info,
dim for timestamps/targets). Emits one log line per completed
successful request. Errors are logged once by the error handler.
Suppresses trace_id=000...0 when no real trace context exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* use .instrument() instead of .entered() for async spans
Span guards from .entered() do not propagate correctly across await
points. Switch to tracing::Instrument to ensure spans are properly
associated with their async tasks throughout their lifetime.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* preserve multi-line error formatting in terminal log output
When stderr is a terminal and the log message contains newlines
(e.g. SQL syntax errors with source highlighting and arrows),
print the metadata on the first line and the message below with
its original formatting. Machine output (non-terminal) remains
single-line logfmt.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* use root Dockerfile for OTel example, add CARGO_PROFILE build arg
Remove the example's custom Dockerfile and use the main one with a
CARGO_PROFILE=release build arg to avoid OOM from fat LTO in
memory-constrained Docker environments. The build scripts now
read CARGO_PROFILE from the environment, defaulting to
superoptimized for backward compatibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add db.query.parameter and db.response.returned_rows span attributes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add official blog post about tracing
* add http.request.body.size and url.query span attributes
Add http.request.body.size to HTTP client spans (fetch, fetch_with_meta)
and to the server-side http.parse_request span (from Content-Length header).
Add url.query to the http.parse_request span.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Replace Promtail with the OpenTelemetry Collector
* Refactor telemetry logging helpers
* Clamp traced fetch body size
* Clamp traced fetch_with_meta body size
* Silence noisy PostgreSQL collector logs
* make startup logs parseable
* update terminal log formats
* Ingest real PostgreSQL logs with trace IDs
* Use raw traceparent for PostgreSQL tracing
* Update opentelemetry example for PostgreSQL query events
* Add nginx logs to opentelemetry example
* Parse nginx error log severity correctly
* Log all span fields when debug logging is enabled
* Rename telemetry example directory
* Fix PostgreSQL Loki log ingestion
* `LOG_LEVEL` is now the primary environment variable for configuring SQLPage's log filter. `RUST_LOG` remains supported as an alias.
* Skip empty trace IDs in logs
* add db errors to otel traces
* add healthcheck
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add optional mode argument to persist_uploaded_file
This change adds an optional `mode` argument to the `persist_uploaded_file` function, allowing users to specify the Unix file permissions in octal notation when saving uploaded files.
- Updated `sqlpage.persist_uploaded_file` signature to include `mode`.
- Implemented permission setting logic using `std::os::unix::fs::PermissionsExt` (on Unix platforms).
- Default permission is set to "600" (octal `0o600`).
- Added documentation for the new parameter in `examples/official-site/sqlpage/migrations/39_persist_uploaded_file.sql`, including an explanation of octal notation and a link to Wikipedia.
- Added a unit test `test_set_file_mode` to verify the permission setting logic.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Address PR feedback: Add integrated test for persist_uploaded_file mode
- Removed unit test from `functions.rs` and added an integrated test in `tests/uploads/mod.rs`.
- Created `tests/uploads/persist_with_mode.sql` for the integrated test.
- Refactored `set_file_mode` to use `#[cfg(unix)]` and `#[cfg(not(unix))]` on the entire function.
- Replied to PR comments.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Fix Windows CI: Normalize paths and improve tests
- Normalized `persist_uploaded_file` return path to use forward slashes for URL compatibility.
- Updated `test_persist_uploaded_file_mode` to handle platform-specific path separators.
- Fixed clippy warning `expect_fun_call` in tests.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Address PR feedback: Assert file contents and ignore test uploads
- Added assertion to verify persisted file contents in `test_persist_uploaded_file_mode`.
- Removed accidental test file from git and added `tests_uploads/` to `.gitignore`.
- Replied to PR comments.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Address PR feedback: Revert breaking change to return value
- Reverted normalization of `persist_uploaded_file` return value to avoid a breaking change.
- Reverted corresponding test changes that relied on normalized paths.
- Replied to PR comments.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Address PR feedback: Query results as JSON in integrated test
- Updated `test_persist_uploaded_file_mode` to directy request and verify JSON results.
- Replied to PR comments.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Fix Windows CI: Robust path handling in tests
- Improved integrated test to correctly request JSON results.
- Added platform-specific path normalization when verifying files on disk.
- Ensured `persist_uploaded_file` return value remains OS-specific to avoid breaking changes.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
* Address PR feedback: Delete leftover test file
- Deleted accidental leftover test file `tests_uploads/2026-03-13_15h47m26s_6JaXODDK.txt`.
- Replied to PR comments.
Co-authored-by: lovasoa <552629+lovasoa@users.noreply.github.com>
---------
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
The `sqlpage.variables()` function previously allowed duplicate keys
when GET, POST, and SET variables of the same name were present. This
commit ensures that the returned JSON object contains only unique keys,
with precedence given to SET variables, then POST, then GET.
* Checkpoint before follow-up message
Co-authored-by: contact <contact@ophir.dev>
* Checkpoint before follow-up message
Co-authored-by: contact <contact@ophir.dev>
* Checkpoint before follow-up message
Co-authored-by: contact <contact@ophir.dev>
* Checkpoint before follow-up message
Co-authored-by: contact <contact@ophir.dev>
* feat: Add OIDC logout functionality
This commit introduces the `oidc_logout_url` function, allowing users to securely log out of OIDC-authenticated applications. It includes CSRF protection and handles redirection to the OIDC provider's logout endpoint.
Co-authored-by: contact <contact@ophir.dev>
* Refactor OIDC logout cookie removal
Co-authored-by: contact <contact@ophir.dev>
* feat: Implement OIDC logout with CSRF protection
This commit implements secure OIDC logout by:
- Using sqlpage.oidc_logout_url() to generate the logout URL.
- Ensuring CSRF protection during the logout process.
- Redirecting to the OIDC provider's logout endpoint.
- Redirecting back to the homepage after logout.
- Adding absolute URI for post logout redirect URI.
* refactor: Enhance build_absolute_uri function to accept scheme parameter
This commit modifies the build_absolute_uri function to include a scheme parameter, allowing for more flexible URL construction. The function now dynamically sets the URL scheme based on the request context, improving compatibility with different environments.
* refactor: Simplify OIDC logout processing and enhance logout token handling
This commit refactors the OIDC logout process by introducing a new function, `parse_logout_params`, to streamline the extraction of logout parameters from the request. It also updates the logout token creation and verification logic, improving security by ensuring the signature is computed correctly. Additionally, the `create_logout_url` function is modified to include a timestamp and signature in the generated URL, enhancing the logout flow's integrity.
* refactor: Improve logout URL generation and parameter parsing
This commit refines the `create_logout_url` function to utilize a query string builder for constructing the logout URL, enhancing readability and maintainability. Additionally, the `parse_logout_params` function is updated to use `Query::into_inner`, streamlining the extraction of logout parameters from the request.
* refactor: Streamline cookie removal in OIDC logout process
This commit simplifies the removal of authentication and nonce cookies during the OIDC logout process by consolidating the cookie removal logic into a single method call for each cookie, enhancing code clarity and maintainability.
* refactor: Enhance cookie removal logic in OIDC logout process
This commit updates the cookie removal process during OIDC logout by utilizing the `Cookie::build` method to specify cookie attributes, improving clarity and ensuring proper cookie handling.
* chore: Update CHANGELOG for version 0.40.1
- Added new function `sqlpage.oidc_logout_url(redirect_uri)` to generate secure logout URLs for OIDC users, supporting RP-Initiated Logout.
- Fixed compatibility issues with Auth0 for OpenID-Connect authentication.
* Support JSON responses via Accept header
* no update in migrations
* No UPDATE in official site migrations
- Updated the JSON component description to clarify its integration with external services and the ability to serve both HTML and JSON based on the HTTP Accept header.
- Added examples demonstrating how to request JSON responses using `curl`.
- Removed the obsolete migration file that documented the JSON response format feature, consolidating information into the main documentation.
* revert stupid docs example change
stupid bot
* simplify tests
* avoid string then json in tests, parse as json directly
* changelog
* feat: Add sqlpage.set_variable function
Co-authored-by: contact <contact@ophir.dev>
* Refactor: Fix set_variable serialization and update tests
Co-authored-by: contact <contact@ophir.dev>
* fix tests: no json_extract on mssql
* Refactor: Update URLParameters handling in set_variable function
- Replaced serde_json::Map with a custom URLParameters struct for better management of URL parameters.
- Introduced methods for handling single and vector values in URLParameters.
- Updated tests to reflect changes in the set_variable function's behavior.
* cargo fmt
* clippy
* retsore set var test
* remove redundant test
* ensure set_variable only takes into account GET variables, not SET
* factor url parameter setting code
* v0.40
* sqlpage.set_variable links to "?" when no parameter is present
- Renamed URLParameters module for clarity and removed the deprecated url_parameter_deserializer.
- Updated the set_variable function to return parameters directly instead of appending to a URL.
- Adjusted related function calls to reflect changes in URL parameter management.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Pagination component
* New pagination component
* Some changes
* Adding a warning about the use of LIMIT and OFFSET in the blog post
* Use icon_img for icons
* Correction of the icons size
* enhance pagination docs examples
* update pagination docs
---------
Co-authored-by: Olivier Auverlot <olivier.auverlot@icloud.com>
Co-authored-by: lovasoa <contact@ophir.dev>
* Adding an alias named contents to the html property of the shell-empty component
* Changes for the shell-empty documentation
* improve shell comoonent description
* shell-empty docs clarification
---------
Co-authored-by: Olivier Auverlot <olivier.auverlot@icloud.com>
Co-authored-by: lovasoa <contact@ophir.dev>
* Make URL and POST parameters immutable, separate from SET variables
- URL and POST parameters are now immutable after request initialization
- SET command creates user-defined variables in separate namespace
- Variable lookup: SET variables shadow request parameters
- Added sqlpage.variables('set') to inspect user-defined variables
- Simplified API: most functions now use &RequestInfo instead of &mut
- All tests passing (151 total)
* Restore deprecation warning for SET on POST variable names
* Restore deprecation warnings for $var accessing POST variables
- Warn when both URL and POST have same variable name
- Warn when $var is used for POST-only variable (should use :var)
* Simplify run_sql: always use clone_without_variables
No need to branch on whether variables are provided since we clone in both cases anyway.
* Revert "Simplify run_sql: always use clone_without_variables"
This reverts commit 60f5a05446.
* Fix cross-database test compatibility for immutable variables
Renamed test to run only on SQLite since json_extract() is SQLite-specific.
Other databases (PostgreSQL, MySQL, MSSQL) have different JSON functions.
* Fix test to work across all databases without json_extract
PostgreSQL doesn't have json_extract, so compare the full JSON string instead.
* Document variable system improvements in CHANGELOG
* Make CHANGELOG more explicit about breaking changes with examples
* Fix CHANGELOG: SET overwrites GET parameters, not POST
* Add database-specific examples for accessing original URL parameters
* wip: perf guide
* update guide
* Add materialized views section to performance guide
- Introduced a new section on materialized views, explaining their purpose and benefits for optimizing analytical queries.
- Added an example SQL statement for creating a materialized view to compute total sales per store.
- Provided guidance on refreshing materialized views manually or via external scripts.
* Document nginx streaming and compression for sqlpage (#1080)
* Docs: Add Nginx streaming and compression configuration
Co-authored-by: contact <contact@ophir.dev>
* Add NGINX streaming and compression configuration
Co-authored-by: contact <contact@ophir.dev>
* Refactor NGINX proxy settings documentation for clarity
Co-authored-by: contact <contact@ophir.dev>
* Refine NGINX proxy buffering recommendations for streaming
Co-authored-by: contact <contact@ophir.dev>
* Update NGINX proxy buffering settings for improved streaming performance
Revised the documentation to clarify the impact of enabling and disabling proxy buffering in NGINX for SQLPage. Added concise recommendations for handling slow SQL queries and emphasized the importance of adjusting `compress_responses` in `sqlpage.json` when using a reverse proxy.
Co-authored-by: contact <contact@ophir.dev>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Update dependencies and version for sqlpage to 0.39.1
- Bump versions of several dependencies including `aho-corasick`, `cc`, `clap`, `icu_collections`, and others to their latest releases.
- Update `Cargo.toml` to reflect the new version of sqlpage.
- Ensure compatibility with updated dependencies and improve overall project stability.
* fix handling of one-element arrays in doc code generator
see https://github.com/sqlpage/SQLPage/issues/1079
* In the table component, allow simple objects in custom_actions instead of requiring arrays of objects.
fix https://github.com/sqlpage/SQLPage/issues/1079
* Implement faster icon loading by inlining icons from the Tabler sprite. The previous method required downloading and parsing a large file, causing delays in icon rendering. Now, icons are generated and cached, improving page load times. Update the icon helper to utilize the new inline method.
* Update tabler icons to version 3.35 and refactor icon extraction logic for improved performance
* icon image helper: logging and error handling
- Changed debug logs to warning logs for invalid icon names and missing icons in the IconImgHelper.
- Updated the way icons are retrieved from the ICON_MAP for better clarity and performance.
* IconImgHelper: use raw string literals for SVG output
* Refactor icon extraction logic in build.rs to improve performance and memory usage. The download_tabler_icons function now directly processes sprite content in memory, eliminating the need for temporary file storage. Updated extract_icons_from_sprite to handle byte slices instead of strings, enhancing efficiency.
* build.rs: raise on missing icon id
* Simlplify icon generation in build.rs
* simplify icon _img helper
* update input field docs
fixes https://github.com/sqlpage/SQLPage/discussions/1081
* better form documentation
* fix ipv6 notation (#1084)
On Mac OS, when localhost:8080 is defined and sqlpage config file, the SocketAddr is resolved with ipv6 address if ip V6 is available on the internal network.
```json
{
"listen_on": "localhost:8080"
}
```
On the terminal we can Ctrl + Click, but the URL is incorrect (ipV6 notation use bracket)
Actually we have
```shell
View your website at:
🔗http://::1:8080
```
Instead of
```
View your website at:
🔗http://[::1]:8080
```
Regards,
* Update dependencies in Cargo.lock to latest versions
* Fix github pr ci cache warnings (#1086)
* feat: Add shared-key to cargo cache action
Co-authored-by: contact <contact@ophir.dev>
* Refactor: Use matrix-specific cache key in CI
Co-authored-by: contact <contact@ophir.dev>
* feat: Cache Rust build artifacts only on main branch
Co-authored-by: contact <contact@ophir.dev>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Enhance SQL performance guidance in migration script
- Added detailed recommendations for using primary and foreign keys, including examples for product and sales tables.
- Introduced best practices for indexing, query performance debugging, and database maintenance commands.
- Included advice on lazy loading and reducing the number of queries to optimize SQLPage applications.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Christophe CHAUVET <christophe.chauvet@gmail.com>
* Docs: Add Nginx streaming and compression configuration
Co-authored-by: contact <contact@ophir.dev>
* Add NGINX streaming and compression configuration
Co-authored-by: contact <contact@ophir.dev>
* Refactor NGINX proxy settings documentation for clarity
Co-authored-by: contact <contact@ophir.dev>
* Refine NGINX proxy buffering recommendations for streaming
Co-authored-by: contact <contact@ophir.dev>
* Update NGINX proxy buffering settings for improved streaming performance
Revised the documentation to clarify the impact of enabling and disabling proxy buffering in NGINX for SQLPage. Added concise recommendations for handling slow SQL queries and emphasized the importance of adjusting `compress_responses` in `sqlpage.json` when using a reverse proxy.
Co-authored-by: contact <contact@ophir.dev>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
- Clarify the execution flow of SQL statements in SQLPage, detailing the decision-making process for handling statements.
- Expand on the role of `sqlpage.*` functions and their execution context.
- Improve explanations and examples to illustrate the differences between local handling and database execution.
- Update section titles for better readability and understanding.
- Refactor content for better clarity on how SQLPage processes SQL statements.
- Introduce sections on static simple selects, variable handling, and the execution of `sqlpage.*` functions.
- Improve examples to illustrate the differences between handled and sent queries.
- Enhance explanations regarding performance and data types in SQLPage.
Ophir LOJKINE