Add complete example with database schema, credential processing, and page protection. Update authentication migration to reference new login component. Enhance login template with default icons and autocomplete attributes. Make validate parameter optional with sensible default.
- Updated the SQL file to improve the output format for components, adding sections for top-level and row-level parameters.
- Each parameter now includes its type, requirement status, and description for better clarity in the generated documentation.
* feat: Add sqlpage.hmac function for cryptographic signing
Co-authored-by: contact <contact@ophir.dev>
* feat: Add sqlpage.hmac function for secure data signing
Co-authored-by: contact <contact@ophir.dev>
* Test HMAC function with RFC vectors and update tests
Co-authored-by: contact <contact@ophir.dev>
* feat: Add sqlpage.hmac() function for secure signatures
Co-authored-by: contact <contact@ophir.dev>
* feat: Add base64 output option to hmac function
Co-authored-by: contact <contact@ophir.dev>
* Refactor hmac function for cleaner output formatting
Co-authored-by: contact <contact@ophir.dev>
* Add webhook HMAC signature validation tests
Co-authored-by: contact <contact@ophir.dev>
* Refactor HMAC function and update SQL examples for clarity and consistency
- Changed function parameters to remove Option types for data and key in the HMAC function.
- Improved SQL documentation and examples for HMAC usage, including clearer descriptions and updated error handling.
- Enhanced test cases for webhook HMAC validation to ensure accurate signature checks and responses.
- Removed obsolete test file for HMAC with null values.
* Update HMAC validation logic to handle NULL values in SQL queries
- Modified conditions in SQL queries to check for NULL values alongside signature mismatches.
- Enhanced documentation on NULL handling for HMAC checks to improve clarity and portability.
* remove debug logging from ci
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* implemented logger Component
* changed target for logger to "sqlpage::logger" and made the log::Level case insensitive
* changed error message on missing message key, to be more precise
* changed custom method for String to log::Level conversion to builtin method log::Level::from_str()
* switched to utility method get_object_str and inlined constants
* dynamically target based on file and statement
* disabled ci error (large difference in enum variants) for ResponseWithWriter<S>
* added functionality to work in Header context
* Refactor log component to use compact error handling
* Rename comp_str variable to component_name
* Documented log component
* fixxed missing values statement
* fixxed pipeline errors
* very simple test case for logger
---------
Co-authored-by: Lenardt Gerhardts <lenardt.ger+git@gmail.com>
Co-authored-by: lovasoa <contact@ophir.dev>
* feat: Enhanced BLOB support across all database backends
- Add comprehensive BLOB support for all supported databases:
* PostgreSQL: BYTEA columns with data URL conversion
* MySQL/MariaDB: BLOB columns with data URL conversion
* MSSQL: VARBINARY, BIGVARBINARY, BINARY, IMAGE columns
* SQLite: BLOB columns with data URL conversion
- Create shared data URL conversion functions to eliminate code duplication
- Add comprehensive tests for all database types
- Update CHANGELOG.md with detailed feature description
- All blob data is now consistently converted to data URLs with base64 encoding
- Cross-database compatibility ensures identical blob behavior across all backends
- Comprehensive testing validates functionality across PostgreSQL, MySQL, MariaDB, MSSQL, and SQLite
* update changelog
* fmt
* fix: Address clippy linter issues
- Change blob function parameters from Vec<u8> to &[u8] to avoid unnecessary copying
- Use inline format args in data URL construction
- Update function calls to borrow parameters correctly
- Maintain backward compatibility and functionality
* feat: Add smart MIME type detection for BLOB data
- Implement automatic MIME type detection based on file signatures (magic bytes)
- Support common file formats: PNG, JPEG, GIF, BMP, WebP, SVG, PDF, DOCX, XLSX, PPTX, JSON, XML, ZIP
- Automatic fallback to 'application/octet-stream' for unknown formats
- Update CHANGELOG.md with comprehensive feature description
- Add comprehensive tests for MIME type detection functionality
- BLOB data now automatically returns appropriate data URLs:
* PNG files: 'data:image/png;base64,...'
* PDF files: 'data:application/pdf;base64,...'
* SVG files: 'data:image/svg+xml;base64,...'
* Unknown files: 'data:application/octet-stream;base64,...'
- Improves user experience by providing correct MIME types for downloads and displays
- Eliminates need for manual MIME type specification in most cases
* refactor: Make MIME type detection more concise
- Use bytes.starts_with() for cleaner magic byte detection
- Remove verbose comments for each MIME type
- Maintain same functionality with cleaner, more readable code
- Reduce code duplication and improve maintainability
* refactor: Improve MIME type detection with byte strings
- Use byte string literals (b"string") for better readability
- Remove UTF-8 parsing for text-based formats, use direct byte comparisons
- Maintain same functionality with cleaner, more performant code
- PNG: b"\x89PNG\r\n\x1a\n" instead of hex arrays
- JPEG: b"\xFF\xD8" instead of [0xFF, 0xD8]
- Text formats: Direct byte matching without String::from_utf8_lossy
- Update all tests to use new byte string format
* refactor: Extract MIME type detection into separate module
- Create new mime_detection.rs module for better code organization
- Move detect_mime_type() function and tests to dedicated module
- Update sql_to_json.rs to import from mime_detection module
- Remove unused import from functions.rs
- Maintain same functionality with improved code structure
Benefits:
- Better separation of concerns
- Improved code organization and maintainability
- Easier to extend MIME detection in the future
- Cleaner module boundaries
File changes:
- NEW: src/webserver/database/mime_detection.rs (MIME detection + tests)
- MOD: src/webserver/database/mod.rs (add mime_detection module)
- MOD: src/webserver/database/sql_to_json.rs (use mime_detection module)
- MOD: src/webserver/database/sqlpage_functions/functions.rs (remove unused import)
* refactor: Rename mime_detection.rs to blob_to_data_url.rs
- Rename module from mime_detection to blob_to_data_url for better clarity
- Follow project naming conventions (similar to sql_to_json.rs)
- Update all imports and references to use new module name
- Maintain same functionality with improved code organization
File changes:
- RENAMED: src/webserver/database/mime_detection.rs → src/webserver/database/blob_to_data_url.rs
- MOD: src/webserver/database/mod.rs (update module declaration)
- MOD: src/webserver/database/sql_to_json.rs (update import path)
- MOD: src/webserver/database/sqlpage_functions/functions.rs (update import path)
* move
- Add #[must_use] attribute to detect_mime_type for better usage indication
- Replace empty byte check with is_empty() for clarity
- Update tests for improved readability with formatted assertions
- Remove unnecessary blank lines in sql_to_json.rs
Benefits:
- Improved code clarity and maintainability
- Enhanced test readability
* remove old file
* refactor: Update sql_to_json.rs to use new blob_to_data_url module
- Replace direct call to vec_to_data_uri_value with updated import from blob_to_data_url
- Remove deprecated vec_to_data_uri and vec_to_data_uri_value functions for cleaner code
- Maintain existing functionality while improving code organization
* refactor: Simplify MIME type detection logic in blob_to_data_url.rs
- Remove unnecessary empty byte check and streamline conditions for text-based formats
- Enhance readability by consolidating checks for XML and JSON formats
- Maintain existing functionality while improving code clarity
* clippy
* Update documentation for BLOB support and data type handling
- CHANGELOG.md : details on BLOB support and automatic MIME type detection
- Add examples in extensions-to-sql.md illustrating data type conversions and JSON object structure
- Update SQL examples in migrations to reflect new BLOB handling capabilities
- Introduce a new download component to facilitate file downloads.
- Implement download handling in the header context, supporting data URLs.
- Add a test for the download functionality to ensure correct behavior.
see https://github.com/sqlpage/SQLPage/discussions/996
- Revise the authentication section to enhance readability and structure.
- Introduce Single Sign-On (OIDC) details and emphasize security best practices.
- Consolidate information on built-in username/password and session management.
- Adds a new parameter `response_encoding` to the fetch function. - This
parameter allows the user to specify a charset for decoding the response
body. - It supports all standard web encodings, and also `hex` and
`base64`. - If no encoding is specified, the response is decoded as
utf-8, or as base64 if it contains binary data.
The search term is now properly escaped when used in SQLite full-text
search queries to prevent syntax errors with quotes. This ensures
searches containing quotes work correctly.
* Check for 404 before redirecting on no-extension paths
The commit improves routing logic by checking if a path would result in
a 404
fixes https://github.com/sqlpage/SQLPage/issues/971 before adding a
trailing slash. This prevents unnecessary redirects when a custom 404
handler exists.
* Fix test function signature formatting in routing module (#973)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Simplify path resolution and redirect logic
The shorter code more clearly handles finding files with .sql extensions
and decides whether to add trailing slashes based on index file
presence.
* clippy
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Added posibility to bypass oidc authentication for certain endpoints
* fixxed missing .clone()
* Fixxed oidc_skip_endpoints not being optional
* feat(oidc): Introduce protected path prefixes
This commit replaces the OIDC endpoint blacklist with a path prefix whitelist. This is a more intuitive and secure approach for managing protected routes.
The new `oidc_protected_paths` configuration option allows users to specify a list of URL prefixes that require OIDC authentication. By default, all paths are protected.
The documentation has been updated to reflect this change, with clear examples and more user-friendly language.
* docs(oidc): Improve OIDC documentation and examples
This commit improves the OIDC documentation and the "single sign on"
example to better demonstrate how to create a selective login system.
The main documentation now includes a section on creating a public
login page and the "single sign on" example has been updated to
reflect this pattern.
* Simplify OIDC middleware request handling for unprotected paths
* docs(oidc): Improve single sign on example
This commit improves the "single sign on" example to better
demonstrate a public information page that adapts to the users
login status and a separate protected page.
* docs(oidc): Document oidc_protected_paths in configuration.md
This commit updates the main configuration documentation to reflect the
new `oidc_protected_paths` option. It removes the outdated
`oidc_skip_endpoints` and provides a more detailed explanation of how
to create a mix of public and private pages.
* Improve SSO demo UX
- Update docker compose command to use `--watch` flag - Add watch
configuration for SQLPage development - Enhance login page with hero
component and better styling - Simplify protected page welcome message -
Fix OIDC middleware path check logic - Update protected paths in config
to use `/protected` instead of `/protected.sql`
* Skip OIDC auth for non-protected paths later in middleware
We still want to be able to access authenticated user's info in
non-authenticated parts of the app.
We crucially need to check request.path() == SQLPAGE_REDIRECT_URI before
the protected_paths check
* Added whitelist option
* Update configuration.md
* Improve OIDC public paths documentation
The documentation now provides clearer examples and explains the
interaction between public and protected paths more precisely. Also
removes the now-unused default_oidc_public_paths function since the
field's default is handled by serde's default for Vec.
* Add OidcConfig method to check public paths
The new `is_public_path` method consolidates the logic for checking if a
path should bypass OIDC authentication. This replaces the previous
inline checks for public and protected paths.
* fix default empty public paths
* Update SSO example with new image path and public access rules
- Change hero image path in login page - Remove protected.sql as it's no
longer needed - Update sqlpage.yaml to allow public access to
/protected/public
---------
Co-authored-by: Lenardt Gerhardts <lenardt.gerhardts@obi.de>
Co-authored-by: lovasoa <contact@ophir.dev>
* New modal component and upgrade of the button component to allow the opening of a modal box
* Modal component
* Update examples/official-site/sqlpage/migrations/63_modal.sql
* Support for embed content in modal box
* Add link & target props to big_number.handlebars
* Refactor: added new links in 49_big_number.sql and updated big_number.handlebars
* Refactor: added new links in 49_big_number.sql
* Apply suggestions from code review
* fix broken links in the documentation
* Update CHANGELOG.md
---------
Co-authored-by: Ophir LOJKINE <contact@ophir.dev>
* form improvements with new types of field: header and switch
* added checked toggle switch example
* add names to the switch checkboxes
* update form header margins
* trailing whitespace
* docs
---------
Co-authored-by: lovasoa <contact@ophir.dev>
lovasoa