* feat: Add sqlpage.hmac function for cryptographic signing
Co-authored-by: contact <contact@ophir.dev>
* feat: Add sqlpage.hmac function for secure data signing
Co-authored-by: contact <contact@ophir.dev>
* Test HMAC function with RFC vectors and update tests
Co-authored-by: contact <contact@ophir.dev>
* feat: Add sqlpage.hmac() function for secure signatures
Co-authored-by: contact <contact@ophir.dev>
* feat: Add base64 output option to hmac function
Co-authored-by: contact <contact@ophir.dev>
* Refactor hmac function for cleaner output formatting
Co-authored-by: contact <contact@ophir.dev>
* Add webhook HMAC signature validation tests
Co-authored-by: contact <contact@ophir.dev>
* Refactor HMAC function and update SQL examples for clarity and consistency
- Changed function parameters to remove Option types for data and key in the HMAC function.
- Improved SQL documentation and examples for HMAC usage, including clearer descriptions and updated error handling.
- Enhanced test cases for webhook HMAC validation to ensure accurate signature checks and responses.
- Removed obsolete test file for HMAC with null values.
* Update HMAC validation logic to handle NULL values in SQL queries
- Modified conditions in SQL queries to check for NULL values alongside signature mismatches.
- Enhanced documentation on NULL handling for HMAC checks to improve clarity and portability.
* remove debug logging from ci
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* implemented logger Component
* changed target for logger to "sqlpage::logger" and made the log::Level case insensitive
* changed error message on missing message key, to be more precise
* changed custom method for String to log::Level conversion to builtin method log::Level::from_str()
* switched to utility method get_object_str and inlined constants
* dynamically target based on file and statement
* disabled ci error (large difference in enum variants) for ResponseWithWriter<S>
* added functionality to work in Header context
* Refactor log component to use compact error handling
* Rename comp_str variable to component_name
* Documented log component
* fixxed missing values statement
* fixxed pipeline errors
* very simple test case for logger
---------
Co-authored-by: Lenardt Gerhardts <lenardt.ger+git@gmail.com>
Co-authored-by: lovasoa <contact@ophir.dev>
* feat: Enhanced BLOB support across all database backends
- Add comprehensive BLOB support for all supported databases:
* PostgreSQL: BYTEA columns with data URL conversion
* MySQL/MariaDB: BLOB columns with data URL conversion
* MSSQL: VARBINARY, BIGVARBINARY, BINARY, IMAGE columns
* SQLite: BLOB columns with data URL conversion
- Create shared data URL conversion functions to eliminate code duplication
- Add comprehensive tests for all database types
- Update CHANGELOG.md with detailed feature description
- All blob data is now consistently converted to data URLs with base64 encoding
- Cross-database compatibility ensures identical blob behavior across all backends
- Comprehensive testing validates functionality across PostgreSQL, MySQL, MariaDB, MSSQL, and SQLite
* update changelog
* fmt
* fix: Address clippy linter issues
- Change blob function parameters from Vec<u8> to &[u8] to avoid unnecessary copying
- Use inline format args in data URL construction
- Update function calls to borrow parameters correctly
- Maintain backward compatibility and functionality
* feat: Add smart MIME type detection for BLOB data
- Implement automatic MIME type detection based on file signatures (magic bytes)
- Support common file formats: PNG, JPEG, GIF, BMP, WebP, SVG, PDF, DOCX, XLSX, PPTX, JSON, XML, ZIP
- Automatic fallback to 'application/octet-stream' for unknown formats
- Update CHANGELOG.md with comprehensive feature description
- Add comprehensive tests for MIME type detection functionality
- BLOB data now automatically returns appropriate data URLs:
* PNG files: 'data:image/png;base64,...'
* PDF files: 'data:application/pdf;base64,...'
* SVG files: 'data:image/svg+xml;base64,...'
* Unknown files: 'data:application/octet-stream;base64,...'
- Improves user experience by providing correct MIME types for downloads and displays
- Eliminates need for manual MIME type specification in most cases
* refactor: Make MIME type detection more concise
- Use bytes.starts_with() for cleaner magic byte detection
- Remove verbose comments for each MIME type
- Maintain same functionality with cleaner, more readable code
- Reduce code duplication and improve maintainability
* refactor: Improve MIME type detection with byte strings
- Use byte string literals (b"string") for better readability
- Remove UTF-8 parsing for text-based formats, use direct byte comparisons
- Maintain same functionality with cleaner, more performant code
- PNG: b"\x89PNG\r\n\x1a\n" instead of hex arrays
- JPEG: b"\xFF\xD8" instead of [0xFF, 0xD8]
- Text formats: Direct byte matching without String::from_utf8_lossy
- Update all tests to use new byte string format
* refactor: Extract MIME type detection into separate module
- Create new mime_detection.rs module for better code organization
- Move detect_mime_type() function and tests to dedicated module
- Update sql_to_json.rs to import from mime_detection module
- Remove unused import from functions.rs
- Maintain same functionality with improved code structure
Benefits:
- Better separation of concerns
- Improved code organization and maintainability
- Easier to extend MIME detection in the future
- Cleaner module boundaries
File changes:
- NEW: src/webserver/database/mime_detection.rs (MIME detection + tests)
- MOD: src/webserver/database/mod.rs (add mime_detection module)
- MOD: src/webserver/database/sql_to_json.rs (use mime_detection module)
- MOD: src/webserver/database/sqlpage_functions/functions.rs (remove unused import)
* refactor: Rename mime_detection.rs to blob_to_data_url.rs
- Rename module from mime_detection to blob_to_data_url for better clarity
- Follow project naming conventions (similar to sql_to_json.rs)
- Update all imports and references to use new module name
- Maintain same functionality with improved code organization
File changes:
- RENAMED: src/webserver/database/mime_detection.rs → src/webserver/database/blob_to_data_url.rs
- MOD: src/webserver/database/mod.rs (update module declaration)
- MOD: src/webserver/database/sql_to_json.rs (update import path)
- MOD: src/webserver/database/sqlpage_functions/functions.rs (update import path)
* move
- Add #[must_use] attribute to detect_mime_type for better usage indication
- Replace empty byte check with is_empty() for clarity
- Update tests for improved readability with formatted assertions
- Remove unnecessary blank lines in sql_to_json.rs
Benefits:
- Improved code clarity and maintainability
- Enhanced test readability
* remove old file
* refactor: Update sql_to_json.rs to use new blob_to_data_url module
- Replace direct call to vec_to_data_uri_value with updated import from blob_to_data_url
- Remove deprecated vec_to_data_uri and vec_to_data_uri_value functions for cleaner code
- Maintain existing functionality while improving code organization
* refactor: Simplify MIME type detection logic in blob_to_data_url.rs
- Remove unnecessary empty byte check and streamline conditions for text-based formats
- Enhance readability by consolidating checks for XML and JSON formats
- Maintain existing functionality while improving code clarity
* clippy
* Update documentation for BLOB support and data type handling
- CHANGELOG.md : details on BLOB support and automatic MIME type detection
- Add examples in extensions-to-sql.md illustrating data type conversions and JSON object structure
- Update SQL examples in migrations to reflect new BLOB handling capabilities
- Introduce a new download component to facilitate file downloads.
- Implement download handling in the header context, supporting data URLs.
- Add a test for the download functionality to ensure correct behavior.
see https://github.com/sqlpage/SQLPage/discussions/996
- Revise the authentication section to enhance readability and structure.
- Introduce Single Sign-On (OIDC) details and emphasize security best practices.
- Consolidate information on built-in username/password and session management.
- Adds a new parameter `response_encoding` to the fetch function. - This
parameter allows the user to specify a charset for decoding the response
body. - It supports all standard web encodings, and also `hex` and
`base64`. - If no encoding is specified, the response is decoded as
utf-8, or as base64 if it contains binary data.
The search term is now properly escaped when used in SQLite full-text
search queries to prevent syntax errors with quotes. This ensures
searches containing quotes work correctly.
* Check for 404 before redirecting on no-extension paths
The commit improves routing logic by checking if a path would result in
a 404
fixes https://github.com/sqlpage/SQLPage/issues/971 before adding a
trailing slash. This prevents unnecessary redirects when a custom 404
handler exists.
* Fix test function signature formatting in routing module (#973)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Simplify path resolution and redirect logic
The shorter code more clearly handles finding files with .sql extensions
and decides whether to add trailing slashes based on index file
presence.
* clippy
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Added posibility to bypass oidc authentication for certain endpoints
* fixxed missing .clone()
* Fixxed oidc_skip_endpoints not being optional
* feat(oidc): Introduce protected path prefixes
This commit replaces the OIDC endpoint blacklist with a path prefix whitelist. This is a more intuitive and secure approach for managing protected routes.
The new `oidc_protected_paths` configuration option allows users to specify a list of URL prefixes that require OIDC authentication. By default, all paths are protected.
The documentation has been updated to reflect this change, with clear examples and more user-friendly language.
* docs(oidc): Improve OIDC documentation and examples
This commit improves the OIDC documentation and the "single sign on"
example to better demonstrate how to create a selective login system.
The main documentation now includes a section on creating a public
login page and the "single sign on" example has been updated to
reflect this pattern.
* Simplify OIDC middleware request handling for unprotected paths
* docs(oidc): Improve single sign on example
This commit improves the "single sign on" example to better
demonstrate a public information page that adapts to the users
login status and a separate protected page.
* docs(oidc): Document oidc_protected_paths in configuration.md
This commit updates the main configuration documentation to reflect the
new `oidc_protected_paths` option. It removes the outdated
`oidc_skip_endpoints` and provides a more detailed explanation of how
to create a mix of public and private pages.
* Improve SSO demo UX
- Update docker compose command to use `--watch` flag - Add watch
configuration for SQLPage development - Enhance login page with hero
component and better styling - Simplify protected page welcome message -
Fix OIDC middleware path check logic - Update protected paths in config
to use `/protected` instead of `/protected.sql`
* Skip OIDC auth for non-protected paths later in middleware
We still want to be able to access authenticated user's info in
non-authenticated parts of the app.
We crucially need to check request.path() == SQLPAGE_REDIRECT_URI before
the protected_paths check
* Added whitelist option
* Update configuration.md
* Improve OIDC public paths documentation
The documentation now provides clearer examples and explains the
interaction between public and protected paths more precisely. Also
removes the now-unused default_oidc_public_paths function since the
field's default is handled by serde's default for Vec.
* Add OidcConfig method to check public paths
The new `is_public_path` method consolidates the logic for checking if a
path should bypass OIDC authentication. This replaces the previous
inline checks for public and protected paths.
* fix default empty public paths
* Update SSO example with new image path and public access rules
- Change hero image path in login page - Remove protected.sql as it's no
longer needed - Update sqlpage.yaml to allow public access to
/protected/public
---------
Co-authored-by: Lenardt Gerhardts <lenardt.gerhardts@obi.de>
Co-authored-by: lovasoa <contact@ophir.dev>
* New modal component and upgrade of the button component to allow the opening of a modal box
* Modal component
* Update examples/official-site/sqlpage/migrations/63_modal.sql
* Support for embed content in modal box
* Add link & target props to big_number.handlebars
* Refactor: added new links in 49_big_number.sql and updated big_number.handlebars
* Refactor: added new links in 49_big_number.sql
* Apply suggestions from code review
* fix broken links in the documentation
* Update CHANGELOG.md
---------
Co-authored-by: Ophir LOJKINE <contact@ophir.dev>
* form improvements with new types of field: header and switch
* added checked toggle switch example
* add names to the switch checkboxes
* update form header margins
* trailing whitespace
* docs
---------
Co-authored-by: lovasoa <contact@ophir.dev>
* Added active indicator to the nav-item to highlight active navigation item
* Update documentation to reflect active property on a menu_item
* Updated shell component examples to separate active flag as its own example
* Update examples/official-site/sqlpage/migrations/01_documentation.sql
---------
Co-authored-by: Ophir LOJKINE <contact@ophir.dev>
Ophir LOJKINE