- Upgrade cc and clap - Upgrade libredox and redox_users - Upgrade
rustls and serde_json - Upgrade tokio and toml - Upgrade biome to v2.1.3
- Update CHANGELOG.md to reflect the changes.
This commit adds automatic OIDC provider metadata refresh when token
validation fails. Previously, tokens would become invalid when providers
rotated their signing keys, requiring a manual SQLPage restart to
refresh the metadata.
Moves client refresh logic into a separate method and uses
request-scoped HTTP client instead of storing AppConfig. This simplifies
the state struct and improves the refresh mechanism's reliability.
This change switches from std::sync::Mutex to tokio::sync::RwLock for
the OIDC client to avoid deadlocks. The read operations now use a shared
lock while writes remain exclusive.
ownership
- Extract request handling logic into standalone async functions -
Replace service ownership with Rc<S> for better memory management -
Simplify get_client() return type to use MutexGuard directly - Add
MiddlewareResponse enum to clarify response handling flow - Move public
path checking to beginning of request pipeline - Reorganize code to
separate concerns and improve readability
This enhancement allows SQLPage to read and utilize custom claims from
JWT tokens generated by OIDC providers, enabling users to store
additional information like roles or permissions that can be used in SQL
queries.
Key changes: - Modified get_token_claims() to accept optional login
state, allowing token verification without requiring active login
session state - Updated nonce verification logic to handle cases where
no login state exists - Refactored OIDC client and token response types
to use more specific generics that support additional claims through
OidcAdditionalClaims - Simplified function signatures by passing
oidc_state instead of separate client and config parameters - Enhanced
error handling in OIDC callback processing with automatic client refresh
- Updated type definitions to properly support custom claim extraction
from tokens
This enables SSO providers to include custom user metadata that SQLPage
can access and use for authorization and personalization in database
queries.
- Update windows-targets from 0.53.2 to 0.53.3 - Update libredox from
0.1.6 to 0.1.8 - Update redox_syscall from 0.5.16 to 0.5.17 - Update
rustls from 0.23.30 to 0.23.29 - Update toml from 0.9.2 to 0.9.3
- Remove custom URL building logic in favor of direct URI usage - Make
validate_redirect_url take ownership of the URL string - Remove
now-unnecessary test cases for removed functionality - Add logging for
redirect targets after successful login
The search term is now properly escaped when used in SQLite full-text
search queries to prevent syntax errors with quotes. This ensures
searches containing quotes work correctly.
* Check for 404 before redirecting on no-extension paths
The commit improves routing logic by checking if a path would result in
a 404
fixes https://github.com/sqlpage/SQLPage/issues/971 before adding a
trailing slash. This prevents unnecessary redirects when a custom 404
handler exists.
* Fix test function signature formatting in routing module (#973)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Simplify path resolution and redirect logic
The shorter code more clearly handles finding files with .sql extensions
and decides whether to add trailing slashes based on index file
presence.
* clippy
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Added posibility to bypass oidc authentication for certain endpoints
* fixxed missing .clone()
* Fixxed oidc_skip_endpoints not being optional
* feat(oidc): Introduce protected path prefixes
This commit replaces the OIDC endpoint blacklist with a path prefix whitelist. This is a more intuitive and secure approach for managing protected routes.
The new `oidc_protected_paths` configuration option allows users to specify a list of URL prefixes that require OIDC authentication. By default, all paths are protected.
The documentation has been updated to reflect this change, with clear examples and more user-friendly language.
* docs(oidc): Improve OIDC documentation and examples
This commit improves the OIDC documentation and the "single sign on"
example to better demonstrate how to create a selective login system.
The main documentation now includes a section on creating a public
login page and the "single sign on" example has been updated to
reflect this pattern.
* Simplify OIDC middleware request handling for unprotected paths
* docs(oidc): Improve single sign on example
This commit improves the "single sign on" example to better
demonstrate a public information page that adapts to the users
login status and a separate protected page.
* docs(oidc): Document oidc_protected_paths in configuration.md
This commit updates the main configuration documentation to reflect the
new `oidc_protected_paths` option. It removes the outdated
`oidc_skip_endpoints` and provides a more detailed explanation of how
to create a mix of public and private pages.
* Improve SSO demo UX
- Update docker compose command to use `--watch` flag - Add watch
configuration for SQLPage development - Enhance login page with hero
component and better styling - Simplify protected page welcome message -
Fix OIDC middleware path check logic - Update protected paths in config
to use `/protected` instead of `/protected.sql`
* Skip OIDC auth for non-protected paths later in middleware
We still want to be able to access authenticated user's info in
non-authenticated parts of the app.
We crucially need to check request.path() == SQLPAGE_REDIRECT_URI before
the protected_paths check
* Added whitelist option
* Update configuration.md
* Improve OIDC public paths documentation
The documentation now provides clearer examples and explains the
interaction between public and protected paths more precisely. Also
removes the now-unused default_oidc_public_paths function since the
field's default is handled by serde's default for Vec.
* Add OidcConfig method to check public paths
The new `is_public_path` method consolidates the logic for checking if a
path should bypass OIDC authentication. This replaces the previous
inline checks for public and protected paths.
* fix default empty public paths
* Update SSO example with new image path and public access rules
- Change hero image path in login page - Remove protected.sql as it's no
longer needed - Update sqlpage.yaml to allow public access to
/protected/public
---------
Co-authored-by: Lenardt Gerhardts <lenardt.gerhardts@obi.de>
Co-authored-by: lovasoa <contact@ophir.dev>
lovasoa