The search term is now properly escaped when used in SQLite full-text
search queries to prevent syntax errors with quotes. This ensures
searches containing quotes work correctly.
* Check for 404 before redirecting on no-extension paths
The commit improves routing logic by checking if a path would result in
a 404
fixes https://github.com/sqlpage/SQLPage/issues/971 before adding a
trailing slash. This prevents unnecessary redirects when a custom 404
handler exists.
* Fix test function signature formatting in routing module (#973)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Simplify path resolution and redirect logic
The shorter code more clearly handles finding files with .sql extensions
and decides whether to add trailing slashes based on index file
presence.
* clippy
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* Added posibility to bypass oidc authentication for certain endpoints
* fixxed missing .clone()
* Fixxed oidc_skip_endpoints not being optional
* feat(oidc): Introduce protected path prefixes
This commit replaces the OIDC endpoint blacklist with a path prefix whitelist. This is a more intuitive and secure approach for managing protected routes.
The new `oidc_protected_paths` configuration option allows users to specify a list of URL prefixes that require OIDC authentication. By default, all paths are protected.
The documentation has been updated to reflect this change, with clear examples and more user-friendly language.
* docs(oidc): Improve OIDC documentation and examples
This commit improves the OIDC documentation and the "single sign on"
example to better demonstrate how to create a selective login system.
The main documentation now includes a section on creating a public
login page and the "single sign on" example has been updated to
reflect this pattern.
* Simplify OIDC middleware request handling for unprotected paths
* docs(oidc): Improve single sign on example
This commit improves the "single sign on" example to better
demonstrate a public information page that adapts to the users
login status and a separate protected page.
* docs(oidc): Document oidc_protected_paths in configuration.md
This commit updates the main configuration documentation to reflect the
new `oidc_protected_paths` option. It removes the outdated
`oidc_skip_endpoints` and provides a more detailed explanation of how
to create a mix of public and private pages.
* Improve SSO demo UX
- Update docker compose command to use `--watch` flag - Add watch
configuration for SQLPage development - Enhance login page with hero
component and better styling - Simplify protected page welcome message -
Fix OIDC middleware path check logic - Update protected paths in config
to use `/protected` instead of `/protected.sql`
* Skip OIDC auth for non-protected paths later in middleware
We still want to be able to access authenticated user's info in
non-authenticated parts of the app.
We crucially need to check request.path() == SQLPAGE_REDIRECT_URI before
the protected_paths check
* Added whitelist option
* Update configuration.md
* Improve OIDC public paths documentation
The documentation now provides clearer examples and explains the
interaction between public and protected paths more precisely. Also
removes the now-unused default_oidc_public_paths function since the
field's default is handled by serde's default for Vec.
* Add OidcConfig method to check public paths
The new `is_public_path` method consolidates the logic for checking if a
path should bypass OIDC authentication. This replaces the previous
inline checks for public and protected paths.
* fix default empty public paths
* Update SSO example with new image path and public access rules
- Change hero image path in login page - Remove protected.sql as it's no
longer needed - Update sqlpage.yaml to allow public access to
/protected/public
---------
Co-authored-by: Lenardt Gerhardts <lenardt.gerhardts@obi.de>
Co-authored-by: lovasoa <contact@ophir.dev>
* New modal component and upgrade of the button component to allow the opening of a modal box
* Modal component
* Update examples/official-site/sqlpage/migrations/63_modal.sql
* Support for embed content in modal box
* Add link & target props to big_number.handlebars
* Refactor: added new links in 49_big_number.sql and updated big_number.handlebars
* Refactor: added new links in 49_big_number.sql
* Apply suggestions from code review
* fix broken links in the documentation
* Update CHANGELOG.md
---------
Co-authored-by: Ophir LOJKINE <contact@ophir.dev>
* form improvements with new types of field: header and switch
* added checked toggle switch example
* add names to the switch checkboxes
* update form header margins
* trailing whitespace
* docs
---------
Co-authored-by: lovasoa <contact@ophir.dev>
* Added active indicator to the nav-item to highlight active navigation item
* Update documentation to reflect active property on a menu_item
* Updated shell component examples to separate active flag as its own example
* Update examples/official-site/sqlpage/migrations/01_documentation.sql
---------
Co-authored-by: Ophir LOJKINE <contact@ophir.dev>
* add oidc config variables
* setup a basic middleware
* implement an async http client that uses oidc
* initialize provider_metadata in OidcService
* better error handling in oidc config
* HTTP client initialization in oidc now follows global config
* oidc: implement redirects
- Add `host` configuration option for specifying the application's web address in configuration.md and app_config.rs.
- Update docker-compose.yaml to include SQLPAGE_HOST and SQLPAGE_OIDC_ISSUER_URL environment variables.
- Enhance OIDC middleware to utilize the new `host` setting for redirect URLs and improve cookie handling in oidc.rs.
* improve local oidc configurability
* log
* Update warning message in OIDC configuration to clarify how to disable it by providing a host setting
* Update OIDC redirect logging to use info level with client ID
* Refactor unauthenticated request handling in OIDC service
- Extracted logic for handling unauthenticated requests into a separate method `handle_unauthenticated_request`.
- Updated the main request handling flow to utilize the new method for improved readability and maintainability.
* Enhance OIDC service with callback handling and token processing
- Introduced `handle_oidc_callback` method to manage OIDC callback requests.
- Added `process_oidc_callback` and `exchange_code_for_token` methods for token exchange logic.
- Updated `handle_unauthenticated_request` to check for callback URL and redirect accordingly.
- Refactored `build_redirect_response` to improve clarity in response handling.
* in handle_oidc_callback use service_request.into_response
* fmt
* Implement oidc code exchange and token storage
* validate oidc cookies
- Updated `get_sqlpage_auth_cookie` to return a result for better error handling and validation of the SQLPage auth cookie.
- Improved logging throughout the OIDC service for better traceability of requests and responses.
- Adjusted the handling of OIDC callback parameters to include context in error messages.
* OIDC callback: redirect to the auth URL on failure.
* oidc use localhost for redirect config instead of 0.0.0.0 by default
* Enhance OIDC provider metadata discovery with improved logging and error context
* maintain the initial URL during OIDC authentication
- Added state cookie handling to maintain the initial URL during OIDC authentication.
- Refactored `build_auth_url` to accept the initial URL as a parameter.
- Enhanced `process_oidc_callback` to retrieve the state from the cookie and redirect accordingly.
* implement csrf token
* update deps
* update sso examples
* nonce verification
- Improved error logging for invalid auth cookies and ID token verification.
- Introduced nonce verification logic to ensure security during OIDC authentication.
- Adjusted parameters for nonce hashing to optimize for short-lived tokens.
* Refactor OIDC logging and improve documentation
- Updated logging statements for better clarity and context.
- Refactored code for nonce verification and error handling.
- Enhanced documentation in `app_config.rs` for clarity on `https_domain` usage.
* Remove unused app_state field from OidcService struct
* Enhance OIDC client error handling and refactor HTTP request types
- Added context to OIDC client creation error handling.
- Updated HTTP request and response types for better integration with the openidconnect library.
- Introduced AwcWrapperError for improved error management in HTTP calls.
* clippy fixes
- Changed http_client from Arc to Rc in OidcService for improved memory efficiency.
- Updated related code to reflect the new ownership model for the HTTP client.
* initialize the oidc and http clients only once
- Added OidcState struct to encapsulate OIDC configuration and client.
- Refactored OidcMiddleware to utilize OidcState for improved state management.
- Updated HTTP client handling in OIDC service methods for better integration with app data.
- Enhanced logging for OIDC middleware initialization and request processing.
* functions for accessing user claims from OIDC tokens + documentation
- Updated SQLPage authentication component documentation for clarity on usage and options.
- Removed deprecated login and redirect handler scripts to streamline the SSO implementation.
- Enhanced logout functionality to properly clear session cookies and redirect users.
- Improved request handling to include OIDC claims in the request context for better user information retrieval.
* better sso troubleshooting info
* fmt
* add sso to the changelog
* Update shell.handlebars
adding two options:
search_button
search_placeholder
* Update table.handlebars
adding search_placeholder option
* Update 01_documentation.sql
documentation update for the shell component options:
search_placeholder
search_button
and for the table component option: search_placeholder
* avoid failing tests on long loading map tiles
* add an example for search_placeholder
---------
Co-authored-by: lovasoa <contact@ophir.dev>
* empty_state component added
* empty_state component added
* Correction and new example
* rename status_code to header
* Enhance empty_state component documentation and template to support rich text formatting. Update docs with detailed descriptions and examples, and modify Handlebars template to conditionally render Markdown content.
* add and document class and id attributes
---------
Co-authored-by: lovasoa <contact@ophir.dev>
lovasoa