Merge branch 'sqlpage:main' into success_stories

Author: olivierauverlot

CHANGELOG.md

@@ -1,5 +1,8 @@
 # CHANGELOG.md
 
+## unreleased
+ - OIDC protected and public paths now respect the site prefix when it is defined.
+
 ## 0.42.0 (2026-01-17)
 
 - **New Function**: `sqlpage.web_root()` - Returns the web root directory where SQLPage serves `.sql` files from. This is more reliable than `sqlpage.current_working_directory()` when you need to reference the location of your SQL files, especially when the `--web-root` argument or `WEB_ROOT` environment variable is used.

Cargo.lock

@@ -175,17 +175,6 @@ To run on a server, you can use [the docker image](https://hub.docker.com/r/lova
 We provide compiled binaries only for the x86_64 architecture, but provide docker images for other architectures, including arm64 and armv7. If you want to run SQLPage on a Raspberry Pi or 
 a cheaper ARM cloud instance, using the docker image is the easiest way to do it.
 
-#### DuckDB ODBC Docker Image
-
-A DuckDB-enabled variant is available with pre-installed DuckDB ODBC drivers:
-
-- Use the `-duckdb` suffix: `lovasoa/sqlpage:main-duckdb` or `lovasoa/sqlpage:latest-duckdb`
-- Comes pre-configured to connect to DuckDB at `/var/lib/sqlpage/duckdb.db`
-- To use a custom database location, set `DATABASE_URL`:
-  - `docker run -e DATABASE_URL="Driver=DuckDB;Database=/path/to/your.db" -p 8080:8080 lovasoa/sqlpage:main-duckdb`
-- To persist your DuckDB database, mount a volume:
-  - `docker run -v ./data:/var/lib/sqlpage lovasoa/sqlpage:main-duckdb`
-
 ### On Mac OS, with homebrew
 
 An alternative for Mac OS users is to use [SQLPage's homebrew package](https://formulae.brew.sh/formula/sqlpage).
@@ -205,6 +194,13 @@ You still need to install or provide the database-specific ODBC driver for the d
 
 #### Install your ODBC database driver
   - [DuckDB](https://duckdb.org/docs/stable/clients/odbc/overview.html)
+    - If you use docker, a DuckDB-enabled image variant is available with pre-installed DuckDB ODBC drivers
+        - Use the `-duckdb` suffix: `lovasoa/sqlpage:main-duckdb` or `lovasoa/sqlpage:latest-duckdb`
+        - Comes pre-configured to connect to DuckDB at `/var/lib/sqlpage/duckdb.db` inside the container
+        - To customize [connection options](https://duckdb.org/docs/stable/clients/odbc/configuration), set `DATABASE_URL`:
+          - `docker run -e DATABASE_URL="Driver=DuckDB;Database=/path/to/your.db" -p 8080:8080 lovasoa/sqlpage:main-duckdb`
+        - To persist your DuckDB database, mount a volume:
+          - `docker run -v ./data:/var/lib/sqlpage lovasoa/sqlpage:main-duckdb`
   - [Snowflake](https://docs.snowflake.com/en/developer-guide/odbc/odbc)
   - [BigQuery](https://cloud.google.com/bigquery/docs/reference/odbc-jdbc-drivers)
   - For other databases, follow your database's official odbc install instructions.

README.md

@@ -25,8 +25,8 @@ Here are the available configuration options and their default values:
 | `configuration_directory`                     | `./sqlpage/`                                                | The directory where the `sqlpage.json` file is located. This is used to find the path to [`templates/`](https://sql-page.com/custom_components.sql), [`migrations/`](https://sql-page.com/your-first-sql-website/migrations.sql), and `on_connect.sql`. Obviously, this configuration parameter can be set only through environment variables, not through the `sqlpage.json` file itself in order to find the `sqlpage.json` file. Be careful not to use a path that is accessible from the public WEB_ROOT |
 | `allow_exec`                                  | false                                                       | Allow usage of the `sqlpage.exec` function. Do this only if all users with write access to sqlpage query files and to the optional `sqlpage_files` table on the database are trusted.                                                                  |
 | `max_uploaded_file_size`                      | 5242880                                                     | Maximum size of forms and uploaded files in bytes. Defaults to 5 MiB.                                                                                                                                                                                            |
-| `oidc_protected_paths`                        | `["/"]`                                                      | A list of URL prefixes that should be protected by OIDC authentication. By default, all paths are protected (`["/"]`). If you want to make some pages public, you can restrict authentication to a sub-path, for instance `["/admin", "/users/settings"]`. |
-| `oidc_public_paths`                           | `[]`                                                        | A list of URL prefixes that should be publicly available. By default, no paths are publicly accessible (`[]`). If you want to make some pages public, you can bypass authentication for a sub-path, for instance `["/public/", "/assets/"]`. Keep in mind that without the closing backslashes, that any directory or file starting with `public` or `assets` will be publicly available. This will also overwrite any protected path restriction. If you have a private path `/private` and you define the public path `/private/public/` everything in `/private/public/` will be publicly accessible, while everything else in private will still need authentication.
+| `oidc_protected_paths`                        | `["/"]`                                                      | A list of URL prefixes that should be protected by OIDC authentication. By default, all paths are protected (`["/"]`). If you want to make some pages public, you can restrict authentication to a sub-path, for instance `["/admin", "/users/settings"]`. All paths must start with a "/" and will be prepended by `site_prefix` if defined.|
+| `oidc_public_paths`                           | `[]`                                                        | A list of URL prefixes that should be publicly available. By default, no paths are publicly accessible (`[]`). If you want to make some pages public, you can bypass authentication for a sub-path, for instance `["/public/", "/assets/"]`. Keep in mind that without the closing backslashes, that any directory or file starting with `public` or `assets` will be publicly available. This will also overwrite any protected path restriction. If you have a private path `/private` and you define the public path `/private/public/` everything in `/private/public/` will be publicly accessible, while everything else in private will still need authentication. All paths must start with a "/" and will be prepended by `site_prefix` if defined.
 | `oidc_issuer_url`                            |                                                           | The base URL of the [OpenID Connect provider](#openid-connect-oidc-authentication). Required for enabling Single Sign-On. |
 | `oidc_client_id`                             | sqlpage                                                   | The ID that identifies your SQLPage application to the OIDC provider. You get this when registering your app with the provider. |
 | `oidc_client_secret`                         |                                                           | The secret key for your SQLPage application. Keep this confidential as it allows your app to authenticate with the OIDC provider. |

configuration.md

@@ -26,6 +26,7 @@
   /* Code colors */
   --tblr-code-color: hsl(225deg 45.4% 76.93%); /* Light code text for dark theme */
   --tblr-code-bg: hsla(225, 47%, 15%, 0.5); /* Subtle dark background */
+  --tblr-active-bg: var(--tblr-code-bg);
 
   /* Ethereal accent colors */
   --tblr-blue-rgb: 84, 151, 213;
@@ -36,6 +37,26 @@
   --tblr-primary: rgb(var(--tblr-primary-rgb));
   --tblr-secondary: hsla(247, 60%, 94%, 0.7); /* Nebula purple */
 
+  /* Status + accent colors aligned with the brand palette */
+  --tblr-success-rgb: 16, 132, 86; /* Deep green for white text */
+  --tblr-success: rgb(var(--tblr-success-rgb));
+  --tblr-warning-rgb: 197, 124, 0; /* Deep amber */
+  --tblr-warning: rgb(var(--tblr-warning-rgb));
+  --tblr-danger-rgb: 196, 68, 68; /* Deep crimson */
+  --tblr-danger: rgb(var(--tblr-danger-rgb));
+  --tblr-purple-rgb: 118, 82, 200; /* Deep violet */
+  --tblr-purple: rgb(var(--tblr-purple-rgb));
+  --tblr-cyan-rgb: 0, 149, 168; /* Deep cyan */
+  --tblr-cyan: rgb(var(--tblr-cyan-rgb));
+  --tblr-indigo-rgb: 96, 113, 215; /* Deep indigo */
+  --tblr-indigo: rgb(var(--tblr-indigo-rgb));
+  --tblr-teal: #267d63;
+  --tblr-teal-fg: #20050b;
+
+  --tblr-green: var(--tblr-success);
+  --tblr-yellow: var(--tblr-warning);
+  --tblr-red: var(--tblr-danger);
+
   /* Luminous links */
   --tblr-link-color: hsl(212, 70%, 75%) !important; /* Star glow */
   --tblr-link-hover-color: hsl(212, 70%, 85%) !important; /* Supernova */
@@ -62,6 +83,26 @@
   --hljs-cosmic-keyword: hsl(210, 100%, 75%); /* Blue giant */
 }
 
+.btn-primary {
+  --tblr-btn-border-color: var(--tblr-secondary);
+  --tblr-btn-active-border-color: transparent;
+  --tblr-btn-color: var(--tblr-primary-fg, #ffffff);
+  --tblr-btn-bg: transparent;
+  --tblr-btn-hover-color: var(--tblr-primary-fg);
+  --tblr-btn-hover-bg: transparent;
+  --tblr-btn-active-color: var(--tblr-primary-fg);
+  --tblr-btn-active-bg: transparent;
+  --tblr-btn-disabled-bg: var(--tblr-primary);
+  --tblr-btn-disabled-color: var(--tblr-primary-fg);
+  --tblr-btn-box-shadow: 0.1em 0.1em 0.1em var(--tblr-primary);
+  --tblr-btn-hover-border-color: var(--tblr-primary);
+  --tblr-btn-active-shadow: -0.1em -0.1em 0.1em var(--tblr-primary);
+}
+
+.dropdown-menu {
+  --tblr-dropdown-link-active-color: rgb(166, 211, 255);
+}
+
 @media (min-width: 768px) {
   .layout-boxed {
     background: #07020ff5