5 Commits

Author SHA1 Message Date
Bob Farrell
9cf6705c88 Per-request database connection
Use JetQuery's new `Repo.bindConnect()` to get a new Repo bound to a
connection for each request. This significantly simplifies connection
management and offloads all the connection pool
management/reconnecting/etc. to pg.zig where it belongs.

Improve development mode SQL syntax highlighting - highlight `SELECT`,
`UPDATE`, `DELETE`, `INSERT` in different bolded colors for clarity.
2024-11-30 12:48:18 +00:00
Bob Farrell
6e6f1bec1b Closes #108: Anti-CSRF middleware
Add to middleware in app's `src/main.zig`:

```zig
pub const jetzig_options = struct {
    pub const middleware: []const type = &.{
        jetzig.middleware.AntiCsrfMiddleware,
    };
};
```

CSRF token available in Zmpl templates:

```
{{context.authenticityToken()}}
```
or render a hidden form element:
```
{{context.authenticityFormElement()}}
```

The following HTML requests are rejected (403 Forbidden) if the
submitted query param does not match the value stored in the encrypted
session (added automatically when the token is generated for a template
value):

* POST
* PUT
* PATCH
* DELETE

JSON requests are not impacted - users should either disable JSON
endpoints or implement a different authentication method to protect
them.
2024-11-23 12:49:49 +00:00
Bob Farrell
a6d1b92f5e Simplify DevelopmentLogger, add ProductionLogger
Add auth helper to create a user from CLI:

```
jetzig auth user:create user@example.com
```
2024-11-11 22:25:35 +00:00
Bob Farrell
55f7bebb9e WIP 2024-11-09 17:13:32 +00:00
Bob Farrell
9bc1b26c10 WIP 2024-11-09 17:12:49 +00:00