\n\n"}]'));
+
+INSERT INTO component(name, icon, description) VALUES
+ ('accordion', 'sort-ascending', 'An accordion based list of elements which can be shown individually.');
+INSERT INTO parameter(component, name, description, type, top_level, optional) SELECT 'accordion', * FROM (VALUES
+ -- top level
+ ('id', 'id attribute added to the container in HTML. It can be used to target this item through css or for scrolling to this item through links (use "#id" in link url).', 'TEXT', TRUE, TRUE),
+ -- item level
+ ('title', 'Name of the list item, displayed prominently.', 'TEXT', FALSE, FALSE),
+ ('contents_md', 'A description of the list item, displayed as greyed-out text.', 'TEXT', FALSE, FALSE)
+) x;
+INSERT INTO example(component, description, properties) VALUES
+ ('accordion', 'A basic accordion with Markdown', json('[{"component":"accordion"},{"title":"Beautiful","contents_md": "Lorem *ipsum* dolor sit amet, **consectetur** adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam."},{"title":"Useful","contents_md": "Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis *ipsum*. Praesent **mauris**. Fusce nec tellus sed augue semper porta."},{"title":"Compact","contents_md": "Mauris **ipsum**. Nulla metus metus, ullamcorper vel, tincidunt sed, euismod in, *nibh*. Quisque volutpat condimentum velit."}]'));
\ No newline at end of file
diff --git a/sqlpage/templates/accordion.handlebars b/sqlpage/templates/accordion.handlebars
new file mode 100644
index 000000000..9a88f80a5
--- /dev/null
+++ b/sqlpage/templates/accordion.handlebars
@@ -0,0 +1,18 @@
+
+ {{#each_row}}
+
+
+
+
+
+
+ {{{markdown contents_md}}}
+
+
+
+ {{/each_row}}
+
diff --git a/src/app_config.rs b/src/app_config.rs
index 6e9166457..6cfb148ca 100644
--- a/src/app_config.rs
+++ b/src/app_config.rs
@@ -412,6 +412,12 @@ pub struct AppConfig {
pub markdown_allow_dangerous_protocol: bool,
pub cache_stale_duration_ms: Option,
+
+ pub s3_bucket: Option,
+ pub s3_region: Option,
+ pub s3_endpoint: Option,
+ pub s3_access_key: Option,
+ pub s3_secret_key: Option,
}
impl AppConfig {
diff --git a/src/webserver/database/sqlpage_functions/functions.rs b/src/webserver/database/sqlpage_functions/functions.rs
index 5139fa314..17908a63f 100644
--- a/src/webserver/database/sqlpage_functions/functions.rs
+++ b/src/webserver/database/sqlpage_functions/functions.rs
@@ -19,6 +19,7 @@ mod environment_variable;
mod exec;
mod fetch;
mod fetch_with_meta;
+mod get_from_s3;
mod hash_password;
mod header;
mod headers;
@@ -38,6 +39,7 @@ mod request_method;
mod run_sql;
mod send_mail;
mod set_variable;
+mod upload_to_s3;
mod uploaded_file_mime_type;
mod uploaded_file_name;
mod uploaded_file_path;
@@ -59,6 +61,7 @@ sqlpage_functions! {
exec,
fetch,
fetch_with_meta,
+ get_from_s3,
hash_password,
header,
headers,
@@ -81,6 +84,7 @@ sqlpage_functions! {
uploaded_file_mime_type,
uploaded_file_name,
uploaded_file_path,
+ upload_to_s3,
url_encode,
user_info,
user_info_token,
diff --git a/src/webserver/database/sqlpage_functions/functions/get_from_s3.rs b/src/webserver/database/sqlpage_functions/functions/get_from_s3.rs
new file mode 100644
index 000000000..a92019974
--- /dev/null
+++ b/src/webserver/database/sqlpage_functions/functions/get_from_s3.rs
@@ -0,0 +1,13 @@
+use std::borrow::Cow;
+
+use super::super::s3;
+use crate::webserver::http_request_info::RequestInfo;
+
+pub(super) async fn get_from_s3<'a>(
+ request: &'a RequestInfo,
+ bucket: Option>,
+ key: Cow<'a, str>,
+) -> anyhow::Result {
+ // Keep the AWS SDK future out of the shared SQL function dispatch future.
+ Box::pin(s3::get_from_s3(request, bucket, key)).await
+}
diff --git a/src/webserver/database/sqlpage_functions/functions/upload_to_s3.rs b/src/webserver/database/sqlpage_functions/functions/upload_to_s3.rs
new file mode 100644
index 000000000..651e9276a
--- /dev/null
+++ b/src/webserver/database/sqlpage_functions/functions/upload_to_s3.rs
@@ -0,0 +1,14 @@
+use std::borrow::Cow;
+
+use super::super::s3;
+use crate::webserver::http_request_info::RequestInfo;
+
+pub(super) async fn upload_to_s3<'a>(
+ request: &'a RequestInfo,
+ bucket: Option>,
+ data: Cow<'a, str>,
+ key: Cow<'a, str>,
+) -> anyhow::Result {
+ // Keep the AWS SDK future out of the shared SQL function dispatch future.
+ Box::pin(s3::upload_to_s3(request, bucket, data, key)).await
+}
diff --git a/src/webserver/database/sqlpage_functions/mod.rs b/src/webserver/database/sqlpage_functions/mod.rs
index d4b70ec2f..b9305c158 100644
--- a/src/webserver/database/sqlpage_functions/mod.rs
+++ b/src/webserver/database/sqlpage_functions/mod.rs
@@ -1,4 +1,5 @@
mod function_traits;
pub(super) mod functions;
mod http_fetch_request;
+mod s3;
mod url_parameters;
diff --git a/src/webserver/database/sqlpage_functions/s3.rs b/src/webserver/database/sqlpage_functions/s3.rs
new file mode 100644
index 000000000..ba653e375
--- /dev/null
+++ b/src/webserver/database/sqlpage_functions/s3.rs
@@ -0,0 +1,191 @@
+use crate::app_config::AppConfig;
+use crate::webserver::http_request_info::RequestInfo;
+use anyhow::Context;
+use aws_config::BehaviorVersion;
+use aws_sdk_s3::presigning::PresigningConfig;
+use std::borrow::Cow;
+use std::time::Duration;
+
+pub(super) async fn upload_to_s3<'a>(
+ request: &'a RequestInfo,
+ bucket: Option>,
+ data: Cow<'a, str>,
+ key: Cow<'a, str>,
+) -> anyhow::Result {
+ let config = &request.app_state.config;
+ let client = get_s3_client(config).await;
+ upload_to_s3_with_client(config, &client, bucket, data, key).await
+}
+
+async fn upload_to_s3_with_client<'a>(
+ config: &AppConfig,
+ client: &aws_sdk_s3::Client,
+ bucket: Option>,
+ data: Cow<'a, str>,
+ key: Cow<'a, str>,
+) -> anyhow::Result {
+ let bucket = bucket
+ .as_deref()
+ .or(config.s3_bucket.as_deref())
+ .ok_or_else(|| anyhow::anyhow!("S3 bucket not configured"))?;
+
+ let body_bytes = prepare_upload_body(data.as_ref(), config).await?;
+
+ client
+ .put_object()
+ .bucket(bucket)
+ .key(key.as_ref())
+ .body(body_bytes.into())
+ .send()
+ .await
+ .map_err(|e| anyhow::anyhow!("Failed to upload to S3: {e}"))?;
+
+ Ok(format!("s3://{bucket}/{key}"))
+}
+
+async fn prepare_upload_body(data: &str, config: &AppConfig) -> anyhow::Result> {
+ if let Some(stripped) = data.strip_prefix("file://") {
+ let file_path = std::path::Path::new(stripped);
+ // Security check: ensure the file is within the web root or allowed paths
+ let web_root = &config.web_root;
+ let full_path = web_root.join(file_path);
+ if !full_path.starts_with(web_root) {
+ anyhow::bail!("Security violation: Access denied to file outside web root");
+ }
+ tokio::fs::read(&full_path)
+ .await
+ .map_err(|e| {
+ log::error!("Failed to read file {}: {}", full_path.display(), e);
+ e
+ })
+ .with_context(|| format!("Unable to read file {}", full_path.display()))
+ } else {
+ // Assume base64
+ use base64::Engine;
+ base64::engine::general_purpose::STANDARD
+ .decode(data.as_bytes())
+ .map_err(|e| {
+ log::error!("Base64 decode failed: {e}");
+ e
+ })
+ .context("Invalid base64 data")
+ }
+}
+
+pub(super) async fn get_from_s3<'a>(
+ request: &'a RequestInfo,
+ bucket: Option>,
+ key: Cow<'a, str>,
+) -> anyhow::Result {
+ let config = &request.app_state.config;
+ let client = get_s3_client(config).await;
+ get_from_s3_with_client(config, &client, bucket, key).await
+}
+
+async fn get_from_s3_with_client<'a>(
+ config: &AppConfig,
+ client: &aws_sdk_s3::Client,
+ bucket: Option>,
+ key: Cow<'a, str>,
+) -> anyhow::Result {
+ let bucket = bucket
+ .as_deref()
+ .or(config.s3_bucket.as_deref())
+ .ok_or_else(|| anyhow::anyhow!("S3 bucket not configured"))?;
+
+ let presigning_config = PresigningConfig::expires_in(Duration::from_secs(3600))?;
+
+ let presigned_request = client
+ .get_object()
+ .bucket(bucket)
+ .key(key.as_ref())
+ .presigned(presigning_config)
+ .await
+ .map_err(|e| anyhow::anyhow!("Failed to generate presigned URL: {e}"))?;
+
+ Ok(presigned_request.uri().to_string())
+}
+
+async fn get_s3_client(config: &AppConfig) -> aws_sdk_s3::Client {
+ let mut loader = aws_config::defaults(BehaviorVersion::latest());
+
+ if let Some(endpoint) = &config.s3_endpoint {
+ loader = loader.endpoint_url(endpoint);
+ }
+ if let Some(region) = &config.s3_region {
+ loader = loader.region(aws_config::Region::new(region.clone()));
+ }
+ if let (Some(access_key), Some(secret_key)) = (&config.s3_access_key, &config.s3_secret_key) {
+ let creds = aws_sdk_s3::config::Credentials::new(
+ access_key.clone(),
+ secret_key.clone(),
+ None,
+ None,
+ "sqlpage-config",
+ );
+ loader = loader.credentials_provider(creds);
+ }
+
+ let sdk_config = loader.load().await;
+ aws_sdk_s3::Client::new(&sdk_config)
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use crate::app_config::tests::test_config;
+
+ #[tokio::test]
+ async fn test_prepare_upload_body_base64() {
+ let config = test_config();
+ let data = "SGVsbG8gV29ybGQ="; // "Hello World"
+ let result = prepare_upload_body(data, &config).await.unwrap();
+ assert_eq!(result, b"Hello World");
+ }
+
+ #[tokio::test]
+ async fn test_prepare_upload_body_invalid_base64() {
+ let config = test_config();
+ let data = "InvalidBase64!";
+ let result = prepare_upload_body(data, &config).await;
+ assert!(result.is_err());
+ }
+
+ #[tokio::test]
+ async fn test_prepare_upload_body_file_security() {
+ let config = test_config();
+ // Try to access a file outside the web root (assuming /tmp is outside)
+ // Note: test_config uses current dir as web_root usually, or a temp dir.
+ // We need to construct a path that attempts directory traversal or absolute path outside.
+ let data = "file:///etc/passwd";
+ let result = prepare_upload_body(data, &config).await;
+ assert!(result.is_err());
+ assert!(
+ result
+ .unwrap_err()
+ .to_string()
+ .contains("Security violation")
+ );
+ }
+
+ #[tokio::test]
+ async fn test_get_from_s3_presigned() {
+ let mut config = test_config();
+ config.s3_bucket = Some("my-bucket".to_string());
+ config.s3_region = Some("us-east-1".to_string());
+ config.s3_access_key = Some("test".to_string());
+ config.s3_secret_key = Some("test".to_string());
+
+ // Create a client that doesn't actually connect but is valid enough for presigning
+ // Presigning is a local operation for the most part, but it needs credentials.
+ let client = get_s3_client(&config).await;
+
+ let url = get_from_s3_with_client(&config, &client, None, Cow::Borrowed("my-file.txt"))
+ .await
+ .unwrap();
+
+ assert!(url.contains("my-bucket"));
+ assert!(url.contains("my-file.txt"));
+ assert!(url.contains("X-Amz-Signature"));
+ }
+}
diff --git a/tests/end-to-end/fixtures/accordion/index.sql b/tests/end-to-end/fixtures/accordion/index.sql
new file mode 100644
index 000000000..7aa7d3bf4
--- /dev/null
+++ b/tests/end-to-end/fixtures/accordion/index.sql
@@ -0,0 +1,4 @@
+SELECT 'shell' AS component, 'Accordion test' AS title;
+SELECT 'accordion' AS component, 'example-accordion' AS id;
+SELECT 'First section' AS title, 'First **content**' AS contents_md;
+SELECT 'Second section' AS title, 'Second **content**' AS contents_md;
diff --git a/tests/end-to-end/fixtures/accordion/test.ts b/tests/end-to-end/fixtures/accordion/test.ts
new file mode 100644
index 000000000..ec5a196db
--- /dev/null
+++ b/tests/end-to-end/fixtures/accordion/test.ts
@@ -0,0 +1,13 @@
+import { expect, test } from "../../fixture";
+
+test("uses the documented id and switches expanded sections", async ({
+ page,
+}) => {
+ const accordion = page.locator("#example-accordion");
+ await expect(accordion).toBeVisible();
+ await expect(accordion.getByText("First content")).toBeVisible();
+ await expect(accordion.getByText("Second content")).toBeHidden();
+ await accordion.getByRole("button", { name: "Second section" }).click();
+ await expect(accordion.getByText("Second content")).toBeVisible();
+ await expect(accordion.getByText("First content")).toBeHidden();
+});