I have started on this path with #1382 but I thought it would be worth creating an issue to track all of the changes I'm thinking about that will come after this. This audit was done with the help of Claude.
B1. configuration.md — six defaults are wrong or incomplete
| Option |
Documented |
Actual |
Reference |
system_root_ca_certificates |
false |
true whenever SSL_CERT_FILE or SSL_CERT_DIR is set |
app_config.rs:729-732 |
listen_on / port |
0.0.0.0:8080 / 8080 |
443 when https_domain is set |
app_config.rs:426-436 |
database_url |
sqlite://sqlpage.db?mode=rwc |
path is relative to the configuration directory; falls back to in-memory if that is not writable; a legacy ./sqlpage.db wins if present |
app_config.rs:630-673 |
max_database_pool_connections |
4 backends listed |
5 branches — ODBC is 50 and in-memory SQLite is 128, neither documented |
connect.rs:82-95 |
https_certificate_cache_dir |
./sqlpage/https |
derived from the process working directory, not from the configured web_root or configuration directory |
app_config.rs:711-713 |
max_recursion_depth |
"Maximum value is 255" |
not a cap — the u8 type makes 256 a startup failure |
app_config.rs:405-406 |
Also drifted inside the code. The Rust doc comment at app_config.rs:290 says the default upload limit is 10 MiB. The actual default at :703-705 is 5 MiB, and configuration.md correctly says 5 MiB.
Suggested fix. Correct the rows. Then, optionally, add a test that parses the (stable, three-column) table and asserts that documented option names match the struct's serde names and that documented defaults match the values produced by deserialising {}.
B2. sqlpage.request_body() returns '' where the documentation says NULL
What happens. examples/official-site/sqlpage/migrations/55_request_body.sql:65 says the function "returns NULL if there is no request body". On a request with no body SQLPage actually returns an empty string.
B3. fetch_with_meta emits a json_body key that its documentation does not mention
What happens. sqlpage.fetch_with_meta returns the response body under the key body for text responses and under json_body for JSON responses. The documentation
(examples/official-site/sqlpage/migrations/58_fetch_with_meta.sql:14-23) documents a single body key holding "a string, or a json object, depending on the content type".
I have started on this path with #1382 but I thought it would be worth creating an issue to track all of the changes I'm thinking about that will come after this. This audit was done with the help of Claude.
B1.
configuration.md— six defaults are wrong or incompletesystem_root_ca_certificatesfalsetruewheneverSSL_CERT_FILEorSSL_CERT_DIRis setapp_config.rs:729-732listen_on/port0.0.0.0:8080/8080443whenhttps_domainis setapp_config.rs:426-436database_urlsqlite://sqlpage.db?mode=rwc./sqlpage.dbwins if presentapp_config.rs:630-673max_database_pool_connectionsconnect.rs:82-95https_certificate_cache_dir./sqlpage/httpsweb_rootor configuration directoryapp_config.rs:711-713max_recursion_depthu8type makes 256 a startup failureapp_config.rs:405-406Also drifted inside the code. The Rust doc comment at
app_config.rs:290says the default upload limit is 10 MiB. The actual default at:703-705is 5 MiB, andconfiguration.mdcorrectly says 5 MiB.Suggested fix. Correct the rows. Then, optionally, add a test that parses the (stable, three-column) table and asserts that documented option names match the struct's serde names and that documented defaults match the values produced by deserialising
{}.B2.
sqlpage.request_body()returns''where the documentation says NULLWhat happens.
examples/official-site/sqlpage/migrations/55_request_body.sql:65says the function "returns NULL if there is no request body". On a request with no body SQLPage actually returns an empty string.B3.
fetch_with_metaemits ajson_bodykey that its documentation does not mentionWhat happens.
sqlpage.fetch_with_metareturns the response body under the keybodyfor text responses and underjson_bodyfor JSON responses. The documentation(
examples/official-site/sqlpage/migrations/58_fetch_with_meta.sql:14-23) documents a singlebodykey holding "a string, or a json object, depending on the content type".