List-typed config options (`oidc_protected_paths`, `oidc_additional_trusted_audiences`) cannot be set via environment variables

[amrutadotorg]

Hello @lovasoa could you please check the issue? Thank you!

Summary

The docs say SQLPage "can be configured through either environment variables or a JSON file" and that "all the parameters above can be set through environment variables" (configuration.md). In practice, list/array-typed options cannot be set via env: only sqlite_extensions works (the single key registered for list parsing). Setting e.g. SQLPAGE_OIDC_PROTECTED_PATHS makes SQLPage fail at startup:

error: "invalid type: string, expected a sequence"

How to reproduce

docker run --rm \
  -e SQLPAGE_OIDC_PROTECTED_PATHS='["/user"]' \
  -e SQLPAGE_OIDC_ISSUER_URL=https://auth.example.org \
  -e SQLPAGE_OIDC_CLIENT_ID=sqlpage \
  -e SQLPAGE_OIDC_CLIENT_SECRET=x \
  lovasoa/sqlpage:latest

Any value fails the same way, JSON-encoded or not (["/user"] and /user both produce invalid type: string, expected a sequence).

Cause

In src/app_config.rs:

fn env_config() -> config::Environment {
    config::Environment::default()
        .try_parsing(true)
        .list_separator(" ")
        .with_list_parse_key("sqlite_extensions")
}

The config crate (0.15.4) Environment::collect() parses each env value only as bool/i64/f64, otherwise keeping it a plain string. Values are split into lists only for keys registered via with_list_parse_key — currently just sqlite_extensions. Every Vec<String> config field (oidc_protected_paths, oidc_additional_trusted_audiences) therefore cannot be populated from the environment; serde rejects the string.

Expected behavior (any one of)

1. Support JSON-encoded arrays in env values (parse with serde_json when the value looks like JSON), e.g. SQLPAGE_OIDC_PROTECTED_PATHS=["/user"]; or
2. Register all list-typed options with with_list_parse_key, with the env format documented (space-separated, e.g. SQLPAGE_OIDC_PROTECTED_PATHS=/user); or
3. At minimum, update configuration.md to state that list options are configuration-file-only.

Impact

Users who want to keep configuration (and especially secrets) out of sqlpage.json — e.g. in an env-file-driven Docker Compose setup — are forced into a split config: scalars in env, list options in sqlpage/sqlpage.json.

Environment

• SQLPage 0.45.0 (lovasoa/sqlpage:latest)
• config crate 0.15.4
• Verified on main (0.45.0) — code identical