Claude Opus 5
b96997501a
All checks were successful
CI / Build container images (pull_request) Successful in 3m53s
CI / Auth e2e pack (pull_request) Successful in 8m42s
CI / Auth e2e pack (push) Successful in 8m41s
CI / Lint, typecheck, test (pull_request) Successful in 6m30s
CI / Import/export fidelity gate (pull_request) Successful in 58s
CD / Build and push images (push) Successful in 18s
CD / Smoke tests against Test (push) Successful in 1m19s
CD / Deploy to Test (push) Successful in 16s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m41s
CI / Build container images (push) Has been skipped
CI / Import/export fidelity gate (push) Successful in 52s
An operator holding a font licence could only use it by baking the file into a custom image, which tied every change to a rebuild and left the file out of the backup. ADR 0016 said there is no runtime font management. It also listed this exact case under "Alternatives considered" — *may become a Site-Admin- level feature later*. The amendment takes that option and answers the two objections it raised: licensing risk (Site Admins only, licence recorded with the family) and file-format attack surface (magic-byte check and a size cap, never a parse). - `CUSTOM_FONTS_DIR` (default `./data/fonts`) — a sibling of uploads and plugins, NOT inside the image-baked `FONTS_DIR`, where a deploy would overwrite it and no backup would ever see it. - One list of data directories (`apps/backup/src/data-dirs.ts`) now feeds both the nightly archive and the restore, so they cannot drift. #306 and #307 add one line each instead of a second mechanism. - Both Dockerfiles bake the path. The backup image sets its volume paths itself ("self-sufficient without compose env" — #71's lesson) and reads no *_DIR from compose; without the ENV entry the archive would have skipped the directory silently. - The PDF path already read WOFF2 from disk at request time, so it only had to pick the other base directory for a custom family. - `fontStack`/`fontEntry` take the instance's uploaded families as an argument — they are runtime data. The catalog is searched first, and a colliding family name is rejected at upload, so a custom font can never shadow a catalog one. - Deletion is never blocked by usage: an unknown family already falls back to the system stack, so affected ponds degrade instead of breaking. The count of affected ponds travels into the audit entry. - Audit catalogue v1.6 (`font.uploaded`, `font.deleted`). Verified: api full suite against a fresh database, 102 files / 571 tests. The upload suite writes into a real temp directory and reads the bytes back off disk, so the storage layer is exercised rather than mocked. |
||
|---|---|---|
| .. | ||
| 20260704171456_init | ||
| 20260704224132_auth_models | ||
| 20260705090100_ponds | ||
| 20260705185146_quotas | ||
| 20260705200714_pages | ||
| 20260708082627_attachments | ||
| 20260708101011_trash_and_jobs | ||
| 20260709060328_collab_open_sessions | ||
| 20260709062007_page_versions | ||
| 20260709062727_page_version_created_by | ||
| 20260709082418_labels | ||
| 20260709104519_page_links | ||
| 20260709111040_search_vector | ||
| 20260709115727_role_grants | ||
| 20260709140000_owner_admin_grants | ||
| 20260710035316_conversion_jobs | ||
| 20260710041215_import_pages_conversion | ||
| 20260710120000_data_export_expiry | ||
| 20260710130000_plugins | ||
| 20260711100000_setup_completed_backfill | ||
| 20260711180000_audit_log_and_job_duration | ||
| 20260711220000_comments | ||
| 20260711230000_watches | ||
| 20260712000000_notifications | ||
| 20260712010000_digest_frequency | ||
| 20260712020000_api_tokens | ||
| 20260714000000_page_hierarchy | ||
| 20260714120000_conversion_job_options | ||
| 20260716000000_page_favorites | ||
| 20260719223755_page_time_filter_indexes | ||
| 20260719224240_feed_tokens | ||
| 20260719232202_page_mentions | ||
| 20260730120000_drop_attachment_deleted_at | ||
| 20260730140000_clear_trashed_search_vectors | ||
| 20260730170000_prune_conversion_job_payloads | ||
| 20260731090000_attachment_sha256 | ||
| 20260731120000_page_classification | ||
| 20260731150000_read_events | ||
| 20260731160000_read_events_dedup | ||
| 20260731170000_read_events_partitioned | ||
| 20260731190000_idp_claim_mapping | ||
| 20260731210000_plugin_bundle_hash | ||
| 20260801120000_custom_fonts | ||
| migration_lock.toml | ||