Claude Opus 5
b96997501a
All checks were successful
CI / Build container images (pull_request) Successful in 3m53s
CI / Auth e2e pack (pull_request) Successful in 8m42s
CI / Auth e2e pack (push) Successful in 8m41s
CI / Lint, typecheck, test (pull_request) Successful in 6m30s
CI / Import/export fidelity gate (pull_request) Successful in 58s
CD / Build and push images (push) Successful in 18s
CD / Smoke tests against Test (push) Successful in 1m19s
CD / Deploy to Test (push) Successful in 16s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m41s
CI / Build container images (push) Has been skipped
CI / Import/export fidelity gate (push) Successful in 52s
An operator holding a font licence could only use it by baking the file into a custom image, which tied every change to a rebuild and left the file out of the backup. ADR 0016 said there is no runtime font management. It also listed this exact case under "Alternatives considered" — *may become a Site-Admin- level feature later*. The amendment takes that option and answers the two objections it raised: licensing risk (Site Admins only, licence recorded with the family) and file-format attack surface (magic-byte check and a size cap, never a parse). - `CUSTOM_FONTS_DIR` (default `./data/fonts`) — a sibling of uploads and plugins, NOT inside the image-baked `FONTS_DIR`, where a deploy would overwrite it and no backup would ever see it. - One list of data directories (`apps/backup/src/data-dirs.ts`) now feeds both the nightly archive and the restore, so they cannot drift. #306 and #307 add one line each instead of a second mechanism. - Both Dockerfiles bake the path. The backup image sets its volume paths itself ("self-sufficient without compose env" — #71's lesson) and reads no *_DIR from compose; without the ENV entry the archive would have skipped the directory silently. - The PDF path already read WOFF2 from disk at request time, so it only had to pick the other base directory for a custom family. - `fontStack`/`fontEntry` take the instance's uploaded families as an argument — they are runtime data. The catalog is searched first, and a colliding family name is rejected at upload, so a custom font can never shadow a catalog one. - Deletion is never blocked by usage: an unknown family already falls back to the system stack, so affected ponds degrade instead of breaking. The count of affected ponds travels into the audit entry. - Audit catalogue v1.6 (`font.uploaded`, `font.deleted`). Verified: api full suite against a fresh database, 102 files / 571 tests. The upload suite writes into a real temp directory and reads the bytes back off disk, so the storage layer is exercised rather than mocked.
56 lines
2.1 KiB
TypeScript
56 lines
2.1 KiB
TypeScript
import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
|
|
import { join } from 'node:path';
|
|
|
|
import { Injectable } from '@nestjs/common';
|
|
import type { FontUploadFormat } from '@dorfteich/shared';
|
|
|
|
import { AppConfig } from '../config/app-config.service';
|
|
|
|
/**
|
|
* Filesystem binding for operator-uploaded fonts (issue #303, ADR 0016 §#303).
|
|
*
|
|
* The layout mirrors the baked-in catalog — `<slug>/<slug>-<weight>.woff2` —
|
|
* so the PDF exporter's `@font-face` builder needs no special case beyond
|
|
* choosing the directory.
|
|
*
|
|
* That directory is `CUSTOM_FONTS_DIR`, NOT `FONTS_DIR`: the latter is baked
|
|
* into the image, so anything written there disappears on the next deploy and
|
|
* never reaches a backup. This one is a sibling of the uploads and plugins
|
|
* mounts and travels in the restore set (`apps/backup/src/data-dirs.ts`).
|
|
*/
|
|
@Injectable()
|
|
export class CustomFontStorageService {
|
|
constructor(private readonly config: AppConfig) {}
|
|
|
|
private dirFor(slug: string): string {
|
|
return join(this.config.env.CUSTOM_FONTS_DIR, slug);
|
|
}
|
|
|
|
fileNameFor(slug: string, weight: number, format: FontUploadFormat): string {
|
|
return `${slug}-${weight}.${format}`;
|
|
}
|
|
|
|
pathFor(slug: string, weight: number, format: FontUploadFormat): string {
|
|
return join(this.dirFor(slug), this.fileNameFor(slug, weight, format));
|
|
}
|
|
|
|
async save(slug: string, weight: number, format: FontUploadFormat, bytes: Buffer): Promise<void> {
|
|
await mkdir(this.dirFor(slug), { recursive: true });
|
|
await writeFile(this.pathFor(slug, weight, format), bytes);
|
|
}
|
|
|
|
read(slug: string, weight: number, format: FontUploadFormat): Promise<Buffer> {
|
|
return readFile(this.pathFor(slug, weight, format));
|
|
}
|
|
|
|
/** Removes the family's whole directory. Missing is fine — deletion must
|
|
* stay idempotent so a half-failed upload can still be cleaned up. */
|
|
async deleteFamily(slug: string): Promise<void> {
|
|
await rm(this.dirFor(slug), { recursive: true, force: true });
|
|
}
|
|
|
|
async deleteWeight(slug: string, weight: number, format: FontUploadFormat): Promise<void> {
|
|
await rm(this.pathFor(slug, weight, format), { force: true });
|
|
}
|
|
}
|