feat(branding): self-hosted webfonts with filesystem scanner

backend/assets/fonts/LICENSE-OFL.txt

@@ -0,0 +1,114 @@
+This directory bundles the following typefaces, each licensed under the
+SIL Open Font License v1.1.
+------------------------------------------------------------
+Per-font copyright notices
+------------------------------------------------------------
+Inter
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+Noto Sans
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-greek-cyrillic)
+Poppins
+Copyright 2020 The Poppins Project Authors (https://github.com/itfoundry/Poppins)
+Jost
+Copyright 2020 The Jost Project Authors (https://github.com/indestructible-type/Jost)
+Montserrat
+Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)
+Playfair Display
+Copyright 2017 The Playfair Display Project Authors (https://github.com/clauseggers/Playfair)
+IBM Plex Sans
+Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
+Comic Neue
+Copyright (c) 2014 by Craig Rozynski. All rights reserved.
+
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

backend/server.js

@@ -449,6 +449,27 @@ app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, se
 // Static file serving for uploads (public - logos, favicons)
 app.use('/uploads', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads')));
 
+// Static file serving for self-hosted webfonts (public — gallery visitors
+// load these via @font-face). Replaces the previous Google Fonts CDN
+// dependency, which leaked visitor IPs to a third party (LG München 2022
+// GDPR ruling).
+//
+// Two mounts in priority order:
+//   1. STORAGE_PATH/fonts/ — runtime user additions (drop a folder, restart)
+//   2. backend/assets/fonts/ — bundled defaults baked into the image
+// Express evaluates handlers in order, so user-supplied files win on overlap.
+const fontStaticOpts = { maxAge: '7d', immutable: true };
+app.use(
+  '/fonts',
+  setCorsHeaders,
+  secureStatic(path.join(storagePath, 'fonts'), fontStaticOpts)
+);
+app.use(
+  '/fonts',
+  setCorsHeaders,
+  secureStatic(path.resolve(__dirname, 'assets/fonts'), fontStaticOpts)
+);
+
 // Debug endpoint to check IP detection (only in development)
 if (process.env.NODE_ENV === 'development') {
   app.get('/api/debug/ip', (req, res) => {
@@ -563,6 +584,7 @@ app.use('/api/v1', require('./src/routes/v1/events'));
 
 app.use('/api/invite', require('./src/routes/acceptInvite'));
 app.use('/api/public/settings', require('./src/routes/publicSettings'));
+app.use('/api/public/fonts', require('./src/routes/publicFonts'));
 app.use('/api/public', require('./src/routes/publicCMS'));
 app.use('/api/images', require('./src/routes/protectedImages'));
 app.use('/api/secure-images', secureImagesRoutes);

backend/src/routes/publicFonts.js

@@ -0,0 +1,24 @@
+const express = require('express');
+const { listFonts } = require('../services/fontsService');
+const logger = require('../utils/logger');
+
+const router = express.Router();
+
+/**
+ * GET /api/public/fonts
+ *
+ * Returns the list of self-hosted font families discovered under
+ * STORAGE_PATH/fonts/. No authentication — gallery visitors need this
+ * to render the chosen theme font.
+ */
+router.get('/', async (req, res) => {
+  try {
+    const fonts = await listFonts();
+    res.json({ fonts });
+  } catch (error) {
+    logger.error('Failed to list fonts', { error: error.message });
+    res.status(500).json({ error: 'Failed to list fonts' });
+  }
+});
+
+module.exports = router;

backend/src/services/fontsService.js

@@ -0,0 +1,172 @@
+const fs = require('fs').promises;
+const path = require('path');
+const logger = require('../utils/logger');
+
+/**
+ * Filesystem-driven font scanner.
+ *
+ * Scans two locations for self-hosted webfonts and merges the results:
+ *
+ *   1. backend/assets/fonts/  — bundled defaults shipped with the repo
+ *      and baked into the Docker image. Visitors get a working font
+ *      picker out of the box, no external CDN, no GDPR exposure.
+ *
+ *   2. STORAGE_PATH/fonts/    — optional runtime additions. Admins drop
+ *      a folder here (via Docker volume / SFTP) and the family appears
+ *      in the picker after the cache TTL expires or the backend restarts.
+ *      User additions WIN over bundled defaults of the same family name —
+ *      this lets a deployment override e.g. with extra weights or a newer
+ *      version without forking the repo.
+ *
+ * Folder layout in either location:
+ *
+ *   <Family-Name>/<weight>.woff2
+ *
+ *   - Folder name → display family with hyphens replaced by spaces:
+ *       "Playfair-Display" → "Playfair Display"
+ *   - Weight files must be named "<integer>.woff2" (e.g. 400.woff2).
+ *     Other names are ignored, family entry still includes its other weights.
+ *
+ * Result is cached in memory for FONTS_CACHE_TTL_MS so frequent
+ * /api/public/fonts hits don't hit disk per request. New folders dropped
+ * into a mount become visible after the TTL or on backend restart.
+ *
+ * Pattern mirrors backend/src/services/uploadSettings.js.
+ */
+
+const FONTS_CACHE_TTL_MS = 30_000;
+
+let cachedFonts = null;
+let fontsCacheExpiresAt = 0;
+
+function getBundledFontsRoot() {
+  // backend/src/services/fontsService.js → backend/assets/fonts
+  return path.resolve(__dirname, '../../assets/fonts');
+}
+
+function getUserFontsRoot() {
+  const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+  return path.join(storagePath, 'fonts');
+}
+
+function familyDisplayName(folderName) {
+  return folderName.replace(/-/g, ' ');
+}
+
+/**
+ * Read one family folder and return { family, weights } or null if the
+ * folder has no usable .woff2 files.
+ */
+async function readFamilyFolder(rootAbs, folderName) {
+  const folderAbs = path.join(rootAbs, folderName);
+  let entries;
+  try {
+    entries = await fs.readdir(folderAbs, { withFileTypes: true });
+  } catch (err) {
+    logger.warn(`[fonts] Could not read family folder ${folderName} in ${rootAbs}: ${err.message}`);
+    return null;
+  }
+
+  const weights = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    if (!entry.name.toLowerCase().endsWith('.woff2')) continue;
+    const stem = entry.name.slice(0, -'.woff2'.length);
+    if (!/^\d+$/.test(stem)) continue; // ignore non-numeric weight names
+    const weight = parseInt(stem, 10);
+    if (weight < 1 || weight > 1000) continue;
+    weights.push(weight);
+  }
+
+  if (weights.length === 0) {
+    logger.warn(`[fonts] Skipping ${folderName} in ${rootAbs}: no usable <weight>.woff2 files`);
+    return null;
+  }
+
+  weights.sort((a, b) => a - b);
+  return { family: familyDisplayName(folderName), weights };
+}
+
+/**
+ * Scan one root directory and return its families as a Map keyed by
+ * lowercased family name (for case-insensitive de-dup against the other
+ * root). Missing directory → empty Map (not an error).
+ */
+async function scanRoot(rootAbs) {
+  let entries;
+  try {
+    entries = await fs.readdir(rootAbs, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return new Map();
+    }
+    throw err;
+  }
+
+  const result = new Map();
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (entry.name.startsWith('.')) continue;
+
+    const family = await readFamilyFolder(rootAbs, entry.name);
+    if (!family) continue;
+
+    const lc = family.family.toLowerCase();
+    if (result.has(lc)) {
+      logger.warn(
+        `[fonts] Duplicate family ${family.family} within ${rootAbs}; ` +
+        `keeping the first encountered folder`
+      );
+      continue;
+    }
+    result.set(lc, family);
+  }
+
+  return result;
+}
+
+/**
+ * List all available font families (bundled + user additions, merged).
+ * Cached for FONTS_CACHE_TTL_MS.
+ *
+ * @returns {Promise<Array<{ family: string, weights: number[] }>>}
+ */
+async function listFonts() {
+  if (Date.now() < fontsCacheExpiresAt && cachedFonts !== null) {
+    return cachedFonts;
+  }
+
+  const bundled = await scanRoot(getBundledFontsRoot());
+  const userAdded = await scanRoot(getUserFontsRoot());
+
+  // User additions override bundled families of the same name.
+  const merged = new Map(bundled);
+  for (const [lc, family] of userAdded) {
+    if (merged.has(lc)) {
+      logger.info(
+        `[fonts] User-supplied ${family.family} overrides bundled default`
+      );
+    }
+    merged.set(lc, family);
+  }
+
+  const families = Array.from(merged.values()).sort((a, b) =>
+    a.family.localeCompare(b.family)
+  );
+
+  cachedFonts = families;
+  fontsCacheExpiresAt = Date.now() + FONTS_CACHE_TTL_MS;
+  return cachedFonts;
+}
+
+function clearFontsCache() {
+  cachedFonts = null;
+  fontsCacheExpiresAt = 0;
+}
+
+module.exports = {
+  listFonts,
+  clearFontsCache,
+  getBundledFontsRoot,
+  getUserFontsRoot
+};