Add print view, group design and share links #8

Merged

mcp-bot merged 3 commits from feature/setlist-print into develop

2026-11-01 20:45:34 +01:00

mcp-bot commented

2026-11-01 20:43:40 +01:00

Member

Why

A setlist ends up on paper and with people who have no account: musicians, moderators, the venue. It should look like the group's own document on plain A4 and be shareable without opening up the archive, so a public link must show the setlist and nothing else.

What

Print view with @page A4 and @media print: logo, colors and font of the group, repeating table header, rows and headings stay together
Group settings for name, colors, font and logo. Three OFL fonts are vendored, including latin-ext so that names like Dvořák print correctly
Design comes from a CSS route, so the strict CSP needs no inline styles. Colors and font are validated when saved, which rules out CSS injection
Public link /s/<token>: no login, widerrufbar, optional expiry. Shows setlist data only, no archive numbers, comments or files
A new link invalidates the old one. no-store makes revoking take effect at once, no-referrer keeps the token private, the page sets no cookie
Played setlists print their snapshot
Logos as SVG, PNG, JPEG or WebP. SVGs are delivered with Content-Security-Policy: sandbox, so scripts inside do not run when the address is opened directly

Verification

make lint and pytest pass (415 tests), the isolation sweep covers all new routes
Printed to a real PDF with headless Chromium through the share link: A4 (209.9 x 297 mm), three pages, table header repeats, fonts embedded, ř correct, the real group logo renders
Checked in the browser at iPad size: no CSP errors, font and accent color load, no sideways scrolling
Not verified: printing from Safari and iPad

## Why A setlist ends up on paper and with people who have no account: musicians, moderators, the venue. It should look like the group's own document on plain A4 and be shareable without opening up the archive, so a public link must show the setlist and nothing else. ## What - Print view with `@page` A4 and `@media print`: logo, colors and font of the group, repeating table header, rows and headings stay together - Group settings for name, colors, font and logo. Three OFL fonts are vendored, including `latin-ext` so that names like Dvořák print correctly - Design comes from a CSS route, so the strict CSP needs no inline styles. Colors and font are validated when saved, which rules out CSS injection - Public link `/s/<token>`: no login, widerrufbar, optional expiry. Shows setlist data only, no archive numbers, comments or files - A new link invalidates the old one. `no-store` makes revoking take effect at once, `no-referrer` keeps the token private, the page sets no cookie - Played setlists print their snapshot - Logos as SVG, PNG, JPEG or WebP. SVGs are delivered with `Content-Security-Policy: sandbox`, so scripts inside do not run when the address is opened directly ## Verification - `make lint` and `pytest` pass (415 tests), the isolation sweep covers all new routes - Printed to a real PDF with headless Chromium through the share link: A4 (209.9 x 297 mm), three pages, table header repeats, fonts embedded, `ř` correct, the real group logo renders - Checked in the browser at iPad size: no CSP errors, font and accent color load, no sideways scrolling - Not verified: printing from Safari and iPad

mcp-bot added 3 commits

2026-11-01 20:43:41 +01:00