feat: add custom branding

[Kanashimo]

Allows you to change display name of the website, so you can put your domain or something else there

---

Summary by cubic

Add custom branding so you can change the site name shown in the header via a new environment variable. Defaults to ConvertX and trims long names to 26 characters.

• New Features
  • Added BRANDING env var used for the header title link (default: "ConvertX", max length: 26).
  • Header now accepts a branding prop and uses it for the site name.
  • All main pages pass BRANDING to Header; README updated with the new env var.

^{Written for commit de1295f. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/pages/user.tsx">

<violation number="1" location="src/pages/user.tsx:140">
P2: Fresh installations still show `Welcome to ConvertX!` instead of the configured brand because the `FIRST_RUN` redirect lands on `/setup`, which is not included in this branding wiring. Applying the branding to the setup heading/shell would keep the first-run experience consistent.</violation>

<violation number="2" location="src/pages/user.tsx:140">
P2: A `BRANDING` value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into `Header`, whose branding child is unescaped. Escaping the branding text in `Header` (for example with a `safe` innermost element) would prevent a deployment/configuration value from becoming XSS.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Fresh installations still show Welcome to ConvertX! instead of the configured brand because the FIRST_RUN redirect lands on /setup, which is not included in this branding wiring. Applying the branding to the setup heading/shell would keep the first-run experience consistent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/user.tsx, line 140:

<comment>Fresh installations still show `Welcome to ConvertX!` instead of the configured brand because the `FIRST_RUN` redirect lands on `/setup`, which is not included in this branding wiring. Applying the branding to the setup heading/shell would keep the first-run experience consistent.</comment>

<file context>
@@ -136,6 +137,7 @@ export const user = new Elysia()
         <>
           <Header
             webroot={WEBROOT}
+            branding={BRANDING}
             accountRegistration={ACCOUNT_REGISTRATION}
             allowUnauthenticated={ALLOW_UNAUTHENTICATED}
</file context>

[Kanashimo]

This is intentional, I don't see any sense in change of that

[cubic-dev-ai]

P2: A BRANDING value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into Header, whose branding child is unescaped. Escaping the branding text in Header (for example with a safe innermost element) would prevent a deployment/configuration value from becoming XSS.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/user.tsx, line 140:

<comment>A `BRANDING` value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into `Header`, whose branding child is unescaped. Escaping the branding text in `Header` (for example with a `safe` innermost element) would prevent a deployment/configuration value from becoming XSS.</comment>

<file context>
@@ -136,6 +137,7 @@ export const user = new Elysia()
         <>
           <Header
             webroot={WEBROOT}
+            branding={BRANDING}
             accountRegistration={ACCOUNT_REGISTRATION}
             allowUnauthenticated={ALLOW_UNAUTHENTICATED}
</file context>