Module logo 

Hat logos (kernel spec §5.1; plan 4d-B2). A logo is uploaded as a PNG, at most 64 KiB, and stored and served only as this module re-encodes it: decoded to plain 8-bit pixels, then written afresh as IHDR, IDAT and IEND, so no text, metadata, profile, animation or trailing bytes of the upload survive (the security review’s ruling B: no SVG, no WebP). The browser turns any other format into a PNG before it uploads.

Memory is bounded before anything is allocated by the image’s size: the header alone is read first, and an image over MAX_SIDE pixels either way is refused there (the review’s A2).

Structs

Logo

A logo as it is stored: always a PNG of ours.

StoredLogo

A stored logo, as the logo route serves it.

Enums

Refusal

Why an upload is not a logo. Each has its own status and fixed message at the route; none carries the decoder’s words or the upload’s bytes (the review’s A8).

Constants

MAX_SIDE

The widest and tallest logo, in pixels.

MAX_STORED

The largest logo stored, once re-encoded: a small upload can decode to pixels that compress worse than it did.

MAX_UPLOAD

The largest upload, decoded (kernel spec §5.1).

MIME_PNG

The one kind a logo is stored and served as.

Functions

from_upload

The upload data as a logo: decoded from base64, then re-encoded (reencode) under MAX_STORED.

reencode

input, a PNG, decoded and written afresh: 8-bit, the colour type its pixels have once palettes and transparency are expanded, only IHDR, IDAT and IEND. An animated PNG keeps its first frame. Refused when it is not a PNG, a side is 0 or over MAX_SIDE, the decoder fails, or the result is over max_stored bytes (a parameter, so a test can reach it: the review’s A4).