feat: add custom branding

[Kanashimo]

Allows you to change display name of the website, so you can put your domain or something else there

---

Summary by cubic

Add custom branding so you can change the site name shown in the header via a new environment variable. Defaults to ConvertX and trims long names to 26 characters.

• New Features
  • Added BRANDING env var used for the header title link (default: "ConvertX", max length: 26).
  • Header now accepts a branding prop and uses it for the site name.
  • All main pages pass BRANDING to Header; README updated with the new env var.

^{Written for commit de1295f. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/pages/user.tsx">

<violation number="1" location="src/pages/user.tsx:140">
P2: A `BRANDING` value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into `Header`, whose branding child is unescaped. Escaping the branding text in `Header` (for example with a `safe` innermost element) would prevent a deployment/configuration value from becoming XSS.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: A BRANDING value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into Header, whose branding child is unescaped. Escaping the branding text in Header (for example with a safe innermost element) would prevent a deployment/configuration value from becoming XSS.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/user.tsx, line 140:

<comment>A `BRANDING` value containing HTML can execute script in every rendered auth page because this new wiring feeds the environment value into `Header`, whose branding child is unescaped. Escaping the branding text in `Header` (for example with a `safe` innermost element) would prevent a deployment/configuration value from becoming XSS.</comment>

<file context>
@@ -136,6 +137,7 @@ export const user = new Elysia()
         <>
           <Header
             webroot={WEBROOT}
+            branding={BRANDING}
             accountRegistration={ACCOUNT_REGISTRATION}
             allowUnauthenticated={ALLOW_UNAUTHENTICATED}
</file context>

[C4illin]

Just do a <a href={${webroot}/} safe> to fix it

[C4illin]

the linter should complain

[C4illin]

Looks good! Just fix the lint errors