allow custom css

Overlord-Server/src/server/routes/assets-routes.ts

@@ -1,4 +1,5 @@
 import path from "path";
+import { getConfig } from "../../config";
 
 type AssetsRouteDeps = {
   PUBLIC_ROOT: string;
@@ -11,6 +12,16 @@ export async function handleAssetsRoutes(
   url: URL,
   deps: AssetsRouteDeps,
 ): Promise<Response | null> {
+  if (req.method === "GET" && url.pathname === "/assets/custom.css") {
+    const css = getConfig().appearance?.customCSS || "";
+    return new Response(css, {
+      headers: {
+        "Content-Type": "text/css; charset=utf-8",
+        "Cache-Control": "no-cache",
+      },
+    });
+  }
+
   if (req.method === "GET" && url.pathname === "/favicon.ico") {
     const file = Bun.file(path.join(deps.PUBLIC_ROOT, "assets", "favicon.ico"));
     if (await file.exists()) {

Overlord-Server/src/server/routes/misc-routes.ts

@@ -1,6 +1,6 @@
 import { authenticateRequest } from "../../auth";
 import { AuditAction, getAuditLogs, logAudit } from "../../auditLog";
-import { getConfig, updateSecurityConfig, updateTlsConfig } from "../../config";
+import { getConfig, updateSecurityConfig, updateTlsConfig, updateAppearanceConfig } from "../../config";
 import { getClientMetricsSummary } from "../../db";
 import { metrics } from "../../metrics";
 import { requirePermission } from "../../rbac";
@@ -397,6 +397,50 @@ export async function handleMiscRoutes(
     );
   }
 
+  if (url.pathname === "/api/settings/appearance") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response("Unauthorized", { status: 401 });
+    }
+    if (user.role !== "admin") {
+      return new Response("Forbidden: Admin access required", { status: 403 });
+    }
+
+    if (req.method === "GET") {
+      return Response.json(
+        { customCSS: getConfig().appearance?.customCSS || "" },
+        { headers: deps.CORS_HEADERS },
+      );
+    }
+
+    if (req.method === "PUT") {
+      let body: any = {};
+      try {
+        body = await req.json();
+      } catch {
+        return Response.json({ error: "Invalid JSON" }, { status: 400 });
+      }
+
+      const customCSS = typeof body?.customCSS === "string" ? body.customCSS : "";
+      if (customCSS.length > 51200) {
+        return Response.json({ error: "CSS exceeds 50 KB limit" }, { status: 400 });
+      }
+
+      const updated = await updateAppearanceConfig(customCSS);
+
+      logAudit({
+        timestamp: Date.now(),
+        username: user.username,
+        ip: deps.requestIP?.(req)?.address || "unknown",
+        action: AuditAction.COMMAND,
+        details: "Updated custom CSS",
+        success: true,
+      });
+
+      return Response.json({ ok: true, customCSS: updated.customCSS }, { headers: deps.CORS_HEADERS });
+    }
+  }
+
   if (req.method === "GET" && url.pathname === "/api/cert/download" && deps.tlsCertPath) {
     try {
       const file = Bun.file(deps.tlsCertPath);