From e7a99db03bf8e675f211d10e7c513d4de405cccb Mon Sep 17 00:00:00 2001
From: Maurice <mauriceboe@icloud.com>
Date: Sat, 7 Nov 2026 11:22:53 +0100
Subject: [PATCH] fix(privacy): the PDF print view uses the bundled Poppins,
 not Google Fonts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The trip PDF's print view linked Poppins from fonts.googleapis.com, so printing
a trip sent the reader's IP address to Google, the case German courts treated as
a GDPR breach (LG München I, 3 O 17493/20). It now declares the Poppins files
TREK already ships under /fonts, and the content security policy no longer
allows fonts.googleapis.com or fonts.gstatic.com, so no font can be fetched
from Google again by accident.
---
 client/src/components/PDF/TripPDF.tsx     | 7 ++++++-
 server/src/middleware/globalMiddleware.ts | 5 +++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/client/src/components/PDF/TripPDF.tsx b/client/src/components/PDF/TripPDF.tsx
index 3691a3706..51a188faf 100644
--- a/client/src/components/PDF/TripPDF.tsx
+++ b/client/src/components/PDF/TripPDF.tsx
@@ -610,8 +610,13 @@ export async function downloadTripPDF({ trip, days, places, assignments: allStor
 <meta charset="UTF-8">
 <base href="${window.location.origin}/">
 <title>${escHtml(trip?.title || tr('pdf.travelPlan'))}</title>
-<link href="https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,400;0,500;0,600;0,700;1,400&display=swap" rel="stylesheet">
 <style>
+  /* Poppins from this server (client/public/fonts), never from Google: the print view
+     would otherwise send every reader's IP to Google's font servers. */
+  @font-face { font-family: 'Poppins'; font-style: normal; font-weight: 400; font-display: swap; src: url('/fonts/Poppins-Regular.ttf') format('truetype'); }
+  @font-face { font-family: 'Poppins'; font-style: italic; font-weight: 400; font-display: swap; src: url('/fonts/Poppins-Italic.ttf') format('truetype'); }
+  @font-face { font-family: 'Poppins'; font-style: normal; font-weight: 500; font-display: swap; src: url('/fonts/Poppins-Medium.ttf') format('truetype'); }
+  @font-face { font-family: 'Poppins'; font-style: normal; font-weight: 600 700; font-display: swap; src: url('/fonts/Poppins-Bold.ttf') format('truetype'); }
   *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
   body { font-family: 'Poppins', sans-serif; background: #fff; color: #1e293b; -webkit-print-color-adjust: exact; print-color-adjust: exact; }
   svg { -webkit-print-color-adjust: exact; print-color-adjust: exact; }
diff --git a/server/src/middleware/globalMiddleware.ts b/server/src/middleware/globalMiddleware.ts
index aacabcb7e..c150b0661 100644
--- a/server/src/middleware/globalMiddleware.ts
+++ b/server/src/middleware/globalMiddleware.ts
@@ -278,7 +278,8 @@ export function applyGlobalMiddleware(
           // verifying a real .heic upload in a browser, not just deleting the
           // string here.
           scriptSrc: ["'self'", "'wasm-unsafe-eval'", "'unsafe-eval'"],
-          styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com', 'https://unpkg.com'],
+          // No Google Fonts: every font ships with TREK (client/public/fonts), so no reader's IP goes to Google.
+          styleSrc: ["'self'", "'unsafe-inline'", 'https://unpkg.com'],
           imgSrc: ["'self'", 'data:', 'blob:', 'https:'],
           connectSrc: [
             "'self'",
@@ -372,7 +373,7 @@ export function applyGlobalMiddleware(
           // thumbnail answered 404 (#2341). Invisible in dev, where Vite serves the
           // document without this header.
           mediaSrc: ["'self'", 'blob:'],
-          fontSrc: ["'self'", 'https://fonts.gstatic.com', 'data:'],
+          fontSrc: ["'self'", 'data:'],
           // 'self' so same-origin file previews can embed PDFs via <object>/<embed>
           // (Firefox/Chrome enforce object-src; 'none' broke inline PDF previews there).
           objectSrc: ["'self'"],