fix(og): the card was a serif name on an empty field — give it the subnet's mark and the brand face - #11494
Merged
Merged
Conversation
…bnet's mark and the brand face Three defects in the first cut, all visible only in the rendered image: THE FONT WAS A FALLBACK, not a choice. `ImageResponse` without `fonts` renders in its own default and the shipped card came out in a serif, which is not the wordmark's typeface. The Node path never showed this because scripts/refresh-og-image.ts passes satori the fonts explicitly. Space Grotesk is now loaded through workers-og's own `loadGoogleFont`, subset to the glyphs the card draws. THE CARD DID NOT FILL THE CANVAS. `width:100%;height:100%` left a white band down the right edge and along the bottom: satori resolves a percentage against the parent it is given, and workers-og does not hand it one the way the Node satori call does. Fixed 1200x630 is the canvas either renderer is asked for, so it cannot disagree with itself. IT CARRIED NO IDENTITY. A name on a flat field, with the wordmark spelled out beside our own icon. The registry already holds `logo_url` for 60 of 129 subnets -- on our own cache, so inlining one is not a third-party fetch -- and the card now draws it. The other 69 get a numbered badge, and the footer is the icon alone: the wordmark said in text what the mark already says. THE MARK IS THE NETUID, NOT THE ALPHA SYMBOL. The symbol was the obvious choice and is the subnet's on-chain identity, but those symbols are Greek, Cyrillic and Arabic letters and Space Grotesk is Latin-only -- rendered, subnet 1's `α` came out as `?`. Loading a font per subnet to cover one glyph is not a trade worth making for a link preview, and a `?` on the cards of the subnets with the least identity is the worst possible place for one. The logo fetch is allowlisted to https on our own logo host and nothing else. `logo_url` is a registry row a contributor can edit, so without that the row points this Worker at any host it likes and the render inlines whatever comes back. Five tests cover the allowlist, including a subdomain that only looks like ours; the off-host cases assert the request never leaves. A logo that will not load is not a failed card -- it falls through to the badge. The digest keys on the logo URL rather than its bytes, because that URL is content-addressed by the logo cache already. Startup CPU re-measured after the change: 283/301/319 ms against a ~400 ms limit, unchanged from the 313 ms baseline -- the font and logo work happens in the handler, not at module scope.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metagraphed-wss-lb | 7f206c6 | Aug 19 2026, 11:21 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metagraphed-data-api | 7f206c6 | Aug 19 2026, 11:21 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metagraphed-registry-sync-api | 7f206c6 | Aug 19 2026, 11:21 AM |
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #11494 +/- ##
==========================================
+ Coverage 95.63% 95.65% +0.01%
==========================================
Files 788 788
Lines 46902 46926 +24
Branches 17223 17236 +13
==========================================
+ Hits 44857 44886 +29
+ Misses 531 527 -4
+ Partials 1514 1513 -1
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three defects in #11493's first cut, all visible only in the rendered image — which is why I rendered it rather than trusting the exit code.
The font was a fallback, not a choice
ImageResponsewithoutfontsrenders in its own default, and the shipped card came out in a serif — not the wordmark's typeface, and it read as a different product. The Node path never showed this becausescripts/refresh-og-image.tspasses satori the fonts explicitly.Space Grotesk now loads through workers-og's own
loadGoogleFont, subset to the glyphs the card actually draws.It did not fill the canvas
width:100%;height:100%left a white band down the right edge and along the bottom: satori resolves a percentage against the parent it is given, and workers-og does not hand it one the way the Node call does. A fixed 1200×630 is the canvas either renderer is asked for, so it cannot disagree with itself.It carried no identity
A name on a flat field, with "Metagraphed" spelled out next to our own icon. The registry already holds
logo_urlfor 60 of 129 subnets — on our own cache, so inlining one is not a third-party fetch. The card draws it now. The other 69 get a numbered badge, and the footer is the icon alone: the wordmark was saying in text what the mark already says.The mark is the netuid, not the alpha symbol
The symbol was the obvious choice and is the subnet's on-chain identity — but those symbols are Greek, Cyrillic and Arabic, and Space Grotesk is Latin-only. Rendered, subnet 1's
αcame out as?. Loading a font per subnet to cover one glyph is not a trade worth making for a link preview, and a?on the cards belonging to the subnets with the least identity is the worst possible place for one.The logo fetch is allowlisted
logo_urlis a registry row a contributor can edit. Without an allowlist that row points this Worker at any host it likes and the render inlines whatever comes back — an SSRF with an image on the end of it.https on our own logo host, nothing else. Five tests cover it, including
metagraph.sh.evil.example— a subdomain that only looks like ours — and the off-host cases assert the request never leaves.A logo that will not load is not a failed card: it falls through to the badge. The digest keys on the logo URL rather than its bytes, because that URL is content-addressed by the logo cache already.
Startup CPU, re-measured
283 / 301 / 319 ms against the ~400 ms limit — unchanged from the 313 ms baseline. The font and logo work happens in the handler, not at module scope.
Verification
Full suite 960 files / 22,106 passed, build, lint, format, all 72 CI validators, patch coverage 100% (21/21 lines, 28/28 branches). Both variants rendered and inspected before pushing.