Add business logo branding support

src/app/api/i/[token]/pdf/route.ts

@@ -7,7 +7,7 @@ import { generateInvoicePDFBlob } from "~/lib/pdf-export";
 export const runtime = "nodejs";
 
 export async function GET(
-  _request: Request,
+  request: Request,
   { params }: { params: Promise<{ token: string }> },
 ) {
   const { token } = await params;
@@ -16,7 +16,28 @@ export async function GET(
     where: eq(invoices.publicToken, token),
     with: {
       client: true,
-      business: true,
+      // Explicit allowlist: token-based public route — never fetch
+      // secret fields (resendApiKey, resendDomain) for an unauthenticated request.
+      business: {
+        columns: {
+          id: true,
+          name: true,
+          nickname: true,
+          email: true,
+          phone: true,
+          addressLine1: true,
+          addressLine2: true,
+          city: true,
+          state: true,
+          postalCode: true,
+          country: true,
+          website: true,
+          taxId: true,
+          logoStorageKey: true,
+          logoMimeType: true,
+          hideNameWithLogo: true,
+        },
+      },
       items: {
         orderBy: (i, { asc }) => [
           asc(i.date),
@@ -39,19 +60,27 @@ export async function GET(
     where: eq(platformSettings.id, "global"),
   });
 
-  const pdfBlob = await generateInvoicePDFBlob(invoice, {
-    pdfTemplate: settings?.pdfTemplate as "classic" | "minimal" | undefined,
-    pdfAccentColor: settings?.pdfAccentColor,
-    pdfFontFamily: settings?.pdfFontFamily as "sans" | "serif" | "mono" | undefined,
-    pdfNumericFontFamily: settings?.pdfNumericFontFamily as
-      | "sans"
-      | "serif"
-      | "mono"
-      | undefined,
-    pdfFooterText: settings?.pdfFooterText,
-    pdfShowLogo: settings?.pdfShowLogo,
-    pdfShowPageNumbers: settings?.pdfShowPageNumbers,
-  });
+  const pdfBlob = await generateInvoicePDFBlob(
+    invoice,
+    {
+      pdfTemplate: settings?.pdfTemplate as "classic" | "minimal" | undefined,
+      pdfAccentColor: settings?.pdfAccentColor,
+      pdfFontFamily: settings?.pdfFontFamily as
+        | "sans"
+        | "serif"
+        | "mono"
+        | undefined,
+      pdfNumericFontFamily: settings?.pdfNumericFontFamily as
+        | "sans"
+        | "serif"
+        | "mono"
+        | undefined,
+      pdfFooterText: settings?.pdfFooterText,
+      pdfShowLogo: settings?.pdfShowLogo,
+      pdfShowPageNumbers: settings?.pdfShowPageNumbers,
+    },
+    { logoBaseUrl: new URL(request.url).origin },
+  );
 
   const buffer = await pdfBlob.arrayBuffer();
   const filename = `invoice-${invoice.invoiceNumber}.pdf`;