Branding customization

app/routes/auth.py

@@ -17,6 +17,9 @@ logger  = logging.getLogger(__name__)
 AVATAR_ALLOWED_EXT = {'png', 'jpg', 'jpeg', 'gif', 'webp'}
 AVATAR_MAX_BYTES   = 5 * 1024 * 1024   # 5 MB
 
+LOGO_ALLOWED_EXT   = {'png', 'jpg', 'jpeg', 'gif', 'webp', 'svg'}
+LOGO_MAX_BYTES     = 2 * 1024 * 1024   # 2 MB
+
 
 def _is_safe_url(target):
     """Return True only when *target* points back to this same host.
@@ -195,3 +198,12 @@ def serve_avatar(filename):
         abort(400)
     upload_dir = current_app.config['UPLOAD_FOLDER']
     return send_from_directory(upload_dir, filename, as_attachment=False)
+
+
+@auth_bp.route('/logo/<string:filename>')
+def serve_logo(filename):
+    """Serve the company logo — publicly accessible (shown on login page)."""
+    if '/' in filename or '\\' in filename or '..' in filename:
+        abort(400)
+    upload_dir = current_app.config['UPLOAD_FOLDER']
+    return send_from_directory(upload_dir, filename, as_attachment=False)