Upload 38 files

package.json

@@ -8,7 +8,8 @@
   "scripts": {
     "start": "node src/server.js",
     "dev": "nodemon src/server.js",
-    "seed": "node src/seed/seed.js"
+    "seed": "node src/seed/seed.js",
+    "upload-watermark-logo": "node scripts/uploadWatermarkLogo.js"
   },
   "engines": {
     "node": ">=18.0.0"

scripts/uploadWatermarkLogo.js

@@ -0,0 +1,50 @@
+/**
+ * One-time setup script: uploads the white Aynwerd logo to Cloudinary
+ * as a plain (public) image asset, so it can be referenced as an
+ * overlay layer when watermarking lesson videos (see
+ * src/utils/cloudinaryUpload.js -> buildWatermarkTransformation).
+ *
+ * This is NOT a course asset — it's not sensitive and isn't uploaded
+ * with `type: "authenticated"` — it just needs a stable public_id that
+ * the video-overlay transformation can reference.
+ *
+ * Usage (run once, from server/):
+ *   node scripts/uploadWatermarkLogo.js
+ *
+ * Requires the same CLOUDINARY_* env vars as the rest of the app
+ * (loaded via .env / your host's secrets, same as normal).
+ *
+ * If you ever want to swap the logo image, just re-run this script —
+ * `overwrite: true` means it replaces the existing asset at the same
+ * public_id, so no code changes are needed afterwards.
+ */
+require("dotenv").config();
+const path = require("path");
+const cloudinary = require("../src/config/cloudinary");
+
+const LOGO_PATH = path.join(__dirname, "assets", "aynwerd-watermark-logo.png");
+const PUBLIC_ID = process.env.CLOUDINARY_WATERMARK_LOGO_PUBLIC_ID || "aynwerd_watermark_logo";
+
+async function main() {
+  console.log(`Uploading ${LOGO_PATH} to Cloudinary as "${PUBLIC_ID}"...`);
+
+  const result = await cloudinary.uploader.upload(LOGO_PATH, {
+    public_id: PUBLIC_ID,
+    resource_type: "image",
+    type: "upload", // public delivery — this is just a logo, not course content
+    overwrite: true,
+    invalidate: true,
+  });
+
+  console.log("Done. Watermark logo is live at public_id:", result.public_id);
+  console.log(
+    "If you set a custom CLOUDINARY_WATERMARK_LOGO_PUBLIC_ID, make sure it matches this value in your server env."
+  );
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((err) => {
+    console.error("Failed to upload watermark logo:", err.message);
+    process.exit(1);
+  });

src/controllers/content.controller.js

@@ -51,6 +51,7 @@ async function getLessonAccess(req, res, next) {
 
     const { url, expiresAt } = getSignedPlaybackUrl(lesson.cloudinaryPublicId, lesson.cloudinaryResourceType, {
       format: lesson.format,
+      viewer: { name: req.user.name, email: req.user.email },
     });
 
     await AuditLog.create({

src/utils/cloudinaryUpload.js

@@ -3,6 +3,11 @@ const cloudinary = require("../config/cloudinary");
 
 const FOLDER = "aynwerd-courses";
 
+// Public ID of the white Aynwerd logo, uploaded once (see
+// scripts/uploadWatermarkLogo.js) as a plain, non-secret image asset —
+// it's only ever used as an overlay layer, never served on its own.
+const WATERMARK_LOGO_PUBLIC_ID = process.env.CLOUDINARY_WATERMARK_LOGO_PUBLIC_ID || "aynwerd_watermark_logo";
+
 // Cloudinary's chunked `upload_large` is meant for genuinely large
 // files (their own docs point to it for anything that risks a single
 // request timing out or exceeding size limits — 100MB+ in practice).
@@ -55,12 +60,67 @@ function deleteAsset(publicId, resourceType) {
   return cloudinary.uploader.destroy(publicId, { resource_type: resourceType, type: "authenticated" });
 }
 
+/**
+ * Builds the overlay layers that stamp a video with the viewing
+ * learner's identity plus the Aynwerd logo, so any leaked/recorded
+ * copy is traceable back to the account it leaked from and is visibly
+ * branded as Aynwerd's property. Applied at request time, per viewer —
+ * nothing pre-baked, so the same source video is watermarked
+ * differently for every learner who opens it.
+ *
+ * The identity text is stamped in two opposite corners (not just one)
+ * so a casual crop/re-frame of the recording doesn't remove it
+ * entirely.
+ */
+function buildWatermarkTransformation({ name, email }) {
+  const label = `${name} • ${email}`;
+  const textLayer = (gravity) => ({
+    overlay: {
+      font_family: "Arial",
+      font_size: 20,
+      font_weight: "bold",
+      text: label,
+    },
+    color: "white",
+    opacity: 45,
+    gravity,
+    x: 18,
+    y: 18,
+  });
+
+  return [
+    textLayer("north_west"),
+    textLayer("south_east"),
+    {
+      overlay: { public_id: WATERMARK_LOGO_PUBLIC_ID, resource_type: "image" },
+      width: 130,
+      opacity: 40,
+      gravity: "south_west",
+      x: 18,
+      y: 18,
+    },
+  ];
+}
+
 /**
  * Mints a short-lived, signed URL for a specific lesson asset. Valid for
  * a couple of hours only, so a leaked link stops working quickly and
  * cannot be redistributed as a permanent download.
+ *
+ * When `viewer` is provided and the asset is a video, the URL also
+ * carries a per-viewer watermark transformation (see
+ * buildWatermarkTransformation above) — Cloudinary renders that
+ * watermarked derivative on the fly and signs the transformed URL, so
+ * the overlay can't be stripped without the original signed request.
+ * Watermarking only applies to video; document/raw lessons (PDFs,
+ * slides) are returned unmodified since Cloudinary can't overlay text
+ * on a raw file delivery the same way.
  */
-function getSignedPlaybackUrl(publicId, resourceType, { format, expiresInSeconds = 2 * 60 * 60 } = {}) {
+function getSignedPlaybackUrl(
+  publicId,
+  resourceType,
+  { format, expiresInSeconds = 2 * 60 * 60, viewer } = {}
+) {
   const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
   const url = cloudinary.url(publicId, {
     resource_type: resourceType,
@@ -69,6 +129,7 @@ function getSignedPlaybackUrl(publicId, resourceType, { format, expiresInSeconds
     secure: true,
     expires_at: expiresAt,
     format: format || undefined,
+    transformation: resourceType === "video" && viewer ? buildWatermarkTransformation(viewer) : undefined,
   });
   return { url, expiresAt };
 }