fix(export): don't serve stale PDF fonts after a font file changes

Review feedback on #8249.

`readFontFile()` cached both font buffers and read failures forever,
keyed only by path. An operator who corrected a wrong `exportPdfFonts`
path, or replaced a face in place, kept getting the old bytes — or the
fallback — until Etherpad was restarted.

The cache now keys on the file's mtime and size as well as its path, and
failures are not cached at all, so a font that appears or changes at a
configured path is picked up by the next export. One `stat` per font
variant per export.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

Author: JohnMcLear

src/node/utils/ExportPdfNative.ts

@@ -228,18 +228,33 @@ const getFontConfig = (): Map<string, PdfFontFiles> => {
 
 // Font files are read once per process; a pad export can reference the same
 // family hundreds of times and every PDFDocument needs its own registration.
-const fontFileCache = new Map<string, Buffer | null>();
+// The cache is keyed by the file's mtime and size as well as its path, so
+// replacing a font in place — or dropping in one whose path was previously
+// wrong — takes effect on the next export without restarting Etherpad.
+// Failures are deliberately not cached, for the same reason.
+const fontFileCache = new Map<string, {stamp: string, buf: Buffer}>();
 
 const readFontFile = (file: string): Buffer | null => {
-  if (fontFileCache.has(file)) return fontFileCache.get(file)!;
-  let buf: Buffer | null = null;
+  let stamp: string;
+  try {
+    const st = fs.statSync(file);
+    stamp = `${st.mtimeMs}:${st.size}`;
+  } catch (err) {
+    logger.warn(`PDF export: cannot read font file "${file}": ${(err as Error).message}`);
+    fontFileCache.delete(file);
+    return null;
+  }
+  const cached = fontFileCache.get(file);
+  if (cached && cached.stamp === stamp) return cached.buf;
+  let buf: Buffer;
   try {
     buf = fs.readFileSync(file);
   } catch (err) {
     logger.warn(`PDF export: cannot read font file "${file}": ${(err as Error).message}`);
-    buf = null;
+    fontFileCache.delete(file);
+    return null;
   }
-  fontFileCache.set(file, buf);
+  fontFileCache.set(file, {stamp, buf});
   return buf;
 };
 

src/tests/backend/specs/export.ts

@@ -817,6 +817,43 @@ hello<br>world
               ['Helvetica']);
         });
 
+        it('picks up a font file that appears or changes on disk',
+            async function () {
+              // The font cache keys on mtime+size, so an operator can correct
+              // a wrong path or swap a face in place and the next export uses
+              // it — no restart, and no cached failure to clear.
+              const os = require('os');
+              const fs = require('fs');
+              const path = require('path');
+              const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ep8245-'));
+              const target = path.join(dir, 'face.ttf');
+              const fontDir = path.join(__dirname, '../../../static/font');
+              try {
+                settings.exportPdfFonts = {'Swappable': target};
+                // Nothing there yet: falls back rather than failing.
+                assert.deepStrictEqual(
+                    await baseFonts("<p><span style='font-family:Swappable'>t</span></p>"),
+                    ['Helvetica'], 'a missing file should fall back');
+
+                fs.copyFileSync(path.join(fontDir, 'Quicksand-Regular.ttf'), target);
+                assert.deepStrictEqual(
+                    await baseFonts("<p><span style='font-family:Swappable'>t</span></p>"),
+                    ['Quicksand-Regular'],
+                    'a file appearing at the configured path should be picked up');
+
+                fs.copyFileSync(path.join(fontDir, 'RobotoMono-Regular.ttf'), target);
+                // Guarantee a different mtime even on a coarse-grained clock.
+                const later = new Date(Date.now() + 2000);
+                fs.utimesSync(target, later, later);
+                assert.deepStrictEqual(
+                    await baseFonts("<p><span style='font-family:Swappable'>t</span></p>"),
+                    ['RobotoMono-Regular'],
+                    'a replaced file should not serve the previous bytes');
+              } finally {
+                fs.rmSync(dir, {recursive: true, force: true, maxRetries: 10, retryDelay: 100});
+              }
+            });
+
         it('overrides the built-in mapping for a known family',
             async function () {
               settings.exportPdfFonts = {