Modernize artwork review, annotation conversations, and author identity

[digimbyte]

Summary

Modernize Proofing Gallery's public review experience around image details and their conversations. General feedback and pin-specific discussions have separate views, while annotation panels remain beside the relevant detail without dimming the artwork. The interaction design takes inspiration from contextual client/designer review on Fiverr and 99designs.

This is a substantial revision of the lightbox review interface and its authorship model, not a replacement for the existing gallery workflows. It combines the interface changes with account-aware persistence, reliable annotation attachment, and private selection synchronization.

Preview

Illustrative screenshot with sample names and comments.

Review experience

• Separate general feedback and pin conversations. General comments appear newest first beneath the composer. The Pins tab groups replies into expandable conversations; a separate action opens the selected pin's dedicated thread.
• Keep discussion attached to the artwork. Pin creation and existing conversations use the same viewport-aware placement beside the annotation. Feedback panels do not apply a full-screen dimming overlay.
• Support precise inspection. Viewer controls, wheel zoom, touch pinch, and bounded desktop right-button dragging preserve image-relative pin positions. A stationary right-click retains the browser context menu.
• Preserve review-state meaning. The selected value and menu display readable state names with their configured color indicators.
• Simplify comment headers. Author names, localized dates and times, and ownership-dependent edit/delete controls share a consistent layout. Current-user comments remain visually distinct.
• Retain localization. Updated labels use the existing translation system, with English/German translations and corresponding user and administrator documentation.

Lightbox and annotation implementation

PhotoSwipe continues to manage the viewer shell, navigation, focus, and slide sizing. A transform-only surface handles image zoom and panning, with annotations attached to the same surface. Zoom updates do not change the image's layout dimensions or switch its source resolution.

Annotation attachment responds to active-image availability and replacement, rather than depending on a short startup retry window or a slide change. Repeated attachment calls reuse a healthy host, and comment arrival can trigger synchronization. Overlay dimensions update when needed; screen-position calculations are limited to an open composer or selected conversation.

Annotation coordinates retain the normalized image-relative representation at 0.01% precision. Opening a thread from the Pins tab also refreshes its placement.

Identity, permissions, and synchronization

Signed-in contributions use the existing Nextcloud account UID; public guests retain their separate identity and session path. Account-aware attribution is carried through comments, selections, private ratings and decisions, and review-round submission.

• Historical guest comments and pins retain their original guest authorship. Signing in does not claim them or match them to an account by name or email.
• Account identity establishes authorship and ownership, not additional capabilities. Instance, gallery, public-link, and actor-specific restrictions remain authoritative.
• Private feedback remains limited to its author and authorized gallery managers. Guest uploads remain a separate guest-only workflow.
• Owner changes and deletions affecting an account's selection reach the permitted recipient without replacing the event's owner attribution or exposing private feedback to other reviewers.
• Account deletion removes account-authored collaboration data through the existing cleanup path.

The existing collaboration endpoints remain in use.

Database and upgrade behavior

• Version000130Date20260903 adds account-attribution fields, lookup indexes, and account-specific uniqueness constraints. Before enforcing feedback uniqueness, it retains the greatest-ID record for each duplicate gallery/file/kind/account tuple. This cleanup does not remove or reassign historical guest comments or pin conversations.
• Version000140Date20260908 adds a nullable, indexed event recipient UID, keeping private account delivery distinct from the event author's UID.
• Additive user migration accepts empty settings objects. Migration smoke checks report failures through a nonzero exit status.

Complete the normal Nextcloud database upgrade before serving the updated application code.

Validation

CI passed for c6bd6c9, including:

• Frontend lint, type checking, localization checks, unit tests, production build, documentation build, and dependency-audit gate.
• PHP 8.1 and 8.6 lint, tests, static analysis, and dependency audits.
• UI and API browser suites, including mobile pinch/swipe, comment organization, guest isolation, and selection synchronization.
• Nextcloud 31–34 compatibility, package installation, and upgrade checks on MariaDB, SQLite, and PostgreSQL.
• CodeQL, workflow validation, secret-history scanning, and the final CI gate.

The mobile regression scenario also passed five consecutive repetitions, followed by all 20 UI scenarios. Its menu-dismissal assertions now wait for the departing dialog before closing and reopening the viewer, avoiding an ambiguous dialog match without removing gesture coverage.

[digimbyte]

Workflow policy input-path correction

Commit 06a8e77 fixes the cause of the failed Workflow policy audit.

The pinned zizmor action mounts only GITHUB_WORKSPACE at /workspace. The policy staged changed YAML beneath RUNNER_TEMP and passed that host path to the scanner, where it was inaccessible. The failure occurred before any audit.

The patch stages the files under GITHUB_WORKSPACE/pr-workflows, updates actionlint's corresponding paths, and passes pr-workflows as the scanner input. Scanner versions, severity threshold, read-only permissions, and the restriction against checking out or executing PR code are unchanged.

Validation:

• The original path reproduced the same invalid-input failure.
• The exact pinned scanner action successfully audited the corrected workflow input and an action-only input.
• An unsafe template-injection fixture still produced a high-severity failure.
• All 10 script tests, workflow/action YAML validation, and pinned actionlint passed. Regression coverage includes mounted input accessibility, removed files, and path-traversal rejection.

Because this check uses pull_request_target, it runs the trusted base-branch workflow. This correction needs to be applied to upstream's base branch before the policy check on this PR can use it; pushing the PR branch alone does not activate the fix.

[soerennb]

Superseded by #74, which has been merged linearly into main as 3c2e64c719b67d72ca94ad1914236df12bbf1360. The successor passed the required CI Gate and Workflow policy, including frontend/PHP tests, E2E, compatibility, upgrade, package, and secret-scan checks. Closing #71 to keep the original fork PR as historical context.