Paper-doll character portrait compositor

.clj-kondo/config.edn

@@ -97,6 +97,13 @@
            :unresolved-symbol
            {:exclude
             [read-string
+             ;; test macros that bind their first argument -- clj-kondo cannot
+             ;; see through them, so each use reads as an unresolved symbol
+             (orcpub.portrait-credit-test/with-conn)
+             (orcpub.portrait-og-test/with-conn)
+             (orcpub.portrait-artists-endpoint-test/with-conn)
+             (orcpub.portrait-store-test/with-conn)
+             (orcpub.page-escape-test/with-conn)
              (clojure.test.check.clojure-test/defspec)
              (clojure.core.match/match)
              (cljs.core.match/match)
@@ -132,6 +139,8 @@
              (orcpub.routes.share-test/with-conn)
              (orcpub.routes.party-test/with-conn)
              (orcpub.heartbeat-test/with-conn)
+             (orcpub.artist-accounts-test/with-conn)
+             (orcpub.artist-credit-test/with-conn)
              (user/with-db)]}}
  ;; native/cljs and web/cljs are separate source roots; kondo doesn't know
  ;; about them so ns names appear to mismatch their file paths.

.env.example

@@ -122,6 +122,25 @@ EMAIL_TLS=FALSE
 # to be empty; ignored otherwise. Private instances only.
 ALLOW_UNVERIFIED_REGISTRATION=false
 
+# --- Preferred names and portrait artists ---
+# Encrypts the preferred names people give on My Account. Comma-separated id:key pairs, each
+# key 32 random bytes in base64; the first encrypts, all decrypt (put a new key first to
+# rotate). Keep it safe: lose it and stored names cannot be read. Without it, preferred
+# names cannot be saved. Generate: echo "k1:$(openssl rand -base64 32)"
+PROFILE_ENCRYPTION_KEYS=
+#
+# Portrait artist credits and accounts, as JSON (see ARTISTS.md). An "account" email gets an
+# artist account and a welcome email when the server starts, so leave real addresses out of
+# a test server unless that is wanted. Artist emails link to APP_URL (Branding, below).
+# PORTRAIT_ARTISTS={"house-pack": {"name": "Fusspot", "account": "artist@example.test"}}
+# Who hears about artist account changes (falls back to EMAIL_ERRORS_TO).
+# EMAIL_ADMIN_TO=
+#
+# Where the server keeps its drawings of shared-link portraits (default: orcpub-portraits in the
+# system temp directory, which the Docker image's user can write). Point several containers at one shared volume and each portrait is
+# drawn once for all of them. They are derived files: deleting them only means they are drawn again.
+# PORTRAIT_STORE_DIR=/var/lib/orcpub/portraits   (mount a shared volume there; the image owns it for the app)
+
 # --- Branding (optional) ---
 # Override app identity for forks. All have sensible defaults in fork/branding.clj.
 # APP_NAME=Dungeon Master's Vault

.github/workflows/portrait-art-guard.yml

@@ -0,0 +1,32 @@
+# Guard: the licensed portrait art lives only on the private deployment branch (Gitea), never
+# here. scripts/private-art.sh writes resources/public/image/portraits/PRIVATE-ART when it lays
+# the art in, so a push or pull request carrying that marker is the private branch arriving in
+# the public repository. Art committed without the marker is caught by scripts/check-images.sh
+# (and orcpub.portrait-art-guard-test): every image, anywhere, must be a recorded silhouette or a
+# reviewed image.
+
+name: Portrait art guard
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  no-private-art:
+    name: No private portrait art
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: The private-art marker must not be in the public repository
+        run: |
+          if [ -e resources/public/image/portraits/PRIVATE-ART ]; then
+            echo "::error file=resources/public/image/portraits/PRIVATE-ART::This branch carries the licensed portrait art. It belongs only on the private deployment branch. Remove it from GitHub (and from the history if it was pushed) and tell the art owner."
+            exit 1
+          fi
+          echo "OK - no private portrait art on $GITHUB_REF_NAME."
+      - name: Every image is a recorded silhouette or reviewed
+        run: scripts/check-images.sh

.gitignore

@@ -143,3 +143,6 @@ _*.js
 # Python bytecode from scripts/ (scripts/lint-changelog.py is run, not imported)
 __pycache__/
 *.pyc
+
+# strand fields are derived from the real portrait art and travel with it
+resources/public/image/portraits/**/*.strands.png

ARTISTS.md

@@ -0,0 +1,139 @@
+# Artists
+
+The portrait art in this repository was drawn by hand. It is not generated.
+
+## Fusspot
+
+- Site: <https://fusspot.rip/>
+- Twitch: <https://www.twitch.tv/fusspot> — where most of the work happens, live
+
+These are the two she asked to be listed. She has others; they are on her site,
+which is the point of linking it.
+
+Every portrait layer in `resources/public/image/portraits/` is Fusspot's work:
+the heads, hair, ears, eyes, noses, mouths and shirts that the portrait maker
+composes.
+
+The files currently committed are **silhouettes** — alpha shapes derived from
+her drawings, at the source proportions, without line detail. They are derived
+works of her art and carry the same credit. The full line art replaces them at
+the same paths.
+
+`scalp/l2b_scalp_01.png` is the one exception: a generated blob that fills a
+gap between two hair pieces. Its shape is derived from hers, so it is listed
+here for completeness rather than claimed as anyone's drawing.
+
+## How the credit is rendered
+
+`orcpub.dnd.e5.portrait-assets/credit-line` produces one line — `Art: Fusspot`
+— and the character sheet, the share card and the portrait summary all use it,
+so the three always say the same thing. Attribution resolves **per asset**, so
+a portrait built from two artists' pieces credits both.
+
+An artist who has not said how they want to be credited is skipped rather than
+given a byline nobody chose.
+
+`:artist/link` is the single link, for surfaces that can only hold one -- the
+character-page credit is a 100px strip. It points at the artist's own homepage,
+because that is the list they maintain, so it cannot go stale the way a copied
+handle can.
+
+`:artist/links` is the full labelled set and appears only in the builder, which
+has room. It is chosen with the artist rather than harvested from their site:
+these are the accounts they want on this work, not every account they have.
+
+Neither is part of `credit-line`. That string is burned into share-card PNGs
+and PDF sheets, where a URL cannot be followed, and it would ride along on
+every copy of somebody else's character.
+
+## For forks
+
+A deployment can restate a credit without editing shared code, via
+`PORTRAIT_ARTISTS`:
+
+```
+PORTRAIT_ARTISTS='{"house-pack": {"name": "…", "link": "https://…"}}'
+```
+
+Only `name`, `link`, `links` and `license` are honoured. Which artist drew which asset
+is structural, lives in the registry, and is not overridable — a configuration
+cannot quietly re-attribute someone's work to a different pack.
+
+**This does not grant a licence.** If you fork this repository, the art is
+still Fusspot's. Ask her before shipping it.
+
+## Artist accounts
+
+An artist can have an account that controls how they're credited: their
+name, where it links, and which link icons sit beside it. The account can't
+change which art is theirs. That stays in the registry.
+
+There's no admin page and no invite endpoint. Accounts come from the same
+`PORTRAIT_ARTISTS` entry as the credit, read when the server starts:
+
+```
+PORTRAIT_ARTISTS='{"house-pack": {
+  "name": "Fusspot",
+  "account": "hello@fusspot.rip",
+  "username": "fusspot",
+  "preferred_name": "Fuss",
+  "welcome_subject": "We did it, Fuss! Your art is officially on OrcPub",
+  "welcome_note": "We did it! Your art is officially on OrcPub! …"
+}}'
+```
+
+On each start:
+
+| The address has…                  | What happens                                                            |
+|-----------------------------------|-------------------------------------------------------------------------|
+| no account                        | one is made and linked, and a welcome email with a set-password link that lasts a week is sent |
+| a confirmed account               | it's linked, and an upgrade email is sent                               |
+| an unconfirmed account            | it is claimed: given a new random password and linked, and the welcome email is sent to the address, so only the address's owner can get in |
+| an account that's already linked  | nothing, so restarts never resend (a welcome the mail server refused is sent again) |
+
+Only `account` is needed; the rest just make the welcome warmer. Changing
+`account` moves the link to the new address and tells the old account.
+`"account": null` removes the link. Deleting the entry does nothing, so a
+bad edit can't quietly strip an artist's access. Several containers
+starting together make one account and send one email.
+
+What the site shows is layered, and later layers win field by field:
+
+1. the registry in `portrait_assets.cljc` (the public default)
+2. the artist's own edits, from My Account → Artist credit
+3. `name`, `link` and `links` in `PORTRAIT_ARTISTS`
+
+So you can always correct a credit from config without touching the
+account. Fields the config sets show as fixed on the artist's settings
+page. Every edit is emailed to the artist and to the admin.
+
+### Settings these need
+
+| Setting                         | For                                                                 |
+|---------------------------------|---------------------------------------------------------------------|
+| `APP_URL`                       | links in the startup emails; without it they're skipped (logged) and the artist can use "Forgot password" |
+| `EMAIL_SERVER_URL` etc.         | sending anything at all                                             |
+| `EMAIL_ADMIN_TO`                | the admin's copies; falls back to `EMAIL_ERRORS_TO`                  |
+| `APP_EMAIL_SIGNOFF`             | who the warmer emails are signed from (default "The <sender name>") |
+| `PROFILE_ENCRYPTION_KEYS`       | preferred names (see below); a Docker secret `profile_encryption_keys` takes precedence |
+
+## Preferred names
+
+Every account can set "What should we call you?" on My Account. Site emails
+open with it ("Hi Kaylee,") and say "Hi there," without it.
+
+It's **encrypted, not hashed**: a hash can't be read back, and the site has
+to write the name into the email. The database holds only ciphertext, and
+the key lives outside it, so a copied database or backup doesn't reveal the
+names. A compromised app server still could, because it holds the key.
+
+```
+# one key: id:base64 of 32 random bytes
+PROFILE_ENCRYPTION_KEYS="k1:$(openssl rand -base64 32)"
+```
+
+Prefer the Docker secret `profile_encryption_keys` in swarm. To rotate, put a
+new key first and keep the old ones after it (`k2:…,k1:…`); the first
+encrypts and all of them decrypt. **Losing every key loses the names**, and
+only the names: they fall back to "Hi there,". With no key set the field says
+it isn't available yet, and nothing is ever stored readable.

CHANGELOG.md

@@ -12,7 +12,7 @@ House style and the branch → release fold: [`docs/branch-changelog.template.md
 
 ### Highlights
 
-Homebrew can be moved, switched off and repaired instead of lost, and a character that used to blank the page now recovers. Characters can be shared with the homebrew they use, printed sheets no longer drop spells and gain a spellbook, and accounts get new sign-in pages and stronger password rules. A new Rules tab holds the SRD's rules and conditions, with links that preview a spell, condition or rule as you read.
+Homebrew can be moved, switched off and repaired instead of lost, and a character that used to blank the page now recovers. Characters can be shared with the homebrew they use and given a portrait drawn from an illustrator's layered art, printed sheets no longer drop spells and gain a spellbook, and accounts get new sign-in pages and stronger password rules. A new Rules tab holds the SRD's rules and conditions, with links that preview a spell, condition or rule as you read.
 
 ### Added
 
@@ -48,6 +48,26 @@ Homebrew can be moved, switched off and repaired instead of lost, and a characte
 - **Rules:** clarification notes on rules, in our own words, linked to where Wizards published
   the ruling.
 - **Spells:** conditions named in spell and magic item text link to their page, with a preview.
+- **Characters:** a portrait builder: pick or randomize layered art for hair, head, ears, eyes,
+  nose, mouth and shirt, from the summary thumbnail, beside the Image URL field, or in a Portrait
+  tab in the builder.
+- **Characters:** portrait colours per character for hair, skin, eyes, eye whites, lips and shirt,
+  with a lighter, darker or different colour for any single piece.
+- **Characters:** hair ombré with streaks that follow the drawn strands, a shine you can place,
+  dyed bangs, and soft shadows where hair falls over the face.
+- **Characters:** eyes with slit or goat pupils, a different colour for each eye, brightness, and
+  glowing eyes.
+- **Characters:** blush, freckles and shading under the hair.
+- **Characters:** mood light: torch, moonlight or arcane, as a lit edge, a cast or a rim.
+- **Characters:** the artist is credited under the portrait, on the sheet, in shared link previews
+  and in the picture itself, with the links the artist chose.
+- **Printing:** the portrait prints on the exported character sheet, at full resolution.
+- **Sharing:** a shared character link previews with the character's own portrait, and the
+  preview updates when the portrait changes.
+- **Accounts:** a preferred name, used to greet you in site emails.
+- **Accounts:** artists get an account with a welcome email and can change how they are credited
+  on My Account.
+- **Site:** pages and portrait images ask AI crawlers not to train on them.
 
 ### Changed
 
@@ -59,6 +79,9 @@ Homebrew can be moved, switched off and repaired instead of lost, and a characte
 - **Site:** on phones the header, menus and ability buttons fit the screen. (#711)
 - **Server:** blank settings count as unset, Docker secrets work for the login key, and the Windows start scripts find their ports. (#701)
 - **Server:** without email configured, registration is refused unless explicitly allowed. (#712)
+- **Accounts:** site emails greet you by your preferred name, or by your username when you have
+  not set one, instead of "Hi there".
+- **Characters:** the builder's tab bar wraps on narrow screens.
 
 ### Fixed
 
@@ -97,6 +120,13 @@ Homebrew can be moved, switched off and repaired instead of lost, and a characte
 - **Equipment:** tools, musical instruments, gaming sets and equipment packs show their SRD prices,
   and tools and instruments their weights.
 - **Magic items:** the Alchemy Jug shows that its liquid can be created once a day.
+- **Characters:** a late save for one character no longer replaces another character open in the
+  builder, along with its unsaved edits.
+- **Sharing:** link previews of shared characters failed on Discord, Mastodon, Slack, Telegram and
+  X, because `robots.txt` blocked every crawler that honours it.
+- **Sharing:** every shared character link had an empty title and image in its preview.
+- **Printing:** exported sheets reported "Adobe InDesign CS6" as their creator and had no title or
+  author.
 
 ### Security
 

dev/e2e_boot.clj

@@ -12,6 +12,7 @@
   (:require [com.stuartsierra.component :as component]
             [datomic.api :as d]
             [orcpub.system :as s]
+            [orcpub.artist-accounts :as artist-accounts]
             [orcpub.routes :as routes]
             [orcpub.entity.strict :as se]
             [orcpub.dnd.e5.character :as char5e]
@@ -73,6 +74,14 @@
                        (item "kaylee" "Kaylee Seeded Beta")
                        (item "kaylee" "Kaylee Seeded Gamma")
                        (item "zoe"    "Zoe Seeded Only")])
+    ;; E2E_ARTIST=<artist id> makes kaylee that artist's account, through the
+    ;; same linking the live site does. Not via PORTRAIT_ARTISTS: the server's
+    ;; own startup pass runs before the seeding above, so it would find no
+    ;; kaylee and create a separate account instead.
+    (when-let [artist (not-empty (System/getenv "E2E_ARTIST"))]
+      (println "e2e-boot: kaylee as artist"
+               (artist-accounts/reconcile! conn {(keyword artist) {:account "kaylee@example.com"}}
+                                           artist-accounts/log-only-notify)))
     ;; Printed so a check can open the character without logging in.
     (let [{:keys [status body]} (routes/do-save-character (d/db conn) conn
                                                           (fighter-carrying "Bree Tinker" :kaylee-seeded-alpha)