[arcanistzed]

Result

Adds an authenticated attendee photo gallery at /photos/ with an English/French interface, category browsing, complete-composition previews and individual full/quick JPEG downloads. Photos remain private until an eligible email signs in; the exact bilingual licence must be acknowledged before downloading.

Explained removal reports immediately quarantine a photo. /photos/manage provides a separate Cloudflare Access organiser workflow, audited case resolution/restoration, notification health, aggregate activity and restricted rights-follow-up lookup. Organiser access is intended for Google Workspace accounts in ctn-rtc.org; removal notifications go to privacy@ctn-rtc.org.

Implementation

• Dedicated Worker, private R2 and D1, with five additive migrations, durable SES outbox, session/CSRF protection, rate limits and publication checks on media delivery.
• Relative first-party browser routes; existing website hosting remains Cloudflare Pages. No ZIP downloads, extra licence page/TXT, facial recognition or identity-linked browsing history.
• Asset pipeline preserves finished full/quick masters, creates WebP viewing variants, and supports resumable upload plus complete remote hash verification. Private assets, rosters, credentials and checkpoints stay outside Git.

Validation and staging

• 18 browser tests: Chromium and Firefox.
• 13 Worker runtime tests and service TypeScript checks.
• Four Python seed/verifier tests; uploader syntax checks.
• Root lint, Astro checks (0 errors/warnings/hints) and production build pass.
• 20 live staging checks: deployed shell, anonymous denial, synthetic OTP/session, 358-photo manifest, licence acknowledgement, representative real variant hashes, attachment/range delivery and revocation.
• All 1,432 staging R2 objects (1,538,731,806 bytes) checked by remote HEAD and streamed SHA-256; no missing or unexpected objects.
• Staging D1: 358 published photos, 18 categories, 1,432 variants. Synthetic test account, OTP outbox and download records removed afterward. No real email sent.

Staging: https://hack-the-hill-photo-gallery-staging.hack-the-hill.workers.dev/photos/
Worker version: aebd0d35-47db-4cbc-a524-011fd20c9d90.

Release status

Draft for review; production is not released. Remaining prerequisites are the dedicated Google Workspace-only Access application, dedicated least-privilege SES credentials, confirmed event-team eligibility, and final visual/organiser pilot checks. Staging intentionally fails closed for organiser access and has mail delivery disabled. Production resource IDs remain unset. The original website and existing public photo-sharing folder are unchanged.

[cloudflare-workers-and-pages]

Deploying hackathon-website with    Cloudflare Pages

Latest commit:	baca897
Status:	✅  Deploy successful!
Preview URL:	https://0baa27d5.website-1cg.pages.dev
Branch Preview URL:	https://codex-attendee-photo-gallery.website-1cg.pages.dev

View logs

[arcanistzed]

Superseded by the standalone photo gallery in HacktheHill/photo-album#1. The unpublished website implementation has been reverted on this branch; the main website checkout and production deployment are unchanged.