M16: rights and sharing

CHANGELOG.md

@@ -8,7 +8,7 @@ version may change things that need attention when updating, and these notes say
 ### For curators
 
 - Each item can record what others may do with it, as a standard statement with a plain label, who holds the rights, and a
-  credit. Settings has a default. A contributor's answer only suggests a statement, and never a free licence.
+  credit. Settings has a default. A contributor's answer only suggests a statement, and only a free licence if they offered one.
 - Catalogue details for curators only: reference number, where the original is kept, received from and when, internal notes.
 - Each photo can say what it shows, for people who cannot see it. Visitors' pages use this as the picture's description.
 - Filters for items without a rights statement or photo descriptions. A reference number typed into the search finds its item.
@@ -30,6 +30,10 @@ version may change things that need attention when updating, and these notes say
 
 ### For visitors
 
+- Every item says in plain language whether it may be reused, and who to credit, with a link to what the statement means and to the
+  archive's contact page. Without a statement, it says to ask.
+- "Cite this item" gives a line to copy, and "Share" opens a phone's own list of where to share to, or copies the link.
+- A link to an item pasted into a messenger shows its picture, title and the beginning of its text.
 - Photos can be opened large, about 3000 pixels, to read a letter or look at a face. It is the browser's own view of a picture,
   which can zoom on every device, with nothing to load or learn.
 - An item with several photos has a row of numbered thumbnails, and says "Photo 2 of 4" with each caption.
@@ -57,9 +61,19 @@ version may change things that need attention when updating, and these notes say
   connection does not make two contributions, also when the first one arrived.
 - The title, date and description stay on the device for three days until they are sent, with a button to clear them. Name,
   email address and the photographer's name are never kept. Without JavaScript the form works as before.
+- Someone who made a photo, or may decide for whoever did, can offer it for reuse. It is optional, and the answer is only a
+  suggestion to the curators.
+- The consent now also covers link previews and the archive's list of what is new, and says that copies others have made are out of
+  the archive's reach.
 
 ### For people who run an archive
 
+- **Rights statements and credits that curators have written so far now appear on public pages.** The label on the field always said
+  so, but it is worth a look before updating. An item with no statement and no default for the archive tells visitors to ask.
+- **Earlier contributions stay under what they agreed to,** which was "this website". Their picture and text stay out of link previews
+  and the feed. Items that did not come through a contribution, and everything sent in from now on, are in both.
+- An Atom feed at `/feed.xml` and a sitemap at `/sitemap.xml`, named in `robots.txt`. They and link previews are switched off together
+  with "Let search engines list this archive" in "Settings".
 - Older photos get the new picture size in the background, with nothing going offline. See docs/operations.md.
 - **The large photos are off in an archive that has saved its settings before, because they show more than it has chosen to
   show so far.** An admin can switch them on under "Settings" and the archive then makes them in the background. In a new archive,

docs/curator-handbook.md

@@ -38,6 +38,16 @@ Open **Rights and credit** on an item:
 stay out of public pages and public search. Each photo also has a field for **what it shows**, in a sentence, for people who
 cannot see it.
 
+Visitors see the statement on the item's page, in plain words, and the credit. Without a statement of its own the archive's default
+applies, and without that the page tells them to ask.
+
+If a contributor offered reuse, the statement is already filled in with that, and the review shows what they said. It is still your
+decision. Before you publish, ask yourself whether it was theirs to give: someone who has reused a photo under a free licence may go
+on doing so, even if you take it back later.
+
+Contributions from before this was possible agreed to this website only. Their picture and text stay out of link previews and the feed,
+and that is not something you can change without asking them, and there is no button for it yet.
+
 ## Working through many items
 
 Open the item list and filter it: by collection, or by what is "still needed", such as a date. Open the first item and use

docs/development.md

@@ -127,6 +127,13 @@ redirects or shows the page again.
   again keeps its draft until the browser's storage is cleared.
 - **Pictures from the device** need `img-src blob:`. `SecurityHeaders` allows that on `/contribute` only.
 
+## Beyond the website
+
+`Search/PublicFeeds.cs` has the feed, the sitemap and `LinkPreview`. All of them follow `AllowSearchEngines`. Addresses come from
+the request, so behind Caddy they depend on `ASPNETCORE_FORWARDEDHEADERS_ENABLED` in `compose.production.yaml`; `SharingTests`
+tries that setting. Text goes into XML through `XmlText`, because one pasted control character would make a whole feed unreadable.
+`ArchiveItem.MayTravel` decides what goes along with a link, and it needs the contribution to be loaded.
+
 ## Photos of an item
 
 `MediaFile.Position` orders an item's photos, and the first is its cover. Anything that picks or lists photos must order by

docs/handbuch-kuratoren.md

@@ -40,6 +40,16 @@ Besucher können ein Foto mit etwa 3000 Pixeln öffnen. Ob das möglich ist, gil
 bleiben aus öffentlichen Seiten und der öffentlichen Suche heraus. Jedes Foto hat außerdem ein Feld dafür, **was es zeigt**, in
 einem Satz, für Menschen, die es nicht sehen können.
 
+Besucher sehen die Angabe in einfachen Worten auf der Seite des Eintrags, dazu die Nennung. Ohne eigene Angabe gilt die Voreinstellung des
+Archivs, und ohne diese bittet die Seite, nachzufragen.
+
+Wenn eine einsendende Person die Weiterverwendung angeboten hat, ist die Angabe schon entsprechend ausgefüllt, und die Prüfung zeigt, was sie
+gesagt hat. Die Entscheidung bleibt bei Ihnen. Fragen Sie sich vor dem Veröffentlichen, ob sie das erlauben durfte: Wer ein Foto unter einer
+freien Lizenz weiterverwendet hat, darf das weiter tun, auch wenn Sie die Lizenz später zurücknehmen.
+
+Beiträge aus der Zeit davor haben nur dieser Website zugestimmt. Ihr Bild und ihr Text bleiben aus Linkvorschauen und dem Feed heraus. Das lässt
+sich nicht ändern, ohne die Person zu fragen, und dafür gibt es noch keine Schaltfläche.
+
 ## Viele Einträge bearbeiten
 
 Öffnen Sie die Liste der Einträge und filtern Sie sie: nach Sammlung oder danach, was noch fehlt, zum Beispiel ein Datum.

docs/operations.md

@@ -49,8 +49,22 @@ Curators have their own guide: [curator-handbook.md](curator-handbook.md) ([deut
 ## Rights and catalogue details
 
 On each item, curators can say what others may do with it, as a standard statement with a plain label. "Settings" has a
-default for items without one of their own. A contributor's answer only suggests a statement, and never a free licence: they
-agreed to publication on this website, not to reuse by others. Visitors do not see these yet; that comes in a later version.
+default for items without one of their own. Each item page tells visitors what applies, with the credit if there is one. Without a
+statement or a default, it tells them to ask. "Who holds the rights?" stays with curators.
+
+A contributor's answer only suggests a statement: a free licence only if they offered one themselves, and never if they do not know
+who made it. Their offer is stored in the words they saw, as part of the consent. A curator decides, because a free licence cannot be
+taken back from those who have already reused something.
+
+## Beyond this website
+
+If search engines may list the archive, it also has a feed of the latest 30 items at `/feed.xml`, a list of its public pages at
+`/sitemap.xml`, named in `robots.txt`, and what a link shows when it is pasted into a messenger. Switching that setting off ends all
+of them at once, though what was already copied elsewhere stays there.
+
+Contributions sent in before this was added agreed to "this website" only, and stay under that: `consentCoversSharing` is false, so their
+picture and text stay out of previews, and the whole item stays out of the feed. A link to one still shows its title. There is no
+button to change this, because it would take the contributor's agreement, which the archive has no record of.
 
 "Catalogue details" (reference number, where the original is kept, received from and when, notes) are for curators only and
 stay out of public pages and public search. A reference number typed into the search on "Manage archive" finds its item.
@@ -117,7 +131,8 @@ the material can always move to another system, or be handed to a public archive
 An item's title can be empty in a full export: a draft from "Add many photos" that nobody has named yet. Each file says its
 `position` among the item's photos and its `rotation`, how far curators turned it in degrees clockwise. The file itself is the
 original, which is never turned, so whoever uses the export has to apply that. Files are listed in order. `needsTranscription` is
-in a full export only.
+in a full export only. A contribution says what the contributor offered (`reuse`) and whether they agreed to more than this website
+(`consentCoversSharing`).
 
 `archive.json` has `"format": "commonage-export"` and `"version": 3`. Version 3 added each item's rights, credit and catalogue
 details and each photo's description; in `items.csv`, `rights` and `rights_holder` are now the item's own, and the contributor's

docs/roadmap.md

@@ -171,7 +171,7 @@ real pace over M7 and M8 before promising dates. Each milestone is a minor relea
 | **M13 Shoebox** ✅ | 4 | A curator turns 300 scans into drafts with shared values, sees progress and can retry failures, is warned about identical files, and publishes a chosen set in one action. An item without a real title cannot be published. |
 | **M14 Phone-first sending** ✅ | 4 | Over slow mobile data, a contributor sees their chosen photos, watches a progress bar and cannot send twice. The new tasks are walked through in the running app and given to the tester, and a week of fixes is done. |
 | **M15 Readable items** ✅ | 4 | A visitor reads a scanned letter at full size, sees "Photo 2 of 4" with its caption, and moves on to the next item or to items from the same time. Curators reorder, rotate and describe each photo. |
-| **M16 Rights and sharing** | 3 | Every item page says whether it may be reused, in plain language. "Cite this item" gives a line to copy. A link pasted into a messenger shows the picture and the archive's name. |
+| **M16 Rights and sharing** ✅ | 3 | Every item page says whether it may be reused, in plain language. "Cite this item" gives a line to copy. A link pasted into a messenger shows the picture and the archive's name. |
 | **M17 Language reach** | 5 | A translator without Git has tried Weblate on a few pages. Missing translations fail a test. Counts read correctly under Polish plural rules. Item text carries the right `lang`. Dates that are accepted today are still accepted. |
 | **M18 Accounts and system** | 4 | A curator logs in with an authenticator app. Login keys are encrypted with a key outside the database, and the backup test still passes. An admin sees version, disk use, failed previews (with retry) and backup age on one page. |
 | **M19 Discovery** | 3 | A visitor taps "1960s" and finds the flood, opens "Places" and picks "Mill Street". A curator merges "Mill St" into "Mill Street". |

docs/security.md

@@ -26,6 +26,7 @@ vulnerability, see [SECURITY.md](../SECURITY.md).
 | Forms | Every form carries an antiforgery token. Redirects after login and language change only go to addresses on this site. |
 | Uploads | Files are recognised by their content (magic bytes), never by name or browser type, and stored under random names outside the web root. Originals are never changed or served to visitors. Previews are made by libvips, rotated upright and stripped of all metadata. Images over 250 megapixels get no preview (decompression bombs). Size limits per file and per request. |
 | Browser | Strict Content Security Policy (no inline script or style, no framing, no plugins; only the contribution form may show `blob:` images, for the photos someone has chosen on their own device, and a picture opened on its own has no scripts at all but lets the browser's picture view style itself), `nosniff`, `Referrer-Policy: same-origin` (setup links never leak to other sites), `X-Frame-Options`, `Permissions-Policy`, `Cross-Origin-Opener-Policy`. No `Server` header. `SecurityHeaderTests` checks the headers and that no page contains inline script or style, so the policy can stay strict. |
+| Beyond the website | The feed, sitemap and link previews hold nothing a public page does not show, and are switched off with "Let search engines list this archive". Contributions that agreed to "this website" only keep their picture and text out of them. |
 | Output | Razor encodes all text. The CSV export prefixes cells that start with `=`, `+`, `-` or `@`, so contributed text cannot become a spreadsheet formula. |
 | Database | All queries go through EF Core with parameters; the only raw SQL (`AccentFolding`) contains no input. Contributor search escapes `%` and `_`. |
 | Spam | Unlisted contribution links, a honeypot field, a minimum fill time and a per-address limit. Spam gets the normal thank-you page. |

docs/usability-test.md

@@ -82,6 +82,9 @@ What to note for task A, besides the usual:
 - Whether the chosen photos appear, and how quickly with ten large ones. Whether the page struggles with that.
 - Turn on flight mode while it is sending, and off again. What happens, and what does the person do next?
 
+Paste a link to an item into a messenger on a real phone, on an archive with a real address. Does the picture appear? A preview can
+only be tried that way, because the messenger's servers have to reach the archive.
+
 For task B, note whether the person finds "Open at full size", and whether they manage to zoom in and read the letter on the phone, and
 in which browser. Nobody has tried that on a real phone yet.