feat: profile pictures for spaces and maintained resources, with SVG support (#632, #634)

[tkuhn]

Closes #632, closes #634.

Profile pictures for spaces and maintained resources (#632)

A space or maintained resource that declares schema:image on its own IRI shows that picture above its title and main URI, plainly — no tilted-square mask like user icons get. With no picture declared, the header renders exactly as before.

Only declarations signed by a current admin of the governing space count. The new query RALK8_WQ…/get-resource-profile-picture follows the shape of get-view-displays-unresolved: it runs on repo/full and makes one federated hop to repo/spaces for the authority gate (npa:hasGoverningSpaceRef → admin RoleInstantiation → npa:AccountState), reflexive for a space itself and pointing at the maintainer space for a maintained resource. Candidates are found subject-first, so that hop only ever sees a handful of rows. The maintainer tier is deliberately not accepted, and the gate is not pinned to a single ref — for an identifier with rival claimants, an admin of any claiming ref can declare a picture.

The picture is fetched inside the resource's existing asynchronous data update, next to the view displays, so rendering never waits on it and a post-publish forced refresh picks up a new picture with the rest of the structure.

Per the issue, there is no About-page option to set one yet: a picture is declared by publishing the triple.

SVG markup as a profile picture (#634)

A schema:image value may be a literal holding the SVG itself rather than a link — for users as well as for spaces and maintained resources.

ProfilePicture is the one place that interprets the value: SVG markup goes through Utils.sanitizeSvg, gets an xmlns injected when the author left it out (an <img> parses SVG as XML and fails without one), and travels on as a data: URI. Every picture site stays a plain <img>, so the mask on user icons, object-fit on resource pictures and list-row sizing keep working for either kind of value — and inside an <img> an SVG document can neither script nor fetch, so a picture cannot reach into the page showing it.

Setting one through the UI needs a template whose field accepts a literal. The live one is URL-only and cannot be superseded from another account (latest-version resolution joins on the same pubkey), so this is published instead:

• template RAz5tNdG…/template — one statement with an nt:ValuePlaceholder ("image URL, or SVG markup in quotes"), space-governed by https://w3id.org/spaces/knowledgepixels/nanodash so its members can edit it collaboratively
• kind registration RA6owO2C… — <kind> a gen:MaintainedResource ; gen:isMaintainedBy <…/nanodash>
• profile view RATPxXJT… — the "update profile image..." action points at the template's embedded IRI

No code change is needed for governed float: the action URL carries template-version=latest, and TemplateData.getLatestTemplateId routes governed pins through get-latest-governed-version.

Two bugs found on the way

Long literals overflowed the stack. isValidLiteralSerialization / getParsedLiteral used patterns shaped ^"(([^\\"]|\\\\|\\")*)"… — an alternation inside a greedy star, which Java's regex engine evaluates with one stack frame per character. A ~15 KB SVG pasted into a value field threw StackOverflowError in the publish form's validator, i.e. a 500. The quoted part is now scanned linearly.

getEscapedLiteralString never escaped quotes. replaceAll("\"", "\\\\\"") passes \" as a replacement string, where the backslash is an escape, so it emitted a bare quote and any value containing one round-tripped into an unparseable serialization. Now uses String.replace. UtilsTest.getEscapedLiteralStringEscapesQuotesCorrectly had codified that bug (it asserted the input came back unchanged, while its backslash sibling asserted real escaping), so its expectation is corrected here.

SVG exported by drawing tools rendered all black. Serif/Affinity-style exports put every paint in style="fill:rgb(…)", and the sanitizer allows no style attribute — so the declarations were dropped and every shape fell back to the SVG default fill. Safe declarations are now rewritten into the equivalent presentation attributes before sanitizing, so the existing allow-list validates them like any other attribute: the property must be one of the paint/text ones, and the value may contain no function call other than rgb/rgba/hsl/hsla(…), so url(…) and expression(…) cannot survive. This also fixes inline SVG in cells, lists and paragraphs, not just profile pictures.

Verification

Driven against a local instance on a separate port (dev server untouched, nothing published from it):

• space and maintained-resource pages with no picture (header unchanged), with a linked image, and with a wide logo
• an admin-signed declaration on test/group renders; the authority join was validated against live data with a stand-in predicate before publishing, a bogus-role variant returns 0 rows, and the two non-space subjects in the network that do carry schema:image are correctly rejected
• an SVG literal renders in the user-page header and the session icon, mask intact
• the new template loads through its embedded IRI, a quoted SVG reaches the signed preview as a literal, a URL as an IRI, and a 28 KB literal no longer 500s

23 new unit tests (ProfilePictureTest, LiteralSerializationTest, SvgStyleSanitizationTest); full suite green at 1176.

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 5.12.0 🎉

The release is available on:

• nanodash-5.12.0
• GitHub release

Your semantic-release bot 📦🚀