feat(admin): FuzzySearch artist lookup client, endpoint, and key setting (SONA-156)

README.md

@@ -24,6 +24,10 @@ original deployment it grew out of). The project home is
 - **Sticker packs** — mirror Telegram sticker sets or upload your own; static,
   animated (.tgs→Lottie), and video stickers, with per-sticker artist credit and
   emoji search. *(Telegram import gated by `TELEGRAM_BOT_TOKEN`.)*
+- **Artist lookup** — reverse image search an upload against FuzzySearch to
+  find who drew it, then credit them without leaving the form. *(Optional;
+  keyed off a `FUZZYSEARCH_API_KEY` secret or a key saved in Settings →
+  Connections. Nothing is sent until you click.)*
 - **Conventions** — track the cons you're attending (picked from the
   [cons.fyi](https://cons.fyi) feed, synced from your Bluesky "going" labels, or
   entered manually); upcoming ones show on the About page.

docs/architecture.md

@@ -41,6 +41,7 @@ graph TB
     subgraph "External services"
         TG[🤖 Telegram Bot API]
         FurTrack[📸 FurTrack]
+        FuzzySearch[🔍 FuzzySearch — reverse image search]
         Resend[✉️ Resend]
         Turnstile[🧩 Cloudflare Turnstile]
         ConsFYI[📅 cons.fyi]
@@ -86,6 +87,7 @@ graph TB
 
     Importers -->|sticker sets| TG
     Importers -->|photo import| FurTrack
+    Admin -->|artist lookup| FuzzySearch
     Auth -->|reset email| Resend
     RateLimit --> Turnstile
     Public -->|convention dates| ConsFYI
@@ -129,8 +131,8 @@ graph TB
 - The cons.fyi feed supplies each convention's IANA timezone as well as its
   dates, which is what lets `/connect` decide "here now" in the event's own
   zone rather than the reader's or UTC.
-- Telegram, FurTrack, Resend, and Turnstile are optional integrations, keyed
-  off secrets or settings (see `wrangler.toml.example` for the full list).
+- Telegram, FurTrack, FuzzySearch, Resend, and Turnstile are optional
+  integrations, keyed off secrets or settings (see `wrangler.toml.example` for the full list).
 - GitHub Actions is part of the runtime, not just delivery: the scheduled
   workflows (`sticker-resync` daily 06:00 UTC, `artist-sync` 06:30,
   `avatar-refresh` 07:00, `cleanup-orphans` weekly, `backfill-animated`

messages/en.json

@@ -1182,6 +1182,32 @@
 	"admin_settings_disconnecting": "Disconnecting…",
 	"admin_settings_connect_registry": "Connect to registry",
 	"admin_settings_forkkey_hint": "The fork key is stored in your site's database (not a deploy secret). It's a low-privilege, revocable, submit-only key.",
+	"admin_settings_lookup_heading": "Artist lookup",
+	"admin_settings_lookup_explainer_1": "Find who drew a piece when the post doesn't say. When you click Look up artist on an upload, Sona sends that image file to FuzzySearch. FuzzySearch matches it against its index of FurAffinity, Weasyl, e621, and the Twitter accounts it tracks. Sona sends nothing until you click, and keeps only the values you apply to the form.",
+	"admin_settings_lookup_explainer_2": "FuzzySearch is an independent service, not part of Sona. It may keep a copy or a hash of what you send. Sona has no agreement with it and can't delete anything on your behalf.",
+	"admin_settings_lookup_key_label": "FuzzySearch API key",
+	"admin_settings_lookup_key_placeholder": "Paste your key",
+	"admin_settings_lookup_hint_pre": "You can get a free key at ",
+	"admin_settings_lookup_hint_post": ".",
+	"admin_settings_lookup_save": "Save key",
+	"admin_settings_lookup_saved": "Key saved.",
+	"admin_settings_lookup_error_invalid": "That doesn't look like a key. Paste it exactly as FuzzySearch gave it to you.",
+	"admin_settings_lookup_connected_eyebrow": "Connected",
+	"admin_settings_lookup_key_ending": "ending {tail}",
+	"admin_settings_lookup_saved_key_label": "Saved key",
+	"admin_settings_lookup_replace": "To use a different key, remove this one and save the new one.",
+	"admin_settings_lookup_remove": "Remove key",
+	"admin_settings_lookup_removed": "Key removed.",
+	"admin_settings_lookup_confirm": "Remove the key? Look up artist disappears from upload and edit until you save a new one.",
+	"admin_settings_lookup_confirm_remove": "Remove",
+	"admin_settings_lookup_removing": "Removing…",
+	"admin_settings_lookup_confirm_keep": "Keep",
+	"admin_settings_lookup_refused_eyebrow": "Key refused",
+	"admin_settings_lookup_refused_line": "FuzzySearch didn't accept this key on the last lookup ({date}).",
+	"admin_settings_lookup_refused_key_label": "Refused key",
+	"admin_settings_lookup_new_key_label": "New FuzzySearch API key",
+	"admin_settings_lookup_secret_pre": "Set by the ",
+	"admin_settings_lookup_secret_post": " deploy secret. Manage it wherever you set your deploy secrets.",
 	"admin_settings_danger_zone": "Danger Zone",
 	"admin_settings_export_title": "Export data",
 	"admin_settings_export_desc": "Download a full backup of all images, metadata, collections, and tags as a JSON file.",

messages/ja.json

@@ -902,6 +902,32 @@
 	"admin_settings_disconnecting": "切断中…",
 	"admin_settings_connect_registry": "レジストリに接続",
 	"admin_settings_forkkey_hint": "フォークキーはサイトのデータベースに保存されます（デプロイシークレットではありません）。低権限・失効可能・申請専用のキーです。",
+	"admin_settings_lookup_heading": "アーティスト検索",
+	"admin_settings_lookup_explainer_1": "投稿元に記載がない作品でも、描いた人を探せます。アップロードした画像で「アーティストを検索」を押すと、Sonaはその画像ファイルをFuzzySearchに送信します。FuzzySearchは、FurAffinity・Weasyl・e621と、収集対象のTwitterアカウントのインデックスと照合します。押すまでは何も送信されず、フォームに反映した値だけが保存されます。",
+	"admin_settings_lookup_explainer_2": "FuzzySearchはSonaとは無関係の外部サービスです。送信した画像のコピーやハッシュが保管される場合があります。Sonaは同サービスと契約しておらず、あなたに代わってデータを削除することはできません。",
+	"admin_settings_lookup_key_label": "FuzzySearch APIキー",
+	"admin_settings_lookup_key_placeholder": "キーを貼り付け",
+	"admin_settings_lookup_hint_pre": "無料のキーは ",
+	"admin_settings_lookup_hint_post": " で取得できます。",
+	"admin_settings_lookup_save": "キーを保存",
+	"admin_settings_lookup_saved": "キーを保存しました。",
+	"admin_settings_lookup_error_invalid": "キーの形式が違うようです。FuzzySearchから受け取ったとおりに貼り付けてください。",
+	"admin_settings_lookup_connected_eyebrow": "接続済み",
+	"admin_settings_lookup_key_ending": "末尾 {tail}",
+	"admin_settings_lookup_saved_key_label": "保存済みのキー",
+	"admin_settings_lookup_replace": "別のキーを使うには、このキーを削除してから新しいキーを保存してください。",
+	"admin_settings_lookup_remove": "キーを削除",
+	"admin_settings_lookup_removed": "キーを削除しました。",
+	"admin_settings_lookup_confirm": "キーを削除しますか？新しいキーを保存するまで、アップロード画面と編集画面から「アーティストを検索」がなくなります。",
+	"admin_settings_lookup_confirm_remove": "削除",
+	"admin_settings_lookup_removing": "削除中…",
+	"admin_settings_lookup_confirm_keep": "そのままにする",
+	"admin_settings_lookup_refused_eyebrow": "キーが拒否されました",
+	"admin_settings_lookup_refused_line": "前回の検索で、FuzzySearchはこのキーを受け付けませんでした（{date}）。",
+	"admin_settings_lookup_refused_key_label": "拒否されたキー",
+	"admin_settings_lookup_new_key_label": "新しいFuzzySearch APIキー",
+	"admin_settings_lookup_secret_pre": "デプロイシークレット ",
+	"admin_settings_lookup_secret_post": " で設定されています。デプロイシークレットを設定している場所で管理してください。",
 	"admin_settings_danger_zone": "危険な操作",
 	"admin_settings_export_title": "データをエクスポート",
 	"admin_settings_export_desc": "すべての画像・メタデータ・コレクション・タグの完全なバックアップをJSONファイルとしてダウンロードします。",

src/app.d.ts

@@ -96,6 +96,13 @@ declare global {
 				 * the site runs entirely on its local artists table.
 				 */
 				REGISTRY_API_KEY?: string;
+				/**
+				 * FuzzySearch API key, enabling "Look up artist" (reverse image search).
+				 * Optional: without it — and without the key saved in Settings →
+				 * Connections, which this secret overrides — the lookup endpoint answers
+				 * `{ enabled: false }` and the button never appears.
+				 */
+				FUZZYSEARCH_API_KEY?: string;
 				/**
 				 * Resend API key. Gates the admin "Forgot password" flow: when unset,
 				 * /admin/forgot silently no-ops (still returns the generic response) and

src/lib/components/ConCard.svelte

@@ -6,6 +6,7 @@
 		conCardFaceSvg,
 		conCardPrintSheetSvg,
 		conCardFileBase,
+		isEmbeddableAvatarType,
 		CON_CARD_WIDTH,
 		CON_CARD_HEIGHT,
 		type ConCardColor,
@@ -173,6 +174,14 @@
 		try {
 			const response = await fetch(avatarSrc);
 			if (!response.ok) throw new Error(`avatar ${response.status}`);
+			// The proxy answers octet-stream for anything outside the raster
+			// allowlist, and a data URI made from that draws nothing. Treated as a
+			// failed avatar so the card falls back to the initial in the ring and
+			// says so, rather than saving a blank one. A response with no
+			// content-type at all is a direct same-origin avatar, not a refusal, so
+			// it still embeds.
+			const type = response.headers.get('content-type');
+			if (!isEmbeddableAvatarType(type)) throw new Error(`avatar type ${type}`);
 			const blob = await response.blob();
 			avatarData = await new Promise<string>((resolve, reject) => {
 				const reader = new FileReader();

src/lib/components/con-card-markup.test.ts

@@ -67,6 +67,19 @@ describe('ConCard download paths', () => {
 		expect(source).toMatch(/avatarFailed = true;[\s\S]*?return null;/);
 	});
 
+	it('checks the proxy answered an image before it builds the data URI', () => {
+		// isEmbeddableAvatarType is unit-tested in con-card.test.ts; what has to be
+		// pinned here is that the fetch path actually calls it, on the response's
+		// own content-type, and throws instead of reaching the FileReader — a data
+		// URI made from an octet-stream body draws nothing and would be saved as a
+		// blank avatar with no message. Only the order matters — the header read,
+		// then the guard, then the reader — so renaming the local or moving a
+		// comment between them doesn't fail this.
+		expect(source).toMatch(
+			/embedAvatar\(\)[\s\S]*?headers\.get\(['"]content-type['"]\)[\s\S]*?isEmbeddableAvatarType\([\s\S]*?throw[\s\S]*?readAsDataURL/
+		);
+	});
+
 	it('separates "saved without your avatar" from "nothing saved"', () => {
 		// avatarFailed is the embed path's alone; a raster failure must never claim
 		// a file was saved. Both save paths route their catch to rasterFailed.

src/lib/con-card.test.ts

@@ -1,11 +1,12 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import { qrSvg } from './qr';
 import { SOCIAL_ICON_ART, type SocialIconArt } from './social-icon-paths';
 import { SOCIAL_PLATFORM_NAMES, type SocialPlatform } from './social-label';
 import {
 	conCardFaceSvg,
 	conCardPrintSheetSvg,
 	conCardFileBase,
+	isEmbeddableAvatarType,
 	CON_CARD_WIDTH,
 	CON_CARD_HEIGHT,
 	CON_CARD_SHEET_WIDTH,
@@ -618,3 +619,55 @@ describe('conCardFileBase', () => {
 		expect(conCardFileBase('')).toBe('con-card');
 	});
 });
+
+// The card embeds the avatar as a data URI, and the byte proxy in front of it
+// hands anything outside the stored raster allowlist back as a download. A URI
+// built from one of those draws nothing, so the type decides whether the card
+// keeps the face or falls back to the initial in the ring.
+describe('isEmbeddableAvatarType', () => {
+	it('takes the raster types the gallery stores, whatever their spelling', () => {
+		for (const type of ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/avif']) {
+			expect(isEmbeddableAvatarType(type), type).toBe(true);
+		}
+		expect(isEmbeddableAvatarType('Image/PNG; charset=binary')).toBe(true);
+	});
+
+	it('refuses the proxy download type and svg', () => {
+		const refused = ['application/octet-stream', 'image/svg+xml', 'text/html'];
+		for (const type of refused) {
+			expect(isEmbeddableAvatarType(type), String(type)).toBe(false);
+		}
+	});
+
+	// The guard also runs on the direct same-origin avatar URL, and the proxy
+	// always sets a content-type. Only a PRESENT, non-raster type is a refusal —
+	// treating a missing header as one drops a perfectly good avatar to the
+	// initial.
+	it('takes a response with no content-type at all', () => {
+		for (const type of ['', null, undefined]) {
+			expect(isEmbeddableAvatarType(type), String(type)).toBe(true);
+		}
+	});
+
+	// GALLERY_ACCEPT has no spaces today, and an accept list is just as valid
+	// written with them. Read literally, a single space would drop the avatar to
+	// the initial for a type the server's own allowlist stores.
+	it('reads an accept list written with spaces after the commas', async () => {
+		vi.resetModules();
+		vi.doMock('$lib/config', async () => {
+			const actual = await vi.importActual<typeof import('./config')>('./config');
+			return { ...actual, GALLERY_ACCEPT: 'image/jpeg, image/png, image/webp' };
+		});
+		try {
+			const spaced = await import('./con-card');
+			expect(spaced.isEmbeddableAvatarType('image/png')).toBe(true);
+			expect(spaced.isEmbeddableAvatarType('image/webp')).toBe(true);
+			// Not in the stubbed list, so a false here also proves the stub is the
+			// list being read rather than the real constant.
+			expect(spaced.isEmbeddableAvatarType('image/gif')).toBe(false);
+		} finally {
+			vi.doUnmock('$lib/config');
+			vi.resetModules();
+		}
+	});
+});

src/lib/con-card.ts

@@ -1,3 +1,4 @@
+import { GALLERY_ACCEPT } from '$lib/config';
 import { qrSvg } from '$lib/qr';
 import { SOCIAL_ICON_ART, type SocialIconArt } from '$lib/social-icon-paths';
 import { SOCIAL_PLATFORM_NAMES, type SocialPlatform } from '$lib/social-label';
@@ -620,6 +621,27 @@ export function conCardPrintSheetSvg(opts: Omit<ConCardOptions, 'variant'>): str
 		.join('');
 }
 
+/**
+ * Whether a fetched avatar response can be embedded in a saved card. The
+ * same-origin byte proxy hands anything outside the stored raster allowlist back
+ * as `application/octet-stream` with a download disposition, and a data URI
+ * built from that never draws: the card would save with an empty ring and no
+ * word to the operator. Only a PRESENT, non-raster type is a failure — the
+ * proxy always sets a content-type, so a response without one is a direct
+ * same-origin avatar and stays embeddable. Read off GALLERY_ACCEPT so this and
+ * the server's allowlist can't drift apart.
+ */
+export function isEmbeddableAvatarType(contentType: string | null | undefined): boolean {
+	if (!contentType) return true;
+	const type = contentType.split(';')[0].trim().toLowerCase();
+	// Tokens are trimmed: an accept list written with a space after the comma is
+	// the same list to an <input accept>, and reading it literally here would
+	// refuse a type the server's allowlist takes.
+	return GALLERY_ACCEPT.split(',')
+		.map((t) => t.trim())
+		.includes(type);
+}
+
 /** Filename stem for a downloaded card: `taro-con-card`. */
 export function conCardFileBase(name: string): string {
 	const slug = name