Changeset 3755014

Timestamp:

10/19/2026 02:48:37 PM (3 weeks ago)

Author:

paintops

Message:

1.2.081

Location:

paintops/trunk

Files:

• assets/js/paintops-sw-src.js (modified) (8 diffs)
• assets/js/pwa-app.js (modified) (2 diffs)
• changelog.txt (modified) (1 diff)
• includes/checkup-review.php (modified) (1 diff)
• includes/color-visualizer.php (modified) (1 diff)
• includes/estimates.php (modified) (1 diff)
• includes/job-invoices.php (modified) (1 diff)
• includes/job-photos.php (modified) (16 diffs)
• includes/manage-jobs.php (modified) (1 diff)
• includes/photo-storage.php (added)
• includes/private-files.php (modified) (2 diffs)
• includes/receipt-storage.php (modified) (13 diffs)
• includes/schema.php (modified) (2 diffs)
• includes/timeoff.php (modified) (1 diff)
• paintops.php (modified) (5 diffs)
• readme.txt (modified) (4 diffs)

paintops/trunk/assets/js/paintops-sw-src.js

@@ -16 +16 @@
 var PAGE_CACHE = 'paintops-pages-' + VERSION;
 var ASSET_CACHE = 'paintops-assets-' + VERSION;
+/* Photos, receipts and documents served through the permission-checked
+ * routes, kept apart from the public assets so that signing out can drop
+ * them without throwing away the shell (1.2.081). */
+var PRIVATE_CACHE = 'paintops-private-' + VERSION;
 
 /* On install: cache the icons (must succeed) and opportunistically the
@@ -49 +53 @@
       if ((k.indexOf('paintops-shell-') === 0 && k !== SHELL_CACHE) ||
           (k.indexOf('paintops-assets-') === 0 && k !== ASSET_CACHE) ||
+          (k.indexOf('paintops-private-') === 0 && k !== PRIVATE_CACHE) ||
           (k.indexOf('paintops-pages-') === 0 && k !== PAGE_CACHE)) {
         return caches.delete(k);
@@ -63 +68 @@
   /* Logout housekeeping: the page posts this when it renders the
    * "please log in" view, so a shared device does not keep one user's
-   * cached job pages after they sign out. */
+   * cached job pages, or their photos and receipts, after they sign out. */
   if (data.type === 'paintops-clear-pages') {
-    event.waitUntil(caches.delete(PAGE_CACHE));
+    event.waitUntil(Promise.all([caches.delete(PAGE_CACHE), caches.delete(PRIVATE_CACHE)]));
     return;
   }
@@ -78 +83 @@
     event.waitUntil((async function () {
       var cache = await caches.open(PAGE_CACHE);
+      var priv = await caches.open(PRIVATE_CACHE);
       await Promise.all(data.urls.map(async function (u) {
         try {
           var r = await fetch(u, { credentials: 'same-origin' });
-          if (r && r.ok && r.type === 'basic') { await cache.put(u, r.clone()); }
+          if (!(r && r.ok && r.type === 'basic')) { return; }
+          await cache.put(u, r.clone());
+          /* The page's photo thumbnails come with it (1.2.081): a job
+           * saved for the day is no use in a basement without its photos,
+           * and photos are served through a route the worker only sees
+           * when the browser asks. Up to forty per page, in the private
+           * cache that sign-out clears. */
+          var html = await r.text();
+          var re = /admin-post\.php\?action=paintops_photo(?:&amp;|&)[^"'\s<>]*?size=thumb[^"'\s<>]*/g;
+          var seen = {}; var m; var n = 0;
+          while ((m = re.exec(html)) !== null && n < 40) {
+            var p = m[0].replace(/&amp;/g, '&').replace(/&#038;/g, '&');
+            var abs; try { abs = new URL(p, u).href; } catch (e2) { continue; }
+            if (seen[abs]) { continue; }
+            seen[abs] = true; n++;
+            try {
+              if (await priv.match(abs)) { continue; }
+              var pr = await fetch(abs, { credentials: 'same-origin' });
+              if (pr && pr.ok) { await priv.put(abs, pr); }
+            } catch (e3) { /* skip this one */ }
+          }
         } catch (e) { /* offline or a bad URL, skip it */ }
       }));
@@ -92 +118 @@
 }
 
-/* A receipt image or a supporting document, served through the
- * capability-checked route rather than from the uploads folder. Matched
- * on the exact action names so nothing else under admin-post.php is
- * touched. The nonce in the query string is part of the cache key, which
- * is fine: a stale key simply misses and re-fetches. */
+/* A job photo, a receipt image or a supporting document, served through
+ * the capability-checked routes rather than from the uploads folder.
+ * Matched on the exact action names so nothing else under admin-post.php
+ * is touched. A receipt or document link carries a nonce that is part of
+ * the cache key, which is fine: a stale key simply misses and re-fetches.
+ * A photo link has no nonce (1.2.081), so the same photo is one entry. */
 function isPrivateFileRequest(url) {
   if (url.pathname.indexOf('admin-post.php') === -1) { return false; }
   var action = url.searchParams ? url.searchParams.get('action') : '';
-  return action === 'paintops_receipt' || action === 'paintops_evidence';
+  return action === 'paintops_photo' || action === 'paintops_receipt' || action === 'paintops_evidence';
 }
 
@@ -222 +249 @@
  * refresh it, so an updated asset heals itself on the next load without
  * waiting for a version bump. With no cached copy yet, wait on network. */
-async function handleAssetRequest(request, event) {
-  var cache = await caches.open(ASSET_CACHE);
+async function handleAssetRequest(request, event, cacheName) {
+  var cache = await caches.open(cacheName || ASSET_CACHE);
   var cached = await cache.match(request);
   var networkPromise = fetch(request).then(function (res) {
@@ -245 +272 @@
   if (url.origin !== self.location.origin) { return; }
 
-  // RECEIPTS AND THEIR DOCUMENTS ARE THE ONE EXCEPTION TO THE wp-admin
-  // RULE BELOW (2026-09-24). They used to be ordinary /wp-content/uploads
-  // image URLs, so isStaticAsset() matched them and a painter could open
-  // a receipt on a job with no signal. Now that they are served through a
-  // permission-checked route on admin-post.php, the blanket wp-admin
-  // bypass would drop them out of the cache and take that away.
+  // PHOTOS, RECEIPTS AND THEIR DOCUMENTS ARE THE ONE EXCEPTION TO THE
+  // wp-admin RULE BELOW (receipts 2026-09-24, job photos 1.2.081). They
+  // used to be ordinary /wp-content/uploads image URLs, so
+  // isStaticAsset() matched them and a painter could open a job's photos
+  // with no signal. Now that they are served through a permission-checked
+  // route on admin-post.php, the blanket wp-admin bypass would drop them
+  // out of the cache and take that away.
   //
   // What is cached here is a file this person was already allowed to see,
@@ -258 +286 @@
   // is versioned with the plugin, so it clears on every update.
   if (isPrivateFileRequest(url)) {
-    event.respondWith(handleAssetRequest(request, event));
+    event.respondWith(handleAssetRequest(request, event, PRIVATE_CACHE));
     return;
   }

paintops/trunk/assets/js/pwa-app.js

@@ -31 +31 @@
         });
 
-      if (document.querySelector('.paintops-login-required')) {
-        // Signed out on a shared device: clear cached job pages.
+      // THE SIGN-IN BOX ONLY (data-po-signed-out), not every box that
+      // shares its class: "You do not have access to this job" and the
+      // vehicle log's refusal use the same styling for a signed-in painter,
+      // and clearing the saved pages and photos on those would strip the
+      // phone of its offline copies over a reassigned job (review of
+      // 1.2.081).
+      if (document.querySelector('.paintops-login-required[data-po-signed-out]')) {
+        // Signed out on a shared device: clear cached job pages and the
+        // photos and receipts saved with them.
         navigator.serviceWorker.ready.then(function (reg) {
           if (reg && reg.active) {
@@ -67 +74 @@
             var n = r.result || 0;
             if (!n) { return; }
-            var box = document.querySelector('.paintops-login-required');
+            var box = document.querySelector('.paintops-login-required[data-po-signed-out]');
             if (!box || box.querySelector('.paintops-tc-queued-note')) { return; }
             var p = document.createElement('p');

paintops/trunk/changelog.txt

@@ -4 +4 @@
 
 == Changelog ==
+
+= 1.2.081 =
+* Changed: job photos now live in a private folder on your server instead of the WordPress media library, the same way receipts have since 1.2.058. A photo opens for you and for the painters on that job, and for nobody else; the media library sat at a web address that worked for anyone who had it. Each photo keeps a small copy beside it for the gallery, the Before/After pairs and the job page, so those load no slower than before. A photo you put on an invoice still shows to the customer holding that invoice link. Checkup shows a card with the number of photos and receipts still in the media library and a button that moves them in batches of 100; everything keeps working while that runs, a photo your website also uses in a page or gallery is copied and left in the media library as well, and a file that is not on the server right now is left alone and counted rather than written off. Photos from the AI Visualizer are kept the same way. The painter's phone now saves the photos of the day's jobs along with the job pages, so they are there with no signal even for a job that was never opened, and on a shared phone signing out clears the photos and receipts the app had saved.
+* Changed: the "Review on Capterra" button on Checkup opens Capterra's own write-a-review form.
 
 = 1.2.080 =

paintops/trunk/includes/checkup-review.php

@@ -48 +48 @@
         'review'   => 'https://wordpress.org/support/plugin/paintops/reviews/#new-post',
         'register' => 'https://login.wordpress.org/register',
-        // Capterra listing, live 2026-10-07 (Mike). The product page; Capterra's
-        // own "Write a Review" form sits behind a per-product UUID that only
-        // the vendor portal shows, so swap this for that URL when it is known.
-        'capterra' => 'https://www.capterra.com/p/10186495/PaintClarity/',
+        // Capterra's own "Write a Review" form for the PaintClarity listing
+        // (vendor-portal URL, Mike 2026-10-17; the listing itself is
+        // https://www.capterra.com/p/10186495/PaintClarity/ and was the
+        // button's target from 1.2.079 until this one was known).
+        'capterra' => 'https://reviews.capterra.com/products/new/284c5b7b-1c06-4716-9507-998121438b4e/',
     ];
     /**

paintops/trunk/includes/color-visualizer.php

@@ -274 +274 @@
                             <?php foreach ($po_vis_photos as $p) : ?>
                                 <button type="button" class="po-aiv-thumb" data-photo-id="<?php echo esc_attr((string) $p['id']); ?>" data-url="<?php echo esc_url($p['full_url']); ?>" data-caption="<?php echo esc_attr($p['caption']); ?>" title="<?php echo esc_attr($p['caption']); ?>" aria-label="<?php echo esc_attr('Use this job photo: ' . $p['caption']); ?>">
-                                    <img src="<?php echo esc_url($p['url']); ?>" alt="">
+                                    <img loading="lazy" decoding="async" src="<?php echo esc_url($p['url']); ?>" alt="">
                                     <span class="po-aiv-thumb-cap"><?php echo esc_html($p['caption']); ?></span>
                                 </button>

paintops/trunk/includes/estimates.php

@@ -1028 +1028 @@
                 ?>
                 <button type="button" class="ai-existing-thumb" data-photo-id="<?php echo esc_attr($pid); ?>" onclick="paintopsAiToggleExisting(this)" style="position:relative;width:84px;height:84px;padding:0;border:2px solid #ddd;border-radius:8px;overflow:hidden;cursor:pointer;background:#fff;">
-                    <img src="<?php echo esc_url($thumb); ?>" alt="Job photo" style="width:100%;height:100%;object-fit:cover;display:block;">
+                    <img loading="lazy" decoding="async" src="<?php echo esc_url($thumb); ?>" alt="Job photo" style="width:100%;height:100%;object-fit:cover;display:block;">
                     <span class="ai-thumb-check" style="display:none;position:absolute;top:3px;right:3px;width:20px;height:20px;border-radius:50%;background:#2563eb;color:#fff;font-size:13px;line-height:20px;text-align:center;">&#10003;</span>
                 </button>

paintops/trunk/includes/job-invoices.php

@@ -207 +207 @@
     foreach ( $photo_ids as $pid ) {
         if ( isset( $rows_by_id[$pid] ) && ($rows_by_id[$pid]['url'] ?? '') !== '' ) {
-            $sel_photos[] = $rows_by_id[$pid];
+            $item = $rows_by_id[$pid];
+            // A photo in private storage opens only for a signed-in viewer
+            // on the job. The customer reading this invoice is signed out
+            // and holds the invoice token, so the public document carries
+            // links that name the invoice; the photo route lets a photo
+            // this invoice lists through on that token (1.2.081,
+            // includes/photo-storage.php).
+            if ( $public && !empty( $item['private'] ) && function_exists( 'paintops_photo_public_url' ) ) {
+                $item['url'] = paintops_photo_public_url( $pid, $invoice, 'thumb' );
+                $item['full_url'] = paintops_photo_public_url( $pid, $invoice, 'full' );
+            }
+            $sel_photos[] = $item;
         }
     }

paintops/trunk/includes/job-photos.php

@@ -482 +482 @@
 
         // TWO KINDS OF ROW LIVE HERE AT ONCE, and this is the one place
-        // that has to know it. A job PHOTO is a media-library attachment
-        // and always will be. A RECEIPT is a file in private storage,
-        // unless it was filed before that shipped and has not been
-        // migrated yet, in which case it is still an attachment. See
-        // includes/receipt-storage.php.
+        // that has to know it. A row filed since private storage shipped
+        // (receipts 1.2.058, photos 1.2.081) is a file in the private
+        // folder; a row from before that has not been migrated yet is
+        // still a media-library attachment. A receipt comes back through
+        // the nonced receipt route (includes/receipt-storage.php), a photo
+        // through the photo route with its thumbnail
+        // (includes/photo-storage.php).
         if ($private_file !== '') {
-            $view = paintops_receipt_view('job', (int) $row['id'], $private_file, 0);
-            $row['url']      = $view['url'];
-            $row['full_url'] = $view['url'];
-            $row['is_pdf']   = $view['is_pdf'];
+            if ((string) $row['context'] === 'receipt') {
+                $view = paintops_receipt_view('job', (int) $row['id'], $private_file, 0);
+                $row['url']      = $view['url'];
+                $row['full_url'] = $view['url'];
+                $row['is_pdf']   = $view['is_pdf'];
+            } else {
+                $view = paintops_photo_view((int) $row['id']);
+                $row['url']      = $view['url'];
+                $row['full_url'] = $view['full_url'];
+                $row['is_pdf']   = false;
+            }
         } else {
             $thumb = wp_get_attachment_image_url($attachment_id, 'medium');
@@ -582 +591 @@
     $table = paintops_table('job_photos');
     $rows = $wpdb->get_results($wpdb->prepare(
-        "SELECT id, job_id, expense_id, context, attachment_id, uploaded_by, uploaded_at, notes, taken_at, gps_lat, gps_lng, photo_role, paired_photo_id
+        "SELECT id, job_id, expense_id, context, attachment_id, private_file, uploaded_by, uploaded_at, notes, taken_at, gps_lat, gps_lng, photo_role, paired_photo_id
          FROM %i
          WHERE job_id = %d AND context IN ('note','photo')
@@ -589 +598 @@
     foreach ($rows as &$row) {
         $attachment_id = (int) $row['attachment_id'];
-        $thumb = $attachment_id > 0 ? wp_get_attachment_image_url($attachment_id, 'medium') : false;
-        $full  = $attachment_id > 0 ? wp_get_attachment_image_url($attachment_id, 'full') : false;
-        $row['url']      = $thumb ?: ($full ?: '');
-        $row['full_url'] = $full ?: $row['url'];
+        $private_file  = trim((string) ($row['private_file'] ?? ''));
+        if ($private_file !== '') {
+            // A photo in private storage (1.2.081); see paintops_get_job_photos().
+            $view = paintops_photo_view((int) $row['id']);
+            $row['url']      = $view['url'];
+            $row['full_url'] = $view['full_url'];
+        } else {
+            $thumb = $attachment_id > 0 ? wp_get_attachment_image_url($attachment_id, 'medium') : false;
+            $full  = $attachment_id > 0 ? wp_get_attachment_image_url($attachment_id, 'full') : false;
+            $row['url']      = $thumb ?: ($full ?: '');
+            $row['full_url'] = $full ?: $row['url'];
+        }
+        $row['private'] = ($private_file !== '');
 
         $uploader = (int) $row['uploaded_by'] > 0 ? get_userdata((int) $row['uploaded_by']) : false;
@@ -754 +772 @@
                 <?php if ($hasPhoto): ?>
                 <div class="thumb">
-                    <a href="<?php echo esc_url($item['full_url']); ?>" target="_blank" rel="noopener noreferrer"><img src="<?php echo esc_url($item['url']); ?>" alt="Job photo"></a>
+                    <a href="<?php echo esc_url($item['full_url']); ?>" target="_blank" rel="noopener noreferrer"><img loading="lazy" decoding="async" src="<?php echo esc_url($item['url']); ?>" alt="Job photo"></a>
                 </div>
                 <?php endif; ?>
@@ -1050 +1068 @@
 
 /**
+ * intermediate_image_sizes_advanced filter callback, keeps only
+ * 'medium', dropping thumbnail/medium_large/large/theme-custom sizes.
+ * Job photos and receipts no longer become attachments at all (private
+ * storage, 1.2.058 and 1.2.081); this is kept for the one attachment the
+ * plugin still makes, the expense report PDF's page images
+ * (pro-expense-reports.php).
+ */
+function paintops_restrict_photo_image_sizes(array $sizes): array {
+    return array_intersect_key($sizes, ['medium' => true]);
+}
+
+/**
  * Handle one uploaded file (a single entry from $_FILES) for a job:
- * resize/compress it, register it as a normal WordPress media
- * attachment (so it lives in the Media Library, survives backups, and
- * works with any offload-to-S3 plugin), and record it in cs_job_photos.
+ * resize/compress it, move it into private storage with a thumbnail
+ * beside it (includes/photo-storage.php; receipts through
+ * includes/receipt-storage.php), and record it in cs_job_photos.
  *
  * Returns the new row's ID on success, or a WP_Error explaining what
@@ -1060 +1090 @@
  * the limit is reached, that's trivially bypassed by a raw POST).
  */
-
-/**
- * intermediate_image_sizes_advanced filter callback, keeps only
- * 'medium', dropping thumbnail/medium_large/large/theme-custom sizes.
- * See the doc comment at its add_filter() call site in
- * paintops_handle_job_photo_upload() for why.
- */
-function paintops_restrict_photo_image_sizes(array $sizes): array {
-    return array_intersect_key($sizes, ['medium' => true]);
-}
 
 function paintops_handle_job_photo_upload(int $job_id, array $file, string $context = 'photo', ?int $expense_id = null, string $notes = '', string $photo_role = '', ?int $pair_with_before_id = null) {
@@ -1105 +1125 @@
     // Core admin includes loaded the documented way for front-end media
     // handling (the permitted require_once exception): wp_handle_upload()
-    // below comes from file.php, and wp_insert_attachment's metadata step
-    // further down (wp_generate_attachment_metadata) comes from image.php.
+    // below comes from file.php; image.php for the editor it may need.
     // Used immediately after loading, never called directly over HTTP.
     require_once ABSPATH . 'wp-admin/includes/image.php';
@@ -1130 +1149 @@
             : 'Only image files can be uploaded here.');
     }
+    // Private storage keeps a short list of types it will serve (the
+    // ones every phone produces and every browser shows). Anything else
+    // is refused here, with the list, rather than at the adopt step
+    // below with a message that names no types.
+    $upload_ext = strtolower((string) pathinfo((string) $upload['file'], PATHINFO_EXTENSION));
+    if (!$is_pdf_receipt && !isset(paintops_private_allowed_types()[$upload_ext])) {
+        wp_delete_file($upload['file']);
+        return new WP_Error('paintops_not_an_image', ($context === 'receipt' ? 'Receipts' : 'Photos') . ' can be a JPG, PNG, GIF, WEBP or HEIC' . ($context === 'receipt' ? ', or a PDF.' : '.'));
+    }
 
     // Read whatever EXIF the photo already had BEFORE the resize/
@@ -1143 +1171 @@
     }
 
-    // A RECEIPT NEVER BECOMES AN ATTACHMENT (2026-09-24). Everything in
-    // the media library sits at a public URL, and a receipt is a
-    // purchase record: vendor, amount, date, often a card's last four.
-    // Job PHOTOS still go to the media library, because a photo of a
-    // finished fence is the thing the owner wants to text to a customer
-    // and nothing on it is private.
+    // NEITHER A RECEIPT NOR A PHOTO BECOMES AN ATTACHMENT. Everything in
+    // the media library sits at a public URL. A receipt is a purchase
+    // record (vendor, amount, date, often a card's last four; 2026-09-24)
+    // and a job photo is the inside of somebody's house with the address
+    // on the job (decision 18 of the 2026-10-13 audit; 1.2.081).
     //
     // The file has already been resized and had its EXIF read above, so
     // this just moves it out of uploads/ and into the private folder
-    // under a generated name. See includes/receipt-storage.php.
+    // under a generated name. A photo gets a thumbnail beside it, since
+    // the gallery, the Before/After pairs and the job page show it
+    // small; a receipt is served at the size it was stored. See
+    // includes/receipt-storage.php and includes/photo-storage.php.
     $private_file  = '';
     $attachment_id = 0;
@@ -1164 +1194 @@
         $private_file = $adopted[0];
     } else {
-        $attachment_id = wp_insert_attachment([
-            'post_mime_type' => $upload['type'],
-            'post_title'     => sanitize_file_name(basename($upload['file'])),
-            'post_content'   => '',
-            'post_status'    => 'inherit',
-        ], $upload['file']);
-
-        if (!$attachment_id || is_wp_error($attachment_id)) {
-            return new WP_Error('paintops_attach_failed', 'Could not save the uploaded photo.');
-        }
-    }
-
-    // Left to its defaults, wp_generate_attachment_metadata() generates
-    // every image size WordPress core AND the active theme have
-    // registered, thumbnail, medium, medium_large, large, whatever
-    // custom sizes a theme adds, for every single photo/receipt.
-    // paintops_get_job_photos() only ever reads 'medium' (grid thumbnail)
-    // and 'full' (the original file itself, already capped to ~1600px by
-    // paintops_resize_and_compress_image() above, not a generated size,
-    // so it exists regardless of this filter). Everything else was pure
-    // wasted disk space that multiplies with every photo on every job
-    // (one upload was producing 6 files on disk). Scoped narrowly to
-    // just this one call, so the rest of the site's media library,
-    // blog post images uploaded the normal way, etc., keeps its usual
-    // theme-registered sizes.
-    // Only an attachment has generated sizes. A private receipt is stored
-    // once, at the size the resize above left it, which is already
-    // bounded to roughly 1600px; nothing asks it for a 'medium'.
-    if (!$is_pdf_receipt && $attachment_id > 0) {
-        add_filter('intermediate_image_sizes_advanced', 'paintops_restrict_photo_image_sizes');
-        $attach_data = wp_generate_attachment_metadata($attachment_id, $upload['file']);
-        remove_filter('intermediate_image_sizes_advanced', 'paintops_restrict_photo_image_sizes');
-        wp_update_attachment_metadata($attachment_id, $attach_data);
+        $stored = paintops_photo_store_file((string) $upload['file']);
+        if (is_wp_error($stored)) {
+            wp_delete_file($upload['file']);
+            return new WP_Error('paintops_attach_failed', $stored->get_error_message());
+        }
+        $private_file = $stored;
     }
 
@@ -1546 +1549 @@
         }
 
-        return '<div class="paintops-notice is-success">Photo uploaded (attachment/photo row #' . esc_html((string) $result) . ').</div>';
+        return '<div class="paintops-notice is-success">Photo uploaded.</div>';
     }
 
@@ -1757 +1760 @@
                     <div style="width:170px;">
                         <a href="<?php echo esc_url($photo['full_url']); ?>" target="_blank" rel="noopener noreferrer">
-                            <img src="<?php echo esc_url($photo['url']); ?>" alt="Job photo" style="width:170px;height:170px;object-fit:cover;border-radius:6px;border:1px solid #ddd;display:block;">
+                            <img loading="lazy" decoding="async" src="<?php echo esc_url($photo['url']); ?>" alt="Job photo" style="width:170px;height:170px;object-fit:cover;border-radius:6px;border:1px solid #ddd;display:block;">
                         </a>
 
@@ -1860 +1863 @@
                     <div style="width:220px;">
                         <div style="display:flex;gap:4px;">
-                            <img src="<?php echo esc_url($before['url']); ?>" alt="Before" style="width:108px;height:108px;object-fit:cover;border-radius:6px 0 0 6px;border:1px solid #ddd;display:block;">
-                            <img src="<?php echo esc_url($after['url']); ?>" alt="After" style="width:108px;height:108px;object-fit:cover;border-radius:0 6px 6px 0;border:1px solid #ddd;display:block;">
+                            <img loading="lazy" decoding="async" src="<?php echo esc_url($before['url']); ?>" alt="Before" style="width:108px;height:108px;object-fit:cover;border-radius:6px 0 0 6px;border:1px solid #ddd;display:block;">
+                            <img loading="lazy" decoding="async" src="<?php echo esc_url($after['url']); ?>" alt="After" style="width:108px;height:108px;object-fit:cover;border-radius:0 6px 6px 0;border:1px solid #ddd;display:block;">
                         </div>
                         <?php paintops_render_compare_trigger_button($before['full_url'], $after['full_url']); ?>
@@ -1892 +1895 @@
                     <?php foreach ($unpairedBefores as $waitingIndex => $before): ?>
                         <div class="pp-ba-waiting-card<?php echo esc_attr($waitingIndex === $lastWaitingIndex ? ' pp-ba-just-added' : ''); ?>" style="width:140px;">
-                            <img src="<?php echo esc_url($before['url']); ?>" alt="Before" style="width:140px;height:140px;object-fit:cover;border-radius:6px;border:1px solid #ddd;display:block;">
+                            <img loading="lazy" decoding="async" src="<?php echo esc_url($before['url']); ?>" alt="Before" style="width:140px;height:140px;object-fit:cover;border-radius:6px;border:1px solid #ddd;display:block;">
                             <?php paintops_render_before_after_capture_button((int) $before['id'], $before['full_url']); ?>
                         </div>
@@ -1959 +1962 @@
                         return '<label class="po-pair-tile" for="' . esc_attr($id) . '" title="' . esc_attr($cap) . '">'
                             . '<input type="radio" name="pair_' . esc_attr($side) . '_photo_id" id="' . esc_attr($id) . '" value="' . esc_attr((string) $photo['id']) . '">'
-                            . '<img src="' . esc_url((string) ($photo['url'] ?? '')) . '" alt="">'
+                            . '<img loading="lazy" decoding="async" src="' . esc_url((string) ($photo['url'] ?? '')) . '" alt="">'
                             . '<span class="po-pair-cap">' . esc_html($cap) . '</span>'
                             . '</label>';
@@ -2455 +2458 @@
                 <div style="width:100px;">
                     <a href="<?php echo esc_url($photo['full_url']); ?>" target="_blank" rel="noopener noreferrer">
-                        <img src="<?php echo esc_url($photo['url']); ?>" alt="Job photo" title="<?php echo esc_attr($hoverTitle); ?>" style="width:100px;height:100px;object-fit:cover;border-radius:6px;border:1px solid #ddd;display:block;">
+                        <?php // Eager on purpose: the job page is what a painter opens before driving into a basement, and the worker can only keep a photo the browser asked for. ?>
+                        <img decoding="async" src="<?php echo esc_url($photo['url']); ?>" alt="Job photo" title="<?php echo esc_attr($hoverTitle); ?>" style="width:100px;height:100px;object-fit:cover;border-radius:6px;border:1px solid #ddd;display:block;">
                     </a>
                     <?php if (!empty($photo['notes'])): ?>

paintops/trunk/includes/manage-jobs.php

@@ -1544 +1544 @@
         return function_exists('paintops_login_required_box')
             ? paintops_login_required_box()
-            : '<div class="paintops-login-required"><p>Please log in to access PaintClarity.</p></div>';
+            : '<div class="paintops-login-required" data-po-signed-out="1"><p>Please log in to access PaintClarity.</p></div>';
     }
 

paintops/trunk/includes/private-files.php

@@ -55 +55 @@
 }
 
-/** The types safe to show in the browser rather than hand over as a download. */
+/**
+ * The types safe to show in the browser rather than hand over as a
+ * download. HEIC is included (1.2.081): a browser that can show it does,
+ * one that cannot shows nothing, and until now tapping a HEIC job photo
+ * opened it in Safari rather than downloading it.
+ */
 function paintops_private_inline_types(): array {
-    return ['jpg', 'jpeg', 'png', 'gif', 'webp', 'pdf'];
+    return ['jpg', 'jpeg', 'png', 'gif', 'webp', 'heic', 'pdf'];
 }
 
@@ -259 +264 @@
  * here. Two callers legitimately have a real file and no upload:
  *
- *   1. the job photo handler, which runs wp_handle_upload() first (it
- *      reads EXIF and resizes the file in place before storing it), so
- *      by the time it decides where the file belongs it has been moved
- *      out of the temp directory already;
+ *   1. the job photo and receipt handler, which runs wp_handle_upload()
+ *      first (it reads EXIF and resizes the file in place before storing
+ *      it), so by the time it decides where the file belongs it has been
+ *      moved out of the temp directory already; the AI Visualizer's
+ *      "keep this render" does the same with its own file;
  *   2. the migration, which is moving files that have been sitting in
  *      the media library for months.

paintops/trunk/includes/receipt-storage.php

@@ -16 +16 @@
  * So receipts now live in the same private directory as everything else
  * PaintClarity keeps to itself (see includes/private-files.php) and come
- * back out through ONE route that checks who is asking.
+ * back out through ONE route that checks who is asking. Job PHOTOS
+ * followed in 1.2.081 (includes/photo-storage.php, its own route with a
+ * wider rule); the migration card and batch below move both.
  *
  * ---------------------------------------------------------------------
@@ -171 +173 @@
 function paintops_receipt_delete(string $stored_file, int $attachment_id): void {
     if ($stored_file !== '') {
-        paintops_private_delete_file($stored_file);
+        // A job photo has a thumbnail beside it (includes/photo-storage.php);
+        // a receipt has none, and deleting a name that is not there is a no-op.
+        if (function_exists('paintops_photo_delete_files')) {
+            paintops_photo_delete_files($stored_file);
+        } else {
+            paintops_private_delete_file($stored_file);
+        }
     }
     if ($attachment_id > 0) {
@@ -484 +492 @@
 function paintops_receipt_migration_counts(): array {
     global $wpdb;
-    $out = ['job' => 0, 'business' => 0, 'vehicle' => 0, 'total' => 0];
+    $out = ['job' => 0, 'business' => 0, 'vehicle' => 0, 'photo' => 0, 'total' => 0];
 
     foreach (paintops_receipt_kinds() as $kind => $cfg) {
@@ -494 +502 @@
         $args  = [$t, $cfg['att_col'], $cfg['file_col'], $cfg['file_col'], ''];
         if ($kind === 'job') {
-            // Job PHOTOS stay in the media library on purpose. Only
-            // context='receipt' rows are moving.
+            // The receipt rows of the shared table; the photo rows are
+            // counted below, on their own line of the card.
             $where .= ' AND %i = %s';
             array_push($args, 'context', 'receipt');
@@ -502 +510 @@
         $out[$kind] = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM %i WHERE {$where}", $args));
         $out['total'] += $out[$kind];
+    }
+
+    // JOB PHOTOS (1.2.081, includes/photo-storage.php): every non-receipt
+    // row that still points at a media-library attachment.
+    if (paintops_receipt_columns_ready('job')) {
+        $out['photo'] = (int) $wpdb->get_var($wpdb->prepare(
+            "SELECT COUNT(*) FROM %i WHERE attachment_id > 0 AND (private_file IS NULL OR private_file = '') AND context <> 'receipt'",
+            paintops_table('job_photos')
+        ));
+        $out['total'] += $out['photo'];
     }
     return $out;
@@ -528 +546 @@
  * again.
  *
- * Returns ['moved' => int, 'failed' => int, 'remaining' => int].
+ * Returns ['moved', 'kept', 'missing', 'failed', 'remaining'] (ints):
+ * kept = copied, but the attachment stays in the media library because
+ * the website uses it (photos only); missing = the file is not on the
+ * server right now and the row was left alone; failed = nothing changed.
+ * A batch also stops after about twenty seconds of work, so a slow host
+ * never runs into its own execution limit part way through a row.
  */
 function paintops_receipt_migrate_batch(int $limit = 100): array {
     global $wpdb;
 
-    $limit  = max(1, min(500, $limit));
-    $moved  = 0;
-    $failed = 0;
+    $limit   = max(1, min(500, $limit));
+    $moved   = 0;
+    $kept    = 0;
+    $missing = 0;
+    $failed  = 0;
+    $started = microtime(true);
+    $budget  = (float) apply_filters('paintops_migration_batch_seconds', 20.0);
+    $out_of_time = static function () use ($started, $budget): bool {
+        return (microtime(true) - $started) > $budget;
+    };
+
+    // Rows are walked by id with a cursor, a page at a time, so a run of
+    // rows that are skipped (missing files) at the low end does not hide
+    // the movable rows behind them on every batch (review of 1.2.081).
+    // $reached_end is true when every kind has been walked to its last
+    // row; only then can "nothing but missing files" be said of the site.
+    $reached_end = true;
+    $done_work   = static function () use (&$moved, &$kept, &$failed): int {
+        return $moved + $kept + $failed;
+    };
 
     foreach (paintops_receipt_kinds() as $kind => $cfg) {
-        if ($moved + $failed >= $limit) {
+        if ($done_work() >= $limit) {
+            $reached_end = false;
             break;
         }
@@ -545 +586 @@
         }
         $t     = paintops_table($cfg['table']);
-        $take  = $limit - ($moved + $failed);
-        $where = '%i > 0 AND (%i IS NULL OR %i = %s)';
-        $args  = [$t, $cfg['att_col'], $cfg['file_col'], $cfg['file_col'], ''];
-        if ($kind === 'job') {
-            $where .= ' AND %i = %s';
-            array_push($args, 'context', 'receipt');
-        }
-        array_push($args, 'id', $take);
-        // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- the only interpolation is the literal clause assembled directly above; every identifier and value is bound
-        $rows = $wpdb->get_results($wpdb->prepare(
-            "SELECT id, {$cfg['att_col']} AS att FROM %i WHERE {$where} ORDER BY %i ASC LIMIT %d",
-            $args
-        ));
+        $after = 0;
+        while ($done_work() < $limit) {
+            if ($out_of_time()) {
+                $reached_end = false;
+                break 2;
+            }
+            $take  = $limit - $done_work();
+            $where = '%i > 0 AND (%i IS NULL OR %i = %s) AND %i > %d';
+            $args  = [$t, $cfg['att_col'], $cfg['file_col'], $cfg['file_col'], '', 'id', $after];
+            if ($kind === 'job') {
+                $where .= ' AND %i = %s';
+                array_push($args, 'context', 'receipt');
+            }
+            array_push($args, 'id', $take);
+            // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- the only interpolation is the literal clause assembled directly above; every identifier and value is bound
+            $rows = $wpdb->get_results($wpdb->prepare(
+                "SELECT id, {$cfg['att_col']} AS att FROM %i WHERE {$where} ORDER BY %i ASC LIMIT %d",
+                $args
+            ));
+            if (!$rows) {
+                break; // this kind is walked to the end
+            }
 
         foreach ((array) $rows as $row) {
-            $att  = (int) $row->att;
+            $after = max($after, (int) $row->id);
+            if ($out_of_time()) {
+                $reached_end = false;
+                break 3;
+            }
+            $att = (int) $row->att;
+
+            if ($att > 0 && get_post($att) === null) {
+                // The attachment itself was deleted from the Media Library:
+                // nothing can come back, so the row stops pointing at it.
+                $wpdb->update($t, [$cfg['att_col'] => null], ['id' => (int) $row->id], ['%d'], ['%d']);
+                $moved++;
+                continue;
+            }
             $path = $att > 0 ? (string) get_attached_file($att) : '';
 
             if ($path === '' || !is_file($path)) {
-                // The attachment row exists but its file is gone, which
-                // happens when someone tidied the uploads folder by
-                // hand. There is nothing to move, and leaving the row
-                // pointing at a dead attachment would make it come back
-                // in every future batch forever. Clear it instead and
-                // count it as moved: the receipt was already lost, and
-                // now the record says so.
-                $wpdb->update($t, [$cfg['att_col'] => null], ['id' => (int) $row->id], ['%d'], ['%d']);
-                if ($att > 0) {
-                    wp_delete_attachment($att, true);
-                }
-                $moved++;
+                // The file is not on the server right now. Until 1.2.081
+                // this cleared the row and deleted the attachment on the
+                // reasoning that the receipt was already lost; on a site
+                // whose uploads are offloaded, being restored from a
+                // backup, or on a mount that is briefly away, that turned
+                // every receipt into a row pointing at nothing and
+                // reported success. Now the row and the attachment are
+                // left exactly as they are and counted so the card can say
+                // so (review of 1.2.081).
+                $missing++;
                 continue;
             }
@@ -608 +669 @@
             $moved++;
         }
+        }
+    }
+
+    // JOB PHOTOS, with whatever is left of the batch (1.2.081). The same
+    // copy, point, delete order, plus the thumbnail; see
+    // paintops_photo_migrate_row() in includes/photo-storage.php.
+    if ($done_work() < $limit && $reached_end && function_exists('paintops_photo_migrate_row') && paintops_receipt_columns_ready('job')) {
+        $after = 0;
+        while ($done_work() < $limit) {
+            if ($out_of_time()) {
+                $reached_end = false;
+                break;
+            }
+            $rows = $wpdb->get_results($wpdb->prepare(
+                "SELECT id, attachment_id AS att FROM %i WHERE attachment_id > 0 AND (private_file IS NULL OR private_file = '') AND context <> 'receipt' AND id > %d ORDER BY id ASC LIMIT %d",
+                paintops_table('job_photos'), $after, $limit - $done_work()
+            ));
+            if (!$rows) {
+                break;
+            }
+            foreach ((array) $rows as $row) {
+                $after = max($after, (int) $row->id);
+                if ($out_of_time()) {
+                    $reached_end = false;
+                    break 2;
+                }
+                $res = paintops_photo_migrate_row((int) $row->id, (int) $row->att);
+                if ($res === 'failed') {
+                    $failed++;
+                } elseif ($res === 'missing') {
+                    $missing++;
+                } elseif ($res === 'kept') {
+                    $kept++;
+                } else {
+                    $moved++;
+                }
+            }
+        }
+    } elseif ($done_work() >= $limit) {
+        $reached_end = false;
     }
 
     $counts = paintops_receipt_migration_counts();
-    return ['moved' => $moved, 'failed' => $failed, 'remaining' => (int) $counts['total']];
+    return ['moved' => $moved, 'kept' => $kept, 'missing' => $missing, 'failed' => $failed, 'remaining' => (int) $counts['total'], 'reached_end' => $reached_end];
 }
 
@@ -629 +730 @@
     }
 
-    $n     = (int) $counts['total'];
-    $done  = (int) get_option('paintops_receipts_moved_total', 0);
-    $fails = (int) get_option('paintops_receipts_move_failed', 0);
+    $n       = (int) $counts['total'];
+    $photos  = (int) ($counts['photo'] ?? 0);
+    $rcpts   = $n - $photos;
+    $done    = (int) get_option('paintops_receipts_moved_total', 0);
+    $fails   = (int) get_option('paintops_receipts_move_failed', 0);
+    $kept    = (int) get_option('paintops_photos_kept_public', 0);
+    // The last batch found nothing it could do (every row left is a file
+    // that is not on the server right now): say so instead of offering a
+    // button that would say the same thing again. The option holds the
+    // count at that moment; a count that has changed since means there
+    // is something new to try.
+    $stalled = ((int) get_option('paintops_files_move_stalled', 0) === $n);
+    $parts   = [];
+    if ($photos > 0) {
+        $parts[] = $photos === 1 ? 'one job photo' : number_format_i18n($photos) . ' job photos';
+    }
+    if ($rcpts > 0) {
+        $parts[] = $rcpts === 1 ? 'one receipt image' : number_format_i18n($rcpts) . ' receipt images';
+    }
+    $what = implode(' and ', $parts);
 
     ob_start();
     ?>
     <div class="cs-financial-box po-receipt-move">
-        <h3 style="margin-top:0;">Move receipts into private storage</h3>
+        <h3 style="margin-top:0;">Move <?php echo esc_html($photos > 0 && $rcpts > 0 ? 'photos and receipts' : ($photos > 0 ? 'photos' : 'receipts')); ?> into private storage</h3>
         <p class="description" style="margin-top:0;">
-            <?php echo esc_html($n === 1
-                ? 'One receipt image is still stored in your WordPress media library.'
-                : number_format_i18n($n) . ' receipt images are still stored in your WordPress media library.'); ?>
+            <?php echo esc_html(ucfirst($what) . ($n === 1 ? ' is' : ' are') . ' still stored in your WordPress media library.'); ?>
             Anything in the media library sits at a web address that works for anyone who has it, signed in or not.
-            Moving them puts each one behind the same permission check as the rest of PaintClarity, so a receipt
-            opens for you and your crew and for nobody else.
+            Moving them puts each one behind the same permission check as the rest of PaintClarity<?php
+                echo $photos > 0 ? ': a job photo opens for you and the crew on that job' : '';
+                echo $rcpts > 0 ? ($photos > 0 ? ', a receipt' : ': a receipt') . ' for you and the person who filed it' : '';
+            ?>, and for nobody else.
         </p>
         <p class="description">
             This runs in batches so it never ties up your site. You can stop after any batch and pick it up later.
-            Receipts you have already moved keep working the whole time.
+            Everything you have already moved keeps working the whole time<?php echo $photos > 0 ? ', and a photo on an invoice still shows to the customer holding that invoice link' : ''; ?>.
+            <?php if ($photos > 0) : ?>A photo that your website also uses (in a page or a gallery) is copied and left in the media library as well, so the website keeps it.<?php endif; ?>
         </p>
-        <?php if ($done > 0) : ?>
+        <?php if ($done > 0 || $kept > 0 || $fails > 0) : ?>
             <p class="description"><strong translate="no" class="notranslate"><?php echo esc_html(number_format_i18n($done)); ?></strong> moved so far<?php
+                echo $kept > 0 ? ', ' . esc_html(number_format_i18n($kept)) . ' copied and also left in the media library because your website uses them' : '';
                 echo $fails > 0 ? ', ' . esc_html(number_format_i18n($fails)) . ' could not be moved and were left alone' : ''; ?>.</p>
         <?php endif; ?>
+        <?php if ($stalled) : ?>
+            <p class="description"><strong>Nothing more can be moved right now.</strong>
+                <?php echo esc_html(($n === 1 ? 'The file for the remaining one is' : 'The files for the remaining ' . number_format_i18n($n) . ' are') . ' not on the server at the moment (an uploads folder that is offloaded, being restored, or missing). They were left exactly as they are; if the files come back, this card will offer the button again.'); ?>
+            </p>
+        <?php else : ?>
         <form method="post" style="margin:12px 0 0;">
             <?php paintops_nonce_field('paintops_move_receipts', 'paintops_move_receipts_nonce'); ?>
@@ -659 +784 @@
             </button>
         </form>
+        <?php endif; ?>
     </div>
     <?php
@@ -682 +808 @@
     }
     if (!function_exists('paintops_user_can_view_financials') || !paintops_user_can_view_financials()) {
-        $done = '<div class="paintops-notice is-error">You do not have permission to move receipts.</div>';
+        $done = '<div class="paintops-notice is-error">You do not have permission to move files.</div>';
         return $done;
     }
@@ -688 +814 @@
     $res = paintops_receipt_migrate_batch(100);
 
-    update_option('paintops_receipts_moved_total', (int) get_option('paintops_receipts_moved_total', 0) + (int) $res['moved'], false);
-    if ((int) $res['failed'] > 0) {
-        update_option('paintops_receipts_move_failed', (int) $res['failed'], false);
-    }
-
-    if ((int) $res['moved'] === 0 && (int) $res['failed'] === 0) {
+    $did = (int) $res['moved'] + (int) $res['kept'];
+    update_option('paintops_receipts_moved_total', (int) get_option('paintops_receipts_moved_total', 0) + $did, false);
+    if ((int) $res['kept'] > 0) {
+        update_option('paintops_photos_kept_public', (int) get_option('paintops_photos_kept_public', 0) + (int) $res['kept'], false);
+    }
+    // The failure count is this batch's, not a running total: a clean
+    // batch clears it, so the card does not repeat an old number forever.
+    update_option('paintops_receipts_move_failed', (int) $res['failed'], false);
+    // Every row left is a missing file: remember the count so the card
+    // stops offering the button until that count changes.
+    update_option('paintops_files_move_stalled', ($did === 0 && (int) $res['failed'] === 0 && (int) $res['missing'] > 0 && !empty($res['reached_end'])) ? (int) $res['remaining'] : 0, false);
+
+    if ($did === 0 && (int) $res['failed'] === 0 && (int) $res['missing'] === 0) {
         $done = '<div class="paintops-notice is-success">There was nothing left to move.</div>';
         return $done;
     }
-
-    $msg = number_format_i18n((int) $res['moved']) . ' receipt' . ((int) $res['moved'] === 1 ? '' : 's') . ' moved into private storage.';
+    if ($did === 0 && (int) $res['failed'] === 0) {
+        $done = '<div class="paintops-notice is-warning">' . esc_html(number_format_i18n((int) $res['missing']) . ' file' . ((int) $res['missing'] === 1 ? ' is' : 's are') . ' not on the server right now, so nothing was moved. They were left exactly as they are.' . (empty($res['reached_end']) ? ' Press the button again to carry on past them.' : '')) . '</div>';
+        return $done;
+    }
+
+    $msg = number_format_i18n((int) $res['moved']) . ' file' . ((int) $res['moved'] === 1 ? '' : 's') . ' moved into private storage.';
+    if ((int) $res['kept'] > 0) {
+        $msg .= ' ' . number_format_i18n((int) $res['kept']) . ' ' . ((int) $res['kept'] === 1 ? 'photo was' : 'photos were') . ' copied and also left in the media library because your website uses ' . ((int) $res['kept'] === 1 ? 'it' : 'them') . '.';
+    }
     if ((int) $res['remaining'] > 0) {
         $msg .= ' ' . number_format_i18n((int) $res['remaining']) . ' still to go, press the button again to continue.';
     } else {
         $msg .= ' That was the last of them.';
+    }
+    if ((int) $res['missing'] > 0) {
+        $msg .= ' ' . number_format_i18n((int) $res['missing']) . ' ' . ((int) $res['missing'] === 1 ? 'is' : 'are') . ' not on the server right now and ' . ((int) $res['missing'] === 1 ? 'was' : 'were') . ' left alone.';
     }
     if ((int) $res['failed'] > 0) {
@@ -711 +854 @@
     }
 
-    $done = '<div class="paintops-notice ' . ((int) $res['failed'] > 0 ? 'is-warning' : 'is-success') . '">' . esc_html($msg) . '</div>';
+    $done = '<div class="paintops-notice ' . (((int) $res['failed'] > 0 || (int) $res['missing'] > 0) ? 'is-warning' : 'is-success') . '">' . esc_html($msg) . '</div>';
     return $done;
 }

paintops/trunk/includes/schema.php

@@ -476 +476 @@
 
     // Job photos and expense receipts, both are just images attached to
-    // a job, stored as real WordPress media attachments (so they show up
-    // in the Media Library, survive backups, and work with any offload-
-    // to-S3 plugin) with this table only tracking which job/expense each
+    // a job. Since 1.2.058 (receipts) and 1.2.081 (photos) the file is in
+    // the plugin's private folder under the generated name in
+    // private_file, served through a permission-checked route; rows from
+    // before are media-library attachments (attachment_id) until the
+    // Checkup card moves them. This table tracks which job/expense each
     // one belongs to and which of the two buckets it's in. "context"
     // separates general job photos (before/after, progress shots, an
@@ -1575 +1577 @@
         'photo_role'      => $wpdb->prepare("ALTER TABLE %i ADD COLUMN photo_role VARCHAR(10) NULL", $photos),
         'paired_photo_id' => $wpdb->prepare("ALTER TABLE %i ADD COLUMN paired_photo_id BIGINT UNSIGNED NULL", $photos),
-        // PRIVATE RECEIPT STORAGE (2026-09-24). A receipt row carries
-        // either this file name or the old attachment_id, never both
-        // once it has been moved. See includes/receipt-storage.php and
-        // the batched migration on the Checkup screen. Job PHOTOS are
-        // untouched and keep using attachment_id.
+        // PRIVATE STORAGE (receipts 2026-09-24, job photos 1.2.081). A
+        // row carries either this file name or the old attachment_id,
+        // never both once it has been moved. See includes/receipt-storage.php,
+        // includes/photo-storage.php and the batched migration on the
+        // Checkup screen.
         'private_file'    => $wpdb->prepare("ALTER TABLE %i ADD COLUMN private_file VARCHAR(190) NULL", $photos),
     ];

paintops/trunk/includes/timeoff.php

@@ -23 +23 @@
 // including it. Kept here too as defense in depth in case that changes.
 if (!paintops_user_can_manage()) {
-    echo '<div class="paintops-login-required"><p>Please log in to access PaintClarity.</p></div>';
+    echo '<div class="paintops-login-required" data-po-signed-out="1"><p>Please log in to access PaintClarity.</p></div>';
     return;
 }

paintops/trunk/paintops.php

@@ -5 +5 @@
  * Plugin URI: https://paintclarity.com
  * Description: Estimating, scheduling, job tracking, crews, invoicing, and profit reporting for painting contractors.
- * Version: 1.2.080
+ * Version: 1.2.081
  * Author: PaintClarity
  * Author URI: https://paintclarity.com/the-paintclarity-story/
@@ -167 +167 @@
         }
     }
-    define( 'PAINTOPS_VERSION', '1.2.080' );
+    define( 'PAINTOPS_VERSION', '1.2.081' );
     define( 'PAINTOPS_PLUGIN_FILE', __FILE__ );
     define( 'PAINTOPS_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
@@ -4949 +4949 @@
      *  per PaintClarity table plus a settings.json and a README. This is an
      *  export for the accountant / a spare off-site copy / moving sites,
-     *  NOT a full backup: NO FILE of any kind is included. Photos and
-     *  receipt images live in the media library; supporting documents live
-     *  in uploads/paintops-private/ and are listed in expense_files.csv
-     *  without their contents. The README and the Business-page card say so
+     *  NOT a full backup: NO FILE of any kind is included. Photos, receipt
+     *  images and supporting documents live in uploads/paintops-private/
+     *  (older ones still in the media library until the Checkup card has
+     *  moved them); the documents are listed in expense_files.csv without
+     *  their contents. The README and the Business-page card say so
      *  and point to a real full-site backup guide. No import/restore is
      *  offered yet. Secrets (API keys, tokens) are never exported.
@@ -5709 +5710 @@
         }
         $paintops_login_url = wp_login_url( $paintops_back );
-        return '<div class="paintops-login-required" style="max-width:420px;margin:48px auto;padding:28px 24px;border:1px solid #dfe5ec;border-radius:12px;background:#fff;color:#1f2d3d;text-align:center;box-shadow:0 2px 10px rgba(20,40,70,0.06);">' . '<p style="margin:0 0 6px;font-size:17px;font-weight:700;color:#1f2d3d;">Please log in to access PaintClarity</p>' . '<p style="margin:0 0 18px;font-size:14px;color:#556677;">Sign in with your team username and password. You will land right back where you were headed.</p>' . '<p style="margin:0;"><a href="' . esc_url( $paintops_login_url ) . '" style="display:inline-block;background:#2f5aae;color:#ffffff;text-decoration:none;font-weight:600;padding:12px 28px;border-radius:8px;">Log In</a></p>' . '</div>';
+        return '<div class="paintops-login-required" data-po-signed-out="1" style="max-width:420px;margin:48px auto;padding:28px 24px;border:1px solid #dfe5ec;border-radius:12px;background:#fff;color:#1f2d3d;text-align:center;box-shadow:0 2px 10px rgba(20,40,70,0.06);">' . '<p style="margin:0 0 6px;font-size:17px;font-weight:700;color:#1f2d3d;">Please log in to access PaintClarity</p>' . '<p style="margin:0 0 18px;font-size:14px;color:#556677;">Sign in with your team username and password. You will land right back where you were headed.</p>' . '<p style="margin:0;"><a href="' . esc_url( $paintops_login_url ) . '" style="display:inline-block;background:#2f5aae;color:#ffffff;text-decoration:none;font-weight:600;padding:12px 28px;border-radius:8px;">Log In</a></p>' . '</div>';
     }
 
@@ -7792 +7793 @@
         require_once PAINTOPS_PLUGIN_DIR . 'includes/receipt-evidence.php';
         require_once PAINTOPS_PLUGIN_DIR . 'includes/receipt-storage.php';
+        // Job photos in the same private folder, their own route and the
+        // thumbnail beside each one (1.2.081). After receipt-storage.php,
+        // whose migration batch and delete helper call into it.
+        require_once PAINTOPS_PLUGIN_DIR . 'includes/photo-storage.php';
         // Review ask card at the foot of Checkup (free, administrators only).
         require_once PAINTOPS_PLUGIN_DIR . 'includes/checkup-review.php';

paintops/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.2.080
+Stable tag: 1.2.081
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -112 +112 @@
 
 = What happens to my data if I deactivate or delete the plugin? =
-Nothing is deleted. Your jobs, quotes, customers, payments, hours, and photos stay in your WordPress database, so nothing is lost if you deactivate temporarily or reinstall later. If you truly want the data gone, delete the plugin's tables and its uploads from your database and media library.
+Nothing is deleted. Your jobs, quotes, customers, payments, hours, and photos stay in your WordPress database, so nothing is lost if you deactivate temporarily or reinstall later. If you truly want the data gone, delete the plugin's tables from your database and the paintops-private folder from your uploads.
 
 = Does it work without OpenAI, Stripe, or Google Maps? =
@@ -153 +153 @@
 
 == Changelog ==
+= 1.2.081 =
+* Changed: job photos now live in a private folder on your server instead of the WordPress media library, the same way receipts have since 1.2.058. A photo opens for you and for the painters on that job, and for nobody else; the media library sat at a web address that worked for anyone who had it. Each photo keeps a small copy beside it for the gallery, the Before/After pairs and the job page, so those load no slower than before. A photo you put on an invoice still shows to the customer holding that invoice link. Checkup shows a card with the number of photos and receipts still in the media library and a button that moves them in batches of 100; everything keeps working while that runs, a photo your website also uses in a page or gallery is copied and left in the media library as well, and a file that is not on the server right now is left alone and counted rather than written off. Photos from the AI Visualizer are kept the same way. The painter's phone now saves the photos of the day's jobs along with the job pages, so they are there with no signal even for a job that was never opened, and on a shared phone signing out clears the photos and receipts the app had saved.
+* Changed: the "Review on Capterra" button on Checkup opens Capterra's own write-a-review form.
+
 = 1.2.080 =
 * Changed: office access is now administrators only. Any WordPress user who could edit posts (Author, Contributor, Editor) used to be full PaintClarity staff with every job, customer, lead and note. Painters and helpers keep their own role and screens. A site that used an Editor account for the office needs to make that person an administrator.
@@ -181 +185 @@
 * Added: Checkup tells administrators when the site is not on HTTPS, lists the features that depend on it (home-screen install, offline mode, online payments, encryption) and what to do. The same check has lived in Settings > Setup Health since July.
 
-= 1.2.078 =
-* Added: a review card at the foot of Checkup, for administrators, with a link to leave an honest WordPress.org review and the two steps to get a free WordPress.org account. It appears once the site has completed three jobs or used PaintClarity for a month; "I already reviewed" hides it for good, "Maybe later" for sixty days. Reviews are never paid or rewarded.
-* Changed: the link at the foot of the menu that read "WP Admin" is now "Settings" and opens PaintClarity > Settings. Administrators only, as before.
-* Added: Help now opens with "Watch the walkthrough", a link to the five-minute video tour in the Help Center, with chapter links to jump to any part of the app.
-* Fixed: the Jobs rows keep their layout when the browser translates the page. The Actions toggle used to grow across the Job Value figure, crew initials were translated and spilled out of their circles, and the "Job Value" header, the section counts and "Tomorrow" stayed English. The toggle is now capped to its column, initials and crew names are left alone, and the labels, counts and "Tomorrow" translate. Lead rows pin the contact and the received date the same way.
-* Fixed: on Production Rates, "Add area" on a completed job that has no paintable area now opens a one-field Save form right in the row, the same form the completion confirmation uses, and the job's rate appears as soon as it is saved. It used to send you to Edit Job.
-* Fixed: "Add hours" on Production Rates now opens the job's Hours page, where hours are entered. It used to open Job Pulse, which only shows them.
-* Fixed: new jobs, quotes and invoices are stamped with the site's own date and time. They used to take the database server's clock (UTC on most hosts), so on a US site a quote or invoice created in the evening carried the next day's date, and an invoice's balance could read low for a few hours after another invoice on the same job was marked paid. Records created before this update keep their original stamp.
-
 The full history is in changelog.txt in the plugin folder.