Dedicate the project page to the project

The project detail page becomes a full project showcase built entirely
from existing platform mechanisms. One encompassing dark card wraps the
page; inner panels (tab bar, sidebar cards, devlog entries, comments)
sit one elevation lighter. The hero opens with a cover banner and an
optional logo tile, both plain attachment references
(cover_attachment_uid/logo_attachment_uid) uploaded through the
standard dp-upload attachment widget and linked via the existing
link_attachments choke point - the route validates each uid belongs to
the actor and is an image, and an empty value on edit keeps the current
one. The title block, type/platform chips and author row overlay the
banner behind a scrim with a dark text shadow, next to an owner-set
Visit Website CTA; website_url and repo_url are normalized in models
and render with rel noopener nofollow.

An anchor tab bar (Overview, Devlog, Screenshots when present,
Comments, Files) navigates the page. The main column keeps About, the
devlog timeline (with devlog_count and an owner Post update button
opening the shared composer preset to the devlog topic + project - the
form now lives once in _post_composer_form.html, included by feed.html
and project_detail.html), a Screenshots gallery built from image
attachments minus the cover/logo (thumbnails, lightbox, 12 rendered),
and the comment thread; the sidebar holds Links, Stats and the Author
card. Owners add gallery images from the More menu via
POST /projects/{slug}/screenshots (owner-only, audit
project.screenshots.add, Devii action project_add_screenshots, docs id
projects-screenshots). comment_count/devlog_count ride
ProjectDetailOut, the new fields ride ProjectOut, and the create/edit
faces (modals, Devii actions, API docs) carry them. The project
comment/files e2e tests scope their locators per the documented
dual-control idiom, and new unit/api/e2e tests cover URL normalization,
the counts, the hero attachment guard, the screenshots flow and the
preset composer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/api/projects/devlog.py

@@ -271,3 +271,124 @@ def test_devlog_works_for_guest_visitor(app_server):
     assert "devlog_posts" in body
     assert body["devlog_posts"] == []
 
+
+def test_devlog_count_and_comment_count_in_json(app_server):
+    """devlog_count and comment_count ride the detail JSON."""
+    session, name = _member()
+    project = _create_project(session)
+    slug = project["slug"] or project["uid"]
+    user = _db_user(name)
+
+    for i in range(3):
+        _create_post_direct(project["uid"], user["uid"], i)
+
+    r = session.get(f"{BASE_URL}/projects/{slug}", headers=JSON)
+    assert r.status_code == 200, r.text[:300]
+    body = r.json()
+    assert body["devlog_count"] == 3
+    assert body["comment_count"] == 0
+
+
+def _upload_image(session, name="shot.png", color=(30, 60, 120)):
+    import io
+    from PIL import Image
+
+    buf = io.BytesIO()
+    Image.new("RGB", (10, 10), color).save(buf, "PNG")
+    r = session.post(
+        f"{BASE_URL}/uploads/upload",
+        files={"file": (name, buf.getvalue(), "image/png")},
+    )
+    assert r.status_code == 201, r.text[:300]
+    return r.json()["uid"]
+
+
+def test_cover_and_logo_attachments_render_in_hero(app_server):
+    """cover/logo attachment uids resolve to the hero banner and logo tile."""
+    session, _ = _member()
+    cover_uid = _upload_image(session, "cover.png", (10, 20, 90))
+    logo_uid = _upload_image(session, "logo.png", (90, 20, 10))
+
+    r = session.post(
+        f"{BASE_URL}/projects/create",
+        headers=JSON,
+        data={
+            "title": _unique("dlhero"),
+            "description": "Hero art test project",
+            "project_type": "game",
+            "status": "In Development",
+            "platforms": "PC",
+            "cover_attachment_uid": cover_uid,
+            "logo_attachment_uid": logo_uid,
+        },
+    )
+    assert r.status_code == 200, r.text[:300]
+    slug = r.json()["data"]["slug"]
+
+    refresh_snapshot()
+    row = get_table("projects").find_one(slug=slug)
+    assert row["cover_attachment_uid"] == cover_uid
+    assert row["logo_attachment_uid"] == logo_uid
+
+    html = session.get(f"{BASE_URL}/projects/{slug}").text
+    assert 'class="project-cover-img"' in html
+    assert 'class="project-logo"' in html
+    assert "project-screenshot-grid" not in html, (
+        "Cover and logo must not repeat in the Screenshots gallery"
+    )
+
+
+def test_hero_attachment_uid_rejects_foreign_and_missing(app_server):
+    """A foreign or unknown attachment uid is ignored rather than linked."""
+    owner, _ = _member()
+    other, _ = _member()
+    foreign_uid = _upload_image(other, "foreign.png")
+
+    r = owner.post(
+        f"{BASE_URL}/projects/create",
+        headers=JSON,
+        data={
+            "title": _unique("dlreject"),
+            "description": "Hero guard test project",
+            "project_type": "software",
+            "status": "In Development",
+            "platforms": "",
+            "cover_attachment_uid": foreign_uid,
+            "logo_attachment_uid": "does-not-exist",
+        },
+    )
+    assert r.status_code == 200, r.text[:300]
+    slug = r.json()["data"]["slug"]
+    refresh_snapshot()
+    row = get_table("projects").find_one(slug=slug)
+    assert row["cover_attachment_uid"] is None
+    assert row["logo_attachment_uid"] is None
+
+
+def test_owner_adds_screenshots_from_the_page(app_server):
+    """POST /projects/{slug}/screenshots links uploads into the gallery; non-owners are refused."""
+    session, _ = _member()
+    project = _create_project(session)
+    slug = project["slug"] or project["uid"]
+
+    assert "project-screenshot-grid" not in session.get(f"{BASE_URL}/projects/{slug}").text
+
+    uid = _upload_image(session, "gallery.png", (5, 120, 60))
+    r = session.post(
+        f"{BASE_URL}/projects/{slug}/screenshots",
+        headers=JSON,
+        data={"attachment_uids": uid},
+    )
+    assert r.status_code == 200, r.text[:300]
+    assert r.json()["data"]["linked"] == 1
+
+    html = session.get(f"{BASE_URL}/projects/{slug}").text
+    assert "project-screenshot-grid" in html, "Expected the gallery after linking"
+
+    intruder, _ = _member()
+    r = intruder.post(
+        f"{BASE_URL}/projects/{slug}/screenshots",
+        headers=JSON,
+        data={"attachment_uids": uid},
+    )
+    assert r.status_code == 403, r.text[:300]

tests/api/projects/edit.py

@@ -105,6 +105,47 @@ def test_owner_can_edit_project(app_server):
     assert row["platforms"] == "Linux,Web"
 
 
+def test_owner_can_set_and_clear_link_urls(app_server):
+    _, _, key = _signup_project_visibility()
+    slug = _create_project_project_visibility(key, "Website Via Api")["slug"]
+    r = requests.post(
+        f"{BASE_URL}/projects/edit/{slug}",
+        headers=_h_project_visibility(key),
+        data={
+            "title": "Website Via Api",
+            "description": "has links now",
+            "website_url": "myproject.dev/docs",
+            "repo_url": "github.com/me/website-via-api",
+        },
+        allow_redirects=False,
+    )
+    assert r.status_code == 200 and r.json()["ok"] is True
+    row = get_table("projects").find_one(slug=slug)
+    assert row["website_url"] == "https://myproject.dev/docs"
+    assert row["repo_url"] == "https://github.com/me/website-via-api"
+
+    html = requests.get(f"{BASE_URL}/projects/{slug}").text
+    assert "Visit Website" in html
+    assert "Repository" in html
+
+    r = requests.post(
+        f"{BASE_URL}/projects/edit/{slug}",
+        headers=_h_project_visibility(key),
+        data={
+            "title": "Website Via Api",
+            "description": "links removed",
+            "website_url": "",
+            "repo_url": "",
+        },
+        allow_redirects=False,
+    )
+    assert r.status_code == 200
+    row = get_table("projects").find_one(slug=slug)
+    assert row["website_url"] is None
+    assert row["repo_url"] is None
+    assert "Visit Website" not in requests.get(f"{BASE_URL}/projects/{slug}").text
+
+
 def test_non_owner_cannot_edit_project(app_server):
     _, _, owner_key = _signup_project_visibility()
     slug = _create_project_project_visibility(owner_key, "Owner Edit Guard")["slug"]