3.8 KiB
Media and measurements
Photo lifecycle
flowchart LR
I["Camera or imported image"] --> O["Correct orientation"]
O --> C["Crop if required"]
C --> Z["Resize and JPEG re-encode"]
Z --> X["Remove metadata"]
X --> U["Authenticated upload"]
U --> V["Server decode and policy validation"]
V --> E["Authenticated encryption"]
E --> F["Opaque private file"]
F --> D["Encrypted metadata in PocketBase"]
Android and Web should transform progress photos before upload to conserve bandwidth. The browser may use createImageBitmap and Canvas/OffscreenCanvas; Android uses a maintained image pipeline. Client transformation is never trusted as server validation.
Server processing is bounded against image bombs. Reasonable policy violations may be normalized server-side; invalid or extreme inputs are rejected. Plaintext temporary files have restrictive permissions, short lifetimes, and cleanup on success/failure/startup.
Photo policy
During setup the administrator chooses an initial profile. Later settings affect future uploads only. Existing media is not recompressed. The administrator can allow per-user choices up to the maximum or enforce one profile.
Each stored photo records actual width, height, size, applied profile, capture/session time, view type, checksum, and processing version. The original camera file is not retained by default.
Access and display
Media URLs are short-lived authenticated application routes or authenticated streams, never public filesystem paths. Verify owner/share authorization on every request. Prevent proxy caching; client caches must be private and encrypted/ephemeral as appropriate.
Timeline sorting uses the linked measurement session, not upload time. Comparison pairs matching view types and supports first/latest and arbitrary selected dates. No automatic face/body recognition in V1.
Avatars
Avatar processing is fixed: square user-controlled crop, 512x512 JPEG, approximately 85% quality, 128x128 thumbnail, EXIF removal, server validation, encryption, and authenticated instance-only visibility. Users may instead use initials or a built-in graphic.
Parametric silhouette
Prefer lightweight vector/SVG or Canvas geometry over a large bitmap catalog. Provide male and female anatomical bases with multiple structural templates and measurement-driven control points. The rendering engine consumes canonical session values and produces a reproducible view for that session.
Requirements:
- no face detail or biometric recognition;
- same measurements produce the same geometry for a given renderer version;
- missing values degrade gracefully and are visibly marked;
- old sessions can be rendered with current or recorded renderer version;
- silhouette selection and morphology labels do not modify stored measurements or health calculations;
- display a concise disclaimer that it is an indicative visualization.
Measurement quality
Each value records origin and confidence context. Direct scale weight and impedance are measured; manual tape entries are manual; imported provider values are imported; formula outputs are estimated or calculated with algorithm version.
The UI avoids false precision, especially for bioimpedance-derived values and tape measurements. Charts show points and trends without implying medical significance. Corrections update an existing logical record and sync version rather than creating accidental duplicates.
Export
Web-only personal export is generated after recent authentication. Stream generation to avoid excessive memory. CSV uses stable English field codes plus localized human-readable headers where appropriate, explicit units and ISO timestamps. Photo filenames include date, view, and a collision-safe suffix. Exports expire quickly, are encrypted while staged, downloadable once or for a short window, and audited.