[oPeras1]

Resolves: #9249

📝 Summary

Add a system-only Policy Workbench setting, disabled by default, allowing external email signers to explicitly save and reuse their visible signature on later documents.

Reuse requires the configured Email confirmation method. When both email token and click to sign are enabled, the email token is required. Saved-image existence is not exposed before verification.

The change also isolates anonymous images by browser and signing request, preserves their storage context in signing jobs, and adds an administrator cleanup command.

🧪 How to test

Run in the documented development environment as the application user:

composer test:unit
composer test:integration -- --filter 'EmailSignerElementsServiceTest|PageControllerTest'
npm test
npm run ts:check
npm run lint
npm run stylelint
composer openapi

Manual acceptance:

1. With the policy disabled, confirm anonymous signers receive no save/reuse controls.
2. Enable “Remember signatures of email signers”. Sign a document with a visible signature and explicitly select “Save my signature for future documents”.
3. Open another request for the same email in a fresh browser session. Choose “Use my saved signature”, verify the email code, and confirm the signing modal reuses that code.
4. Repeat with click to sign and with both confirmation methods enabled. Both enabled must require the email token.
5. Verify invalid codes and a different email cannot retrieve the saved image.
6. Replace and save the signature, then verify the replacement on another request. Delete an unlocked signature and confirm its saved copy is forgotten.
7. Exercise asynchronous signing and confirm the completed PDF contains the visible signature.
8. Preview cleanup on a development instance:
   php occ libresign:signature-elements:cleanup --days=90 --dry-run

Validation evidence

• Focused regression/acceptance tests: 16 runtime integration tests passed; backend and frontend regression coverage included.
• Relevant lint/type/static-analysis checks: ESLint, Stylelint, TypeScript, PHP style and targeted Psalm passed.

🎨 UI / Front-end changes

• Add the system policy switch, explicit save checkbox, saved-signature button and verification-dialog flow.

⚙️ API / Back-end changes

• Add a verified saved-signature endpoint and explicit save consent to signing.
• Capture confirmed images before signing; persist after successful signing or asynchronous job acceptance.
• Preserve anonymous signature storage context in queued jobs.
• Restrict brute-force throttling to invalid credentials and isolate saved-copy deletion failures.
• Add explicit cleanup with retention period and dry-run support.
• Unit and integration tests added or updated.
• Authorization and negative paths covered by focused tests.
• Capabilities reviewed; no additional capability key required.
• Changelog and upgrade notice updated.
• Generated OpenAPI JSON and TypeScript types match regeneration.
• Administrator manual update submitted to LibreSign/documentation.
• [ ]
  Anonymous signers must recreate in-flight drawings after upgrading. Saved images have no automatic expiration; administrators can schedule cleanup. Rotating the instance secret makes older saved signatures unreachable, and cleanup can remove those orphaned images.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[oPeras1]

Hey @vitormattos So, I used some AI (Codex) to help with the PHP and tests because my PHP skills are not that good xd

CI was failing on PHP 8.5. The problem is nextcloud-behat v1.6.3 use an old json-query thing that throw deprecation warnings. Behat sees this as test fail. So Codex changed tests/integration/composer.json to use dev-main instead of ^1.6 for libresign/nextcloud-behat and updated the lockfile.
The fix is already in their main branch, just no tag for it yet. I also updated 6 JSON test expectations to match the new output format, but it still check the same permissions

All local tests passed now (222 scenarios)

Please tell me if is there anything wrong with my current approach

thanks!