Editable product info, with HTML descriptions made safe

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -128,6 +128,34 @@ age, not verified) and `tagline`.
   thumbnails generated, extra texture maps accepted (see Better looks).
 - **Format**: IMVU's own product files, as the client loads them, so creators keep using IMVU's tools.
 
+### Product info (**Decided**: editable)
+
+- A product's **files** come in versions that never change; its **info** belongs to the product and its creator
+  can edit it at any time on the hub's website: name, description, icon, tags, category. Stored at the hub, so an
+  edit shows everywhere (every catalog, every client) without re-uploading anything.
+- **Icon**: an image uploaded to the hub, re-encoded there (decoded and saved again as PNG or WebP at fixed sizes,
+  which drops anything hidden in the file) and served from R2.
+- **Description**: HTML, as on IMVU, made safe by an **allowlist** (in Go, bluemonday or equivalent), never a
+  blocklist:
+  - Tags: text formatting (`b`, `i`, `u`, `s`, `em`, `strong`, `small`, `big`, `sub`, `sup`, `font` with `color`
+    and `size`, `span`, `div`, `p`, `br`, `hr`, `center`), lists, simple tables, headings, `a`, `img`.
+  - Styles: only a short list of properties (color, background color, font size, weight and style, text
+    alignment and decoration) with checked values; no `url()`, no positioning, nothing that can cover the page.
+  - Links: `http`/`https` only, with `rel="nofollow ugc noopener noreferrer"`, opening outside the page.
+  - Images: `https` only, fetched through the hub's image proxy (re-encoded, size-limited), so viewers' addresses
+    don't reach outside servers and pages don't mix in insecure content.
+  - Everything else is removed: scripts, event attributes (`onclick`, ...), `iframe`, `object`, `embed`, `form`,
+    `style` and `link` elements, `javascript:` and `data:` addresses, comments.
+  - Size limits on the description.
+- **Cleaned twice**: when saved (the stored HTML is already safe) and again when shown, by whatever shows it: the
+  hub's website (with a strict Content-Security-Policy that allows no inline scripts) and the proxy.
+- **In the client, the proxy is the last line**: IMVU's pages run in Gecko 1.9.2 with chrome privileges (they can
+  call into the client's Python), so a script there could do far more than on a website. The proxy cleans
+  descriptions again with the same allowlist before handing them to the client, and gives the client text-only
+  fields (name, tags) as escaped text.
+- **History and moderation**: every edit is kept as a revision; moderators see the history and can revert or lock
+  a product's info. Changing the rating to *adult* is immediate; changing it to *general* is reviewed first.
+
 ### Catalogs (`t5de-catalog`)
 
 - Go program, SQLite or Postgres, S3-compatible storage, docker-compose for operators.