


server.php
?action=photo_link_image
&server_name=[string]
&player_id=[int]


Returns an image to be used in a link icon.
The image will indicate whether there are any photos available for this life.




server.php
?action=photo_appearances
&server_name=[string]
&player_id=[int]


Shows page of player's photo appearances.






server.php
?action=front_page


Shows recent photos.







server.php
?action=get_sequence_number
&email=[email address]

Return:
sequence number
OK

Gets next valid sequence number associated with email.  Note that even if
email is unknown to server, 0 will be returned so that first photo can be
submitted.






POST to:
server.php

action=submit_photo
&email=[email address]
&sequence_number=[int]
&hash_value=[hash value]
&server_sig=[hash value]
&server_name=[string]
&photo_author_id=[int]
&photo_subjects_ids=[string]
&photo_author_name=[string]
&photo_subjects_names=[string]
&jpg_base64=[jpg file as base 64]
&negative_jpg_base64=[negative version of jpg file as base 64]

Return:
OK
photo_id
-or-
DENIED

Used by clients to submit photos.

hash_value is computed on both ends with:

HMAC_SHA1( account_key, sequence_number )


server_sig is provided by a trusted server, computed by:

HMAC_SHA1( shared_secret, sequence_number )

(Client must ask server for a signature before submitting a photo.)


If sequence number is <= previously used sequence number for this email address,
request will be rejected.


photo_author is character name of person who took photo

photo_subjects is comma-delimited list of character names in photo

photo_author and photo_subjects must be URL-encoded (Maybe+Like+This)

photo_subjects_ids is comma-delimited list of ints



photo_id (returned value) is a lowercase 40-digit hex string 
         like c63d4aaaba92dbf846b4f688a3663d075a8e5f96

This returned ID can be used to fetch photos from the photo server later like:

http://photos.onehouronelife.com/photos/c63d4aaaba92dbf846b4f688a3663d075a8e5f96.jpg




The JPG file must have a comment section (0xFFFE) containing the hash value
in ASCII, upper case.

Note:
I get that this is completely insecure in terms of verifying that real photos
generated by the real client are submitted.  With appropriate coding,
third-party tools and modified clients can easily submit bogus photos.  As
far as I'm aware, preventing this would be impossible.  But still, this
is a very cool feature to have in the game.

However, it is impossible to submit a photo, bogus or not, that is not signed
by your account key.  In other words, if you submit a bogus photo, I will be
able to verify that you did it.

SO: do not use your account key to submit bogus photos, or photos with bogus
author names, or bogus subject names.  Doing so would be disruptive to the 
game, and wasteful of my time.  If you do this, your account will be banned, 
no second chances, no refund, and no warnings.  This is your warning.



