Add AI-assisted signature appearance authoring #9049

Goal

Use Nextcloud AI capabilities to help administrators/users create or refine LibreSign signature appearance templates while keeping the normal template editor, validator and renderer authoritative.

AI is an optional authoring aid. The underlying template functionality must remain fully usable without AI.

Intended experience

Potential assistance includes:

• generate an initial appearance from a natural-language request;
• improve or simplify an existing appearance;
• suggest layout/content changes;
• add supported variables;
• produce a draft compatible with the established template contract.

The user must review a preview and explicitly apply a generated draft. AI output must never be saved automatically.

Architectural constraints

This epic consumes:

• the shared AI capability/policy contract;
• the signature appearance/template contract.

AI output must be converted to and validated against the normal LibreSign template representation. Do not create an AI-only template format or bypass the normal renderer.

Security

• Treat prompts and model output as untrusted.
• Reject unsupported placeholders or template constructs.
• Apply the same sanitizer/validator used by manually authored templates.
• Never execute generated scripts, arbitrary functions, filesystem/network operations or remote resources.
• Do not allow AI generation to widen the current actor's policy permissions.

UX and prototyping

Before implementing the final interaction:

• prototype where AI assistance belongs in the existing editor;
• review official Nextcloud AI affordances such as Assistant buttons/content containers;
• compare relevant document/signature authoring experiences;
• define generate, refine, preview, reject, retry and apply states;
• ensure users can always continue with the manual editor;
• make AI-generated content clearly identifiable until explicitly applied.

Documentation

Document how AI-assisted appearance authoring works, prerequisites, policy controls, limitations, review/apply behavior and troubleshooting. Cross-link to the normal signature appearance documentation instead of duplicating the template reference.

Planning gate

Preserve the current product research and expected behavior, but do not fully decompose implementation issues until both the AI foundation and template architecture have established their final contracts.

At that point, re-evaluate whether the available Task Processing task types and template representation still support this design before creating focused implementation issues.

Non-goals

• replacing the manual template editor;
• letting AI define the template grammar;
• autosaving generated content;
• provider/model configuration inside LibreSign.

Done when

• AI assistance is available only when capability and policy allow it.
• Generated drafts pass normal template validation/sanitization.
• Users preview and explicitly apply changes.
• Manual authoring remains fully available.
• Security/adversarial cases are covered.
• The interaction follows reviewed/prototyped UX.
• The feature is documented and cross-linked to the normal template documentation.

Decomposition gate

This epic is intentionally blocked by prerequisite work tracked through GitHub's native dependency relationships.

Do not create a full implementation backlog for this epic while its blockers are open.

When all blockers are complete, review this epic against the contracts, tests, documentation and constraints actually produced by the blocking work. Update the goal, scope, architecture, UX assumptions, security requirements, testing strategy and documentation requirements where needed. Only then create focused implementation sub-issues.

The current description preserves product intent and research; it is not authorization to implement around unfinished prerequisite contracts.