fix(ui): add missing opening script tag in base.html Sentry block

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/3780cab7-11b6-470a-935a-57d63bf1d36b

BUILD_DATE

@@ -1 +1 @@
-2026-03-22T14:46:09Z
+2026-03-22T17:37:50Z

CHANGELOG.md

@@ -10,6 +10,81 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## v0.171.2 (2026-03-22)
+
+### Bug Fixes
+
+- **ui**: Fix greyed-out toggle switches on admin connections page
+  ([`46772fc`](https://github.com/christianlouis/DocuElevate/commit/46772fc7461f9f8333b399b301ec969f5caa4c1e))
+
+### Chores
+
+- Upgrade Sentry Browser SDK CDN bundle from v9.x.x to v10.x.x
+  ([`3d0bdf7`](https://github.com/christianlouis/DocuElevate/commit/3d0bdf783649019d631fa0b1156db66e5e3269b4))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`25d32a9`](https://github.com/christianlouis/DocuElevate/commit/25d32a9006161b433dc6bbac3810ab560e5e5847))
+
+- **changelog**: Update changelog [skip ci]
+  ([`9822ba5`](https://github.com/christianlouis/DocuElevate/commit/9822ba583d076671692699cd9856d8fbc7d0218d))
+
+
+## Unreleased
+
+### Chores
+
+- Upgrade Sentry Browser SDK CDN bundle from v9.x.x to v10.x.x
+  ([`3d0bdf7`](https://github.com/christianlouis/DocuElevate/commit/3d0bdf783649019d631fa0b1156db66e5e3269b4))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`9822ba5`](https://github.com/christianlouis/DocuElevate/commit/9822ba583d076671692699cd9856d8fbc7d0218d))
+
+
+## Unreleased
+
+### Chores
+
+- Upgrade Sentry Browser SDK CDN bundle from v9.x.x to v10.x.x
+  ([`3d0bdf7`](https://github.com/christianlouis/DocuElevate/commit/3d0bdf783649019d631fa0b1156db66e5e3269b4))
+
+
+## v0.171.1 (2026-03-22)
+
+### Bug Fixes
+
+- **admin**: Fix greyed-out QR login toggle on admin connections page
+  ([`d4cc44a`](https://github.com/christianlouis/DocuElevate/commit/d4cc44a72f7821360ffce1c9743efb85dbc65f22))
+
+
+## v0.171.0 (2026-03-22)
+
+### Features
+
+- **ui**: Show file owner, add claim ownership on file summary, detail, and annotations pages
+  ([`9458055`](https://github.com/christianlouis/DocuElevate/commit/9458055661e5458256b51cfe1965b0607d6a478e))
+
+
+## v0.170.0 (2026-03-22)
+
+### Features
+
+- **ui**: Integrate EmbedPDF viewer with annotations panel for bidirectional sync
+  ([`9c98a84`](https://github.com/christianlouis/DocuElevate/commit/9c98a8438ab81c70cc497191449378b914775731))
+
+
+## v0.169.1 (2026-03-22)
+
+### Bug Fixes
+
+- **api**: Add PUT /api/settings/{key} endpoint and shared credentials for Google/Microsoft social
+  login
+  ([`7d6128d`](https://github.com/christianlouis/DocuElevate/commit/7d6128d78f7782d4a687b51220747714ab59df6d))
+
+
 ## v0.169.0 (2026-03-22)
 
 ### Bug Fixes

GIT_SHA

@@ -1 +1 @@
-4a35aab
+3e1b352

RUNTIME_INFO

@@ -1,10 +1,10 @@
 DocuElevate Build Information
 ==============================
-Version: 0.169.0
+Version: 0.171.2
-Build Date: 2026-03-22T14:46:09Z
+Build Date: 2026-03-22T17:37:50Z
-Git Commit: 4a35aabdaa92dfa55d1f3a332691df81e56f025a
+Git Commit: 3e1b35293006b76737c7d2edfc50a14b003ef266
-Git Short SHA: 4a35aab
+Git Short SHA: 3e1b352
 Git Branch: main
-Commit Date: 2026-03-22T15:45:45+01:00
+Commit Date: 2026-03-22T18:37:25+01:00
-Build Timestamp: 2026-03-22T14:46:09Z
+Build Timestamp: 2026-03-22T17:37:50Z
 ==============================

VERSION

@@ -1 +1 @@
-0.169.0
+0.171.2

app/api/qr_auth.py

@@ -31,6 +31,7 @@ from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
 
 from app.auth import require_login
+from app.config import settings
 from app.database import get_db
 from app.middleware.audit_log import get_client_ip
 from app.utils.session_manager import (
@@ -151,6 +152,11 @@ async def create_challenge(
     displayed to the user.  The mobile app scans this QR code and
     calls the ``/claim`` endpoint.
     """
+    if not settings.qr_login_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="QR login feature is currently disabled. Please contact your administrator to enable it.",
+        )
     ip = get_client_ip(request)
     challenge = create_qr_challenge(db, owner_id, ip_address=ip)
 
@@ -187,6 +193,11 @@ async def poll_challenge_status(
     The web UI calls this endpoint every few seconds to check if the
     mobile app has scanned the QR code and claimed the challenge.
     """
+    if not settings.qr_login_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="QR login feature is currently disabled. Please contact your administrator to enable it.",
+        )
     result = get_challenge_status(db, challenge_id, owner_id)
     if not result:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Challenge not found")
@@ -206,6 +217,11 @@ async def claim_challenge(
     serves as proof that the user authorized this login from their web
     session.
     """
+    if not settings.qr_login_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="QR login feature is currently disabled. Please contact your administrator to enable it.",
+        )
     ip = get_client_ip(request)
     result = claim_qr_challenge(db, body.challenge_token, device_name=body.device_name, ip_address=ip)
 

app/config.py

@@ -244,6 +244,10 @@ class Settings(BaseSettings):
             "Useful for admin-configured non-standard durations."
         ),
     )
+    qr_login_enabled: bool = Field(
+        default=True,
+        description="Enable QR code-based login for mobile device authentication (default: True).",
+    )
     qr_login_challenge_ttl_seconds: int = Field(
         default=120,
         description="Time-to-live in seconds for QR login challenges (default: 2 minutes).",

app/utils/settings_service.py

@@ -206,6 +206,14 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": True,
     },
+    "qr_login_enabled": {
+        "category": "Authentication",
+        "description": "Enable QR code-based login for mobile device authentication.",
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     "qr_login_challenge_ttl_seconds": {
         "category": "Authentication",
         "description": "Time-to-live in seconds for QR login challenges (default 120).",

app/views/files.py

@@ -19,6 +19,43 @@ router = APIRouter()
 _FILE_NOT_FOUND = "File not found"
 
 
+def _resolve_owner_context(request: Request, file_record, db: Session) -> dict:
+    """Return owner display info and the current user's effective role.
+
+    Returns a dict with:
+    - ``current_user_role``: one of "owner" / "editor" / "viewer" / None
+    - ``owner_display``: human-readable owner string (display_name or user_id)
+    - ``multi_user_enabled``: whether multi-user mode is active
+    """
+    from app.config import settings
+    from app.models import UserProfile
+    from app.utils.user_scope import get_current_owner_id, get_file_role
+
+    multi_user_enabled = settings.multi_user_enabled
+
+    current_owner_id = get_current_owner_id(request)
+    user_session = request.session.get("user")
+    is_admin = isinstance(user_session, dict) and bool(user_session.get("is_admin"))
+
+    if is_admin:
+        current_user_role: str | None = "owner"
+    else:
+        current_user_role = get_file_role(file_record, current_owner_id, db)
+
+    # Build a human-readable owner label
+    if file_record.owner_id:
+        profile = db.query(UserProfile).filter(UserProfile.user_id == file_record.owner_id).first()
+        owner_display: str | None = profile.display_name if profile and profile.display_name else file_record.owner_id
+    else:
+        owner_display = None  # No owner (unowned)
+
+    return {
+        "current_user_role": current_user_role,
+        "owner_display": owner_display,
+        "multi_user_enabled": multi_user_enabled,
+    }
+
+
 @router.get("/files")
 @require_login
 def files_page(
@@ -268,6 +305,7 @@ def file_summary_page(request: Request, file_id: int, db: Session = Depends(get_
             step_summary = None
 
         pipeline_info = _resolve_pipeline(db, file_record)
+        owner_ctx = _resolve_owner_context(request, file_record, db)
 
         return templates.TemplateResponse(
             "file_summary.html",
@@ -279,6 +317,7 @@ def file_summary_page(request: Request, file_id: int, db: Session = Depends(get_
                 "processed_file_exists": processed_file_exists,
                 "step_summary": step_summary,
                 "pipeline_info": pipeline_info,
+                **owner_ctx,
             },
         )
     except Exception as e:
@@ -353,6 +392,7 @@ def file_view_page(request: Request, file_id: int, db: Session = Depends(get_db)
 
         # Resolve the pipeline assigned to this file (explicit or system default)
         pipeline_info = _resolve_pipeline(db, file_record)
+        owner_ctx = _resolve_owner_context(request, file_record, db)
 
         return templates.TemplateResponse(
             "file_view.html",
@@ -364,6 +404,7 @@ def file_view_page(request: Request, file_id: int, db: Session = Depends(get_db)
                 "processed_file_exists": processed_file_exists,
                 "step_summary": step_summary,
                 "pipeline_info": pipeline_info,
+                **owner_ctx,
             },
         )
     except Exception as e:
@@ -497,17 +538,8 @@ def file_annotations_page(request: Request, file_id: int, db: Session = Depends(
         mime = file_record.mime_type or ""
         is_pdf = mime == "application/pdf" or (file_record.original_filename or "").lower().endswith(".pdf")
 
-        # Determine the current user's role on this file
+        # Determine the current user's role on this file (and owner display info)
-        from app.utils.user_scope import get_current_owner_id, get_file_role
+        owner_ctx = _resolve_owner_context(request, file_record, db)
-
-        current_owner_id = get_current_owner_id(request)
-        user_session = request.session.get("user")
-        is_admin = isinstance(user_session, dict) and bool(user_session.get("is_admin"))
-        if is_admin:
-            current_user_role: str | None = "owner"
-        else:
-            current_user_role = get_file_role(file_record, current_owner_id, db)
-            # None means no access — the template will not show owner-only UI
 
         return templates.TemplateResponse(
             "file_annotations.html",
@@ -517,7 +549,7 @@ def file_annotations_page(request: Request, file_id: int, db: Session = Depends(
                 "original_file_exists": original_file_exists,
                 "processed_file_exists": processed_file_exists,
                 "is_pdf": is_pdf,
-                "current_user_role": current_user_role,
+                **owner_ctx,
             },
         )
     except Exception as e:

app/views/settings.py

@@ -464,7 +464,7 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
 
         # Feature toggles
         sso_auto_login = _is_truthy(_get_effective("sso_auto_login"))
-        qr_login_enabled = _is_truthy(_get_effective("qr_login_challenge_ttl_seconds"))
+        qr_login_enabled = _is_truthy(_get_effective("qr_login_enabled"))
         frontend_url_configured = bool(_get_effective("public_base_url"))
 
         return templates.TemplateResponse(

docs/SentrySetup.md

@@ -181,7 +181,7 @@ Simply leave `SENTRY_DSN` unset (or set it to an empty string).  Neither the Pyt
 ## SDK Version
 
 - **Server:** DocuElevate uses [`sentry-sdk`](https://pypi.org/project/sentry-sdk/) `>=2.20.0,<3.0.0` with the `fastapi`, `celery`, and `sqlalchemy` extras.
-- **Browser:** The `bundle.tracing.replay.min.js` bundle is loaded from the official Sentry CDN (`browser.sentry-cdn.com`).  The version pin is in `frontend/templates/base.html`.
+- **Browser:** The `bundle.tracing.replay.min.js` bundle from the Sentry Browser SDK **v10** is loaded from the official Sentry CDN (`browser.sentry-cdn.com`).  The version pin is in `frontend/templates/base.html`.
 
 ---
 

frontend/static/js/annotations.js

@@ -24,6 +24,10 @@
     _i18n = i18n || {};
     _loadAnnotations();
 
+    // Expose reload function so the EmbedPDF viewer init script can refresh the
+    // list after auto-saving an annotation created inside the viewer.
+    window._reloadAnnotations = _loadAnnotations;
+
     var form = document.getElementById('annotation-form');
     if (form) {
       form.addEventListener('submit', function (e) {
@@ -81,10 +85,18 @@
     typeBadge.className = 'annotation-type annotation-type--' + ann.annotation_type;
     typeBadge.textContent = _i18n['type_' + ann.annotation_type] || ann.annotation_type;
 
-    var pageInfo = document.createElement('span');
+    var pageInfo = document.createElement('button');
-    pageInfo.className = 'annotation-page';
+    pageInfo.type = 'button';
+    pageInfo.className = 'annotation-page annotation-page--link';
+    pageInfo.setAttribute('aria-label', (_i18n.go_to_page || 'Go to page') + ' ' + ann.page);
+    pageInfo.title = (_i18n.go_to_page || 'Go to page') + ' ' + ann.page;
     pageInfo.innerHTML = '<i class="fas fa-file-alt" aria-hidden="true"></i> ' +
       (_i18n.page || 'Page') + ' ' + ann.page;
+    pageInfo.addEventListener('click', function () {
+      if (typeof window._embedpdfScrollToPage === 'function') {
+        window._embedpdfScrollToPage(ann.page);
+      }
+    });
 
     header.appendChild(typeBadge);
     if (ann.color) {

frontend/static/js/claim.js

@@ -0,0 +1,44 @@
+/**
+ * claim.js — Claim-ownership UI helper for unowned documents.
+ *
+ * Usage: call initClaimOwnership(fileId, i18n) after DOMContentLoaded.
+ * The i18n object must contain:
+ *   confirm, success, failed
+ */
+function initClaimOwnership(fileId, i18n) {
+  var btn = document.getElementById('claim-btn');
+  var msg = document.getElementById('claim-msg');
+  if (!btn) return;
+
+  btn.addEventListener('click', function () {
+    if (!confirm(i18n.confirm)) return;
+    btn.disabled = true;
+    fetch('/api/files/' + fileId + '/claim', { method: 'POST' })
+      .then(function (r) { return r.json().then(function (d) { return { ok: r.ok, data: d }; }); })
+      .then(function (result) {
+        if (result.ok || (result.data && result.data.status === 'already_owned')) {
+          if (msg) {
+            msg.textContent = i18n.success;
+            msg.style.color = '#059669';
+            msg.style.display = msg.tagName === 'SPAN' ? 'inline' : 'block';
+          }
+          setTimeout(function () { location.reload(); }, 1200);
+        } else {
+          if (msg) {
+            msg.textContent = (result.data && result.data.detail) || i18n.failed;
+            msg.style.color = '#dc2626';
+            msg.style.display = msg.tagName === 'SPAN' ? 'inline' : 'block';
+          }
+          btn.disabled = false;
+        }
+      })
+      .catch(function () {
+        if (msg) {
+          msg.textContent = i18n.failed;
+          msg.style.color = '#dc2626';
+          msg.style.display = msg.tagName === 'SPAN' ? 'inline' : 'block';
+        }
+        btn.disabled = false;
+      });
+  });
+}

frontend/static/styles.css

@@ -238,3 +238,81 @@ html.dark ::-webkit-scrollbar-thumb:hover { background: #6b7280; }
 
 /* ---- Settings page: sidebar active state (dark) ---- */
 html.dark .bg-blue-50 { background-color: #1e3a5f; }
+
+/* =============================================================
+   DOC-TOGGLE  –  cross-browser toggle switch
+   Works with Tailwind v2 CDN (which lacks after:* utilities).
+   Usage:
+     <label class="doc-toggle">
+       <input type="checkbox" class="sr-only" onchange="...">
+       <span class="doc-toggle-track" aria-hidden="true"></span>
+       <span class="ml-3 ...">Label text</span>
+     </label>
+   ============================================================= */
+
+.doc-toggle {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  cursor: pointer;
+}
+
+.doc-toggle-track {
+  position: relative;
+  display: inline-block;
+  width: 44px;
+  min-width: 44px;
+  height: 24px;
+  background-color: #e5e7eb; /* gray-200 */
+  border-radius: 9999px;
+  transition: background-color 0.2s ease-in-out;
+  flex-shrink: 0;
+}
+
+.doc-toggle-track::after {
+  content: '';
+  position: absolute;
+  top: 2px;
+  left: 2px;
+  width: 20px;
+  height: 20px;
+  background-color: #ffffff;
+  border: 1px solid #d1d5db; /* gray-300 */
+  border-radius: 9999px;
+  transition: transform 0.2s ease-in-out, border-color 0.2s ease-in-out;
+}
+
+.doc-toggle input[type="checkbox"]:checked + .doc-toggle-track {
+  background-color: #4f46e5; /* indigo-600 */
+}
+
+.doc-toggle input[type="checkbox"]:checked + .doc-toggle-track::after {
+  transform: translateX(20px);
+  border-color: #ffffff;
+}
+
+.doc-toggle input[type="checkbox"]:focus-visible + .doc-toggle-track {
+  box-shadow: 0 0 0 2px #ffffff, 0 0 0 4px #6366f1; /* ring-2 ring-indigo-500 with offset */
+}
+
+/* Dark mode overrides */
+html.dark .doc-toggle-track {
+  background-color: #374151; /* gray-700 */
+}
+
+html.dark .doc-toggle-track::after {
+  background-color: #ffffff;
+  border-color: #4b5563; /* gray-600 */
+}
+
+html.dark .doc-toggle input[type="checkbox"]:checked + .doc-toggle-track {
+  background-color: #4f46e5; /* indigo-600 */
+}
+
+html.dark .doc-toggle input[type="checkbox"]:checked + .doc-toggle-track::after {
+  border-color: #ffffff;
+}
+
+html.dark .doc-toggle input[type="checkbox"]:focus-visible + .doc-toggle-track {
+  box-shadow: 0 0 0 2px #111827, 0 0 0 4px #6366f1; /* dark background offset */
+}

frontend/templates/admin_connections.html

@@ -18,11 +18,11 @@
         <p class="text-sm text-gray-500 dark:text-gray-400 mt-1">{{ _("connections.sso_auto_login_description") }}</p>
       </div>
       <div>
-        <label class="relative inline-flex items-center cursor-pointer">
+        <label class="doc-toggle">
-          <input type="checkbox" id="sso-auto-login-toggle" class="sr-only peer"
+          <input type="checkbox" id="sso-auto-login-toggle" class="sr-only"
                  {% if sso_auto_login %}checked{% endif %}
                  onchange="toggleSetting('sso_auto_login', this.checked)">
-          <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-indigo-500 rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-gray-600 peer-checked:bg-indigo-600" style="min-width:44px; min-height:24px;"></div>
+          <span class="doc-toggle-track" aria-hidden="true"></span>
           <span class="ml-3 text-sm font-medium text-gray-700 dark:text-gray-300">{{ _("connections.sso_auto_login") }}</span>
         </label>
       </div>
@@ -44,10 +44,11 @@
         {% endif %}
       </div>
       <div>
-        <label class="relative inline-flex items-center cursor-pointer">
+        <label class="doc-toggle">
-          <input type="checkbox" id="qr-upload-toggle" class="sr-only peer"
+          <input type="checkbox" id="qr-upload-toggle" class="sr-only"
-                 {% if qr_login_enabled %}checked{% endif %} disabled>
+                 {% if qr_login_enabled %}checked{% endif %}
-          <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-indigo-500 rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-gray-600 peer-checked:bg-indigo-600" style="min-width:44px; min-height:24px;"></div>
+                 onchange="toggleSetting('qr_login_enabled', this.checked)">
+          <span class="doc-toggle-track" aria-hidden="true"></span>
           <span class="ml-3 text-sm font-medium text-gray-700 dark:text-gray-300">{{ _("connections.qr_code_enabled") }}</span>
         </label>
       </div>
@@ -199,24 +200,24 @@ function openServiceModal(serviceKey) {
     }
 
     if (meta.type === 'boolean') {
-      // Styled Tailwind toggle switch (matches the page-level toggles)
+      // Styled toggle switch using .doc-toggle CSS class (compatible with Tailwind v2 CDN).
       const toggleWrapper = document.createElement('label');
-      toggleWrapper.className = 'relative inline-flex items-center cursor-pointer';
+      toggleWrapper.className = 'doc-toggle';
       toggleWrapper.setAttribute('aria-label', field.key.replace(/_/g, ' ').replace(/\b\w/g, function(c) { return c.toUpperCase(); }));
 
       const checkbox = document.createElement('input');
       checkbox.type = 'checkbox';
       checkbox.id = 'field-' + field.key;
       checkbox.name = field.key;
-      checkbox.className = 'sr-only peer';
+      checkbox.className = 'sr-only';
       const val = field.value;
       if (val === true || val === 'true' || val === '1' || val === 'True') {
         checkbox.checked = true;
       }
 
-      const slider = document.createElement('div');
+      const slider = document.createElement('span');
-      slider.className = "w-11 h-6 bg-gray-200 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-indigo-500 rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-gray-600 peer-checked:bg-indigo-600";
+      slider.className = 'doc-toggle-track';
-      slider.style.cssText = 'min-width:44px; min-height:24px;';
+      slider.setAttribute('aria-hidden', 'true');
 
       toggleWrapper.appendChild(checkbox);
       toggleWrapper.appendChild(slider);

frontend/templates/base.html

@@ -41,8 +41,10 @@
          upgrading the SDK.
     ──────────────────────────────────────────────────────────────────────── #}
     {% if sentry_dsn %}
-    <script src="https://browser.sentry-cdn.com/9.x.x/bundle.tracing.replay.min.js"
+    <script src="https://browser.sentry-cdn.com/10.45.0/bundle.tracing.replay.feedback.logs.metrics.min.js"
-            crossorigin="anonymous"></script>
+      integrity="sha384-TCY3xw5Ej940LIWfS6PwhCCBl7lvEsxBpHy+BirF+EycSQUvXbfZsgsLi0oU18yZ"
+      crossorigin="anonymous"
+    ></script>
     <script>
       if (window.Sentry) {
         Sentry.init({

frontend/templates/file_annotations.html

@@ -380,6 +380,23 @@
       font-size: 0.75rem;
       color: #718096;
     }
+    .annotation-page--link {
+      background: none;
+      border: none;
+      padding: 0;
+      cursor: pointer;
+      font-size: 0.75rem;
+      color: #718096;
+      text-decoration: none;
+      min-height: 0;
+    }
+    .annotation-page--link:hover {
+      color: #3182ce;
+      text-decoration: underline;
+    }
+    .dark .annotation-page--link:hover {
+      color: #63b3ed;
+    }
     .annotation-content {
       color: #4a5568;
       font-size: 0.9375rem;
@@ -569,6 +586,23 @@
         Comments & Annotations
       </div>
       <div class="annotations-subtitle">{{ file.original_filename }}</div>
+      {% if multi_user_enabled %}
+      <div class="annotations-subtitle" style="margin-top:0.25rem;">
+        <i class="fas fa-user" aria-hidden="true" style="margin-right:0.25rem;"></i>
+        {{ _("file.owner_label") }}: <strong>{{ owner_display or _("file.owner_unowned") }}</strong>
+        {% if file.owner_id is none %}
+        &mdash;
+        <button
+          id="claim-btn"
+          aria-label="{{ _('file.claim_ownership') }}"
+          style="background:#10b981;color:#fff;border:none;border-radius:0.375rem;padding:0.25rem 0.75rem;font-size:0.8rem;font-weight:600;cursor:pointer;"
+        >
+          <i class="fas fa-user-check" aria-hidden="true"></i> {{ _("file.claim_ownership") }}
+        </button>
+        <span id="claim-msg" style="font-size:0.8rem;margin-left:0.5rem;display:none;" role="alert"></span>
+        {% endif %}
+      </div>
+      {% endif %}
     </div>
   </div>
 
@@ -750,6 +784,7 @@
           delete_confirm: {{ _("annotations.delete_confirm") | tojson }},
           page: {{ _("annotations.page") | tojson }},
           color: {{ _("annotations.color") | tojson }},
+          go_to_page: {{ _("annotations.go_to_page") | tojson }},
           type_note: {{ _("annotations.type_note") | tojson }},
           type_highlight: {{ _("annotations.type_highlight") | tojson }},
           type_underline: {{ _("annotations.type_underline") | tojson }},
@@ -801,18 +836,110 @@
 
   const viewerEl = document.getElementById('embedpdf-viewer');
   if (viewerEl) {
+    const fileId = {{ file.id | tojson }};
     {% if processed_file_exists %}
-    const pdfUrl = '/api/files/{{ file.id }}/preview?version=processed';
+    const pdfUrl = '/api/files/' + fileId + '/preview?version=processed';
     {% else %}
-    const pdfUrl = '/api/files/{{ file.id }}/preview?version=original';
+    const pdfUrl = '/api/files/' + fileId + '/preview?version=original';
     {% endif %}
 
-    EmbedPDF.init({
+    const viewer = EmbedPDF.init({
       type: 'container',
       target: viewerEl,
       src: pdfUrl,
     });
+
+    if (viewer) {
+      viewer.registry.then(function (registry) {
+        // ── Page sync: viewer page change → update annotation form ──────────
+        var scrollPlugin = registry.getPlugin('scroll');
+        if (scrollPlugin) {
+          var scroll = scrollPlugin.provides();
+          scroll.onPageChange(function (event) {
+            var pageInput = document.getElementById('annotation-page-input');
+            if (pageInput) {
+              pageInput.value = String(event.pageNumber);
+            }
+          });
+          // Expose scrollToPage so the annotations panel can navigate the viewer
+          window._embedpdfScrollToPage = function (pageNumber) {
+            scroll.scrollToPage({ pageNumber: pageNumber });
+          };
+        }
+
+        // ── Auto-save: viewer annotation events → DocuElevate API ───────────
+        var annotationPlugin = registry.getPlugin('annotation');
+        if (annotationPlugin) {
+          var annotation = annotationPlugin.provides();
+          annotation.onAnnotationEvent(function (event) {
+            if (event.type !== 'create') return;
+            var ann = event.annotation;
+            var pageIndex = typeof ann.pageIndex === 'number' ? ann.pageIndex
+              : (typeof event.pageIndex === 'number' ? event.pageIndex : 0);
+            var page = pageIndex + 1;
+            var rect = ann.rect || { x: 0, y: 0, width: 0, height: 0 };
+            var color = ann.strokeColor || ann.color || undefined;
+            var content = (ann.contents || '').trim();
+            // Map PDF annotation subtypes to DocuElevate annotation types
+            var typeMap = {
+              highlight: 'highlight',
+              underline: 'underline',
+              strikeout: 'strikethrough',
+              squiggly: 'underline',
+              text: 'note',
+              freetext: 'note',
+              ink: 'note',
+              square: 'note',
+              circle: 'note',
+            };
+            var annType = typeMap[String(ann.type).toLowerCase()] || 'note';
+            if (!content) {
+              var typeLabel = annType.charAt(0).toUpperCase() + annType.slice(1);
+              content = typeLabel + ' \u2014 p.' + page;
+            }
+            var payload = {
+              page: page,
+              x: rect.x || 0,
+              y: rect.y || 0,
+              width: rect.width || 0,
+              height: rect.height || 0,
+              annotation_type: annType,
+              content: content,
+            };
+            if (color) {
+              payload.color = color;
+            }
+            fetch('/api/files/' + fileId + '/annotations', {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify(payload),
+            })
+              .then(function (r) {
+                if (r.ok && typeof window._reloadAnnotations === 'function') {
+                  window._reloadAnnotations();
+                }
+              })
+              .catch(function (err) {
+                console.error('Failed to save viewer annotation:', err);
+              });
+          });
+        }
+      }).catch(function () {});
+    }
   }
 </script>
 {% endif %}
+{% if multi_user_enabled and file and file.owner_id is none %}
+<script src="{{ url_for('static', path='js/claim.js') }}" defer></script>
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  initClaimOwnership({{ file.id | tojson }}, {
+    confirm: {{ _("file.claim_ownership_confirm") | tojson }},
+    success: {{ _("file.claim_ownership_success") | tojson }},
+    failed:  {{ _("file.claim_ownership_failed") | tojson }}
+  });
+});
+</script>
+{% endif %}
 {% endblock %}
+

frontend/templates/file_summary.html

@@ -165,6 +165,12 @@
     {% if file.document_title %}
     <div class="info-row"><span class="info-key">Document Title</span><span class="info-val">{{ file.document_title }}</span></div>
     {% endif %}
+    {% if multi_user_enabled %}
+    <div class="info-row">
+      <span class="info-key">{{ _("file.owner_label") }}</span>
+      <span class="info-val">{{ owner_display or _("file.owner_unowned") }}</span>
+    </div>
+    {% endif %}
   </div>
 
   <!-- ── Quick actions ── -->
@@ -184,7 +190,18 @@
       <a href="/files/{{ file.id }}/detail" class="action-btn btn-secondary">
         <i class="fas fa-eye" aria-hidden="true"></i> View Detail
       </a>
+      {% if multi_user_enabled and file.owner_id is none %}
+      <button
+        class="action-btn btn-primary"
+        id="claim-btn"
+        aria-label="{{ _('file.claim_ownership') }}"
+        style="background:#10b981;"
+      >
+        <i class="fas fa-user-check" aria-hidden="true"></i> {{ _("file.claim_ownership") }}
+      </button>
+      {% endif %}
     </div>
+    <p id="claim-msg" style="margin-top:0.5rem;font-size:0.875rem;display:none;" role="alert"></p>
   </div>
 
   {% else %}
@@ -193,4 +210,17 @@
   {% endif %}
 
 </div>
+
+{% if multi_user_enabled and file and file.owner_id is none %}
+<script src="{{ url_for('static', path='js/claim.js') }}" defer></script>
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  initClaimOwnership({{ file.id | tojson }}, {
+    confirm: {{ _("file.claim_ownership_confirm") | tojson }},
+    success: {{ _("file.claim_ownership_success") | tojson }},
+    failed:  {{ _("file.claim_ownership_failed") | tojson }}
+  });
+});
+</script>
+{% endif %}
 {% endblock %}

frontend/templates/file_view.html

@@ -316,6 +316,12 @@
             {% endif %}
           </span>
         </div>
+        {% if multi_user_enabled %}
+        <div class="info-row">
+          <span class="info-key">{{ _("file.owner_label") }}</span>
+          <span class="info-val">{{ owner_display or _("file.owner_unowned") }}</span>
+        </div>
+        {% endif %}
       </div>
 
       <!-- Actions -->
@@ -344,7 +350,18 @@
           <a href="/shared-links?file_id={{ file.id }}" class="action-btn btn-secondary">
             <i class="fas fa-share-alt" aria-hidden="true"></i> Share
           </a>
+          {% if multi_user_enabled and file.owner_id is none %}
+          <button
+            class="action-btn btn-primary"
+            id="claim-btn"
+            aria-label="{{ _('file.claim_ownership') }}"
+            style="background:#10b981;border:none;cursor:pointer;"
+          >
+            <i class="fas fa-user-check" aria-hidden="true"></i> {{ _("file.claim_ownership") }}
+          </button>
+          {% endif %}
         </div>
+        <p id="claim-msg" style="margin-top:0.5rem;font-size:0.875rem;display:none;" role="alert"></p>
       </div>
     </div>
 
@@ -937,6 +954,16 @@
         pdfInit('/api/files/{{ file.id }}/preview?version={{ pv }}');
       {% endif %}
     {% endif %}
+    {% if multi_user_enabled and file and file.owner_id is none %}
+    initClaimOwnership({{ file.id | tojson }}, {
+      confirm: {{ _("file.claim_ownership_confirm") | tojson }},
+      success: {{ _("file.claim_ownership_success") | tojson }},
+      failed:  {{ _("file.claim_ownership_failed") | tojson }}
+    });
+    {% endif %}
   });
 </script>
+{% if multi_user_enabled and file and file.owner_id is none %}
+<script src="{{ url_for('static', path='js/claim.js') }}" defer></script>
+{% endif %}
 {% endblock %}

frontend/translations/en.json

@@ -321,6 +321,7 @@
   "annotations.delete_confirm": "Are you sure you want to delete this annotation?",
   "annotations.deleted": "Annotation deleted",
   "annotations.empty": "No annotations yet",
+  "annotations.go_to_page": "Go to page",
   "annotations.heading": "Annotations",
   "annotations.page": "Page",
   "annotations.save": "Save",
@@ -1756,6 +1757,12 @@
   "sharing.role_viewer": "Viewer",
   "sharing.user_id_label": "User ID or email",
   "sharing.user_id_placeholder": "e.g. alice@example.com",
+  "file.owner_label": "Owner",
+  "file.owner_unowned": "Unowned",
+  "file.claim_ownership": "Claim Ownership",
+  "file.claim_ownership_confirm": "Claim this document as yours? You will become the owner and can manage sharing.",
+  "file.claim_ownership_success": "You are now the owner of this document.",
+  "file.claim_ownership_failed": "Could not claim ownership. The document may already have an owner.",
   "similarity.backfill_auto": "The background task will compute them automatically every 5 minutes, or you can",
   "similarity.files_missing_text": "file(s) have OCR text but no embedding yet.",
   "similarity.find_pairs_btn": "Find Pairs",

tests/test_comments_ui.py

@@ -156,6 +156,49 @@ class TestCommentsUIRendering:
         assert 'id="embedpdf-viewer"' in html
         assert "@embedpdf/snippet" in html
 
+    def test_embedpdf_init_subscribes_to_page_change(self, client: TestClient, db_session, tmp_path):
+        """The EmbedPDF init script should subscribe to page change events to sync the form."""
+        f = _create_file(db_session, tmp_path)
+        resp = client.get(f"/files/{f.id}/annotations")
+        assert resp.status_code == 200
+        html = resp.text
+        # Verifies the viewer registry is awaited and scroll plugin is used
+        assert "viewer.registry" in html
+        assert "onPageChange" in html
+        assert "annotation-page-input" in html
+
+    def test_embedpdf_init_exposes_scroll_function(self, client: TestClient, db_session, tmp_path):
+        """The EmbedPDF init script must expose _embedpdfScrollToPage for the annotations panel."""
+        f = _create_file(db_session, tmp_path)
+        resp = client.get(f"/files/{f.id}/annotations")
+        assert resp.status_code == 200
+        assert "_embedpdfScrollToPage" in resp.text
+        assert "scrollToPage" in resp.text
+
+    def test_embedpdf_init_saves_viewer_annotations(self, client: TestClient, db_session, tmp_path):
+        """The EmbedPDF init script should capture annotation events and POST to the API."""
+        f = _create_file(db_session, tmp_path)
+        resp = client.get(f"/files/{f.id}/annotations")
+        assert resp.status_code == 200
+        html = resp.text
+        assert "onAnnotationEvent" in html
+        # Verifies the POST target is the annotations API for this file
+        assert "/api/files/" in html and "/annotations" in html
+
+    def test_embedpdf_init_reloads_annotation_list(self, client: TestClient, db_session, tmp_path):
+        """After auto-saving a viewer annotation, the panel list should be refreshed."""
+        f = _create_file(db_session, tmp_path)
+        resp = client.get(f"/files/{f.id}/annotations")
+        assert resp.status_code == 200
+        assert "_reloadAnnotations" in resp.text
+
+    def test_annotations_page_has_go_to_page_i18n(self, client: TestClient, db_session, tmp_path):
+        """The annotations i18n bundle should include the go_to_page key."""
+        f = _create_file(db_session, tmp_path)
+        resp = client.get(f"/files/{f.id}/annotations")
+        assert resp.status_code == 200
+        assert "go_to_page" in resp.text
+
     def test_summary_page_renders(self, client: TestClient, db_session, tmp_path):
         """The summary page at /files/{id} should render correctly."""
         f = _create_file(db_session, tmp_path)

tests/test_views_files_comprehensive.py

@@ -6,6 +6,7 @@ Target: Bring coverage from 8.77% to 70%+
 """
 
 import json
+import uuid
 from datetime import datetime, timedelta
 from unittest.mock import Mock, patch
 
@@ -1981,3 +1982,128 @@ class TestPipelineInfoInViews:
 
         assert response.status_code == 200
         assert b"Standard" in response.content
+
+
+# ---------------------------------------------------------------------------
+# Owner display and claim ownership tests
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.unit
+class TestOwnerDisplayAndClaim:
+    """Tests that owner info and claim button appear correctly on file views."""
+
+    def _make_file(self, db_session, owner_id=None) -> FileRecord:
+        file_rec = FileRecord(
+            filehash=uuid.uuid4().hex,
+            original_filename="doc.pdf",
+            local_filename="/tmp/doc.pdf",
+            file_size=512,
+            mime_type="application/pdf",
+            owner_id=owner_id,
+        )
+        db_session.add(file_rec)
+        db_session.commit()
+        db_session.refresh(file_rec)
+        return file_rec
+
+    # ── /files/{id} (file_summary.html) ──────────────────────────────────
+
+    def test_summary_shows_owner_when_multi_user_enabled(self, client, db_session):
+        """Owner ID is rendered in file summary when multi-user mode is on."""
+        file_rec = self._make_file(db_session, owner_id="alice@example.com")
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}")
+        assert response.status_code == 200
+        assert b"alice@example.com" in response.content
+
+    def test_summary_shows_unowned_label_for_unowned_file(self, client, db_session):
+        """'Unowned' label is rendered in file summary for files without an owner."""
+        file_rec = self._make_file(db_session, owner_id=None)
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}")
+        assert response.status_code == 200
+        assert b"Unowned" in response.content
+
+    def test_summary_shows_claim_button_for_unowned_file(self, client, db_session):
+        """Claim Ownership button appears on file summary for an unowned file."""
+        file_rec = self._make_file(db_session, owner_id=None)
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}")
+        assert response.status_code == 200
+        assert b"Claim Ownership" in response.content
+
+    def test_summary_no_claim_button_when_owned(self, client, db_session):
+        """No Claim Ownership button when the file already has an owner."""
+        file_rec = self._make_file(db_session, owner_id="bob@example.com")
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}")
+        assert response.status_code == 200
+        assert b"Claim Ownership" not in response.content
+
+    def test_summary_no_owner_row_in_single_user_mode(self, client, db_session):
+        """Owner row is hidden in single-user mode."""
+        file_rec = self._make_file(db_session, owner_id=None)
+        with patch("app.config.settings.multi_user_enabled", False):
+            response = client.get(f"/files/{file_rec.id}")
+        assert response.status_code == 200
+        # Claim button and Unowned label should not appear in single-user mode
+        assert b"Claim Ownership" not in response.content
+
+    # ── /files/{id}/detail (file_view.html) ──────────────────────────────
+
+    def test_detail_shows_owner_when_multi_user_enabled(self, client, db_session):
+        """Owner ID is rendered in file detail view when multi-user mode is on."""
+        file_rec = self._make_file(db_session, owner_id="charlie@example.com")
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}/detail")
+        assert response.status_code == 200
+        assert b"charlie@example.com" in response.content
+
+    def test_detail_shows_claim_button_for_unowned_file(self, client, db_session):
+        """Claim Ownership button appears in file detail view for an unowned file."""
+        file_rec = self._make_file(db_session, owner_id=None)
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}/detail")
+        assert response.status_code == 200
+        assert b"Claim Ownership" in response.content
+
+    # ── /files/{id}/annotations (file_annotations.html) ──────────────────
+
+    def test_annotations_shows_owner_info(self, client, db_session):
+        """Owner info is rendered on the annotations page in multi-user mode."""
+        file_rec = self._make_file(db_session, owner_id="dave@example.com")
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}/annotations")
+        assert response.status_code == 200
+        assert b"dave@example.com" in response.content
+
+    def test_annotations_shows_claim_button_for_unowned_file(self, client, db_session):
+        """Claim Ownership button appears on annotations page for unowned file."""
+        file_rec = self._make_file(db_session, owner_id=None)
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}/annotations")
+        assert response.status_code == 200
+        assert b"Claim Ownership" in response.content
+
+    def test_annotations_no_claim_button_when_owned(self, client, db_session):
+        """No Claim Ownership button on annotations page when file has an owner."""
+        file_rec = self._make_file(db_session, owner_id="eve@example.com")
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}/annotations")
+        assert response.status_code == 200
+        assert b"Claim Ownership" not in response.content
+
+    def test_display_name_used_when_profile_exists(self, client, db_session):
+        """UserProfile.display_name overrides raw user_id in the owner display."""
+        from app.models import UserProfile
+
+        file_rec = self._make_file(db_session, owner_id="frank@example.com")
+        profile = UserProfile(user_id="frank@example.com", display_name="Frank Lastname")
+        db_session.add(profile)
+        db_session.commit()
+
+        with patch("app.config.settings.multi_user_enabled", True):
+            response = client.get(f"/files/{file_rec.id}")
+        assert response.status_code == 200
+        assert b"Frank Lastname" in response.content