22 lines
1.9 KiB
Markdown
22 lines
1.9 KiB
Markdown
|
# Tasks
|
||
|
|
|
||
|
|
## 1. Permission plumbing
|
||
|
|
|
||
|
|
- [x] 1.1 Generalize `permit.js`: single-object `checkPermission` for an arbitrary relation, plus `cropPermission(phone, {force})` with the 5-minute per-phone cache; verify with `node --test` and stubbed fetch covering allow, deny, cache-hit (no portal call), expiry, and live-at-save
|
||
|
|
|
||
|
|
## 2. Cropper router
|
||
|
|
|
||
|
|
- [x] 2.1 Add `tools/cropper.js` — `createCropperRouter` with DI (minio, azure queue, fetch, nodered/removebg/a2loft config): router-level session + crop gate, picture next/load-by-id/image routes, review + review-agent routes, dequeue, removebg proxy (native FormData), save proxy (live gate + OTP + session phone + picture domain), baseUrl; 503 when credentials are absent; verify with `node --test` and fake clients/upstreams covering gate denials (403, no upstream calls), cache behavior, save proxying, and the unconfigured 503 path
|
||
|
|
|
||
|
|
## 3. UI
|
||
|
|
|
||
|
|
- [x] 3.1 Port the Smart Photo Editor to `tools/public/assets/cropper/` restyled to the tools design language (navbar, panels, badges): relative API paths, phone prefilled from `/auth/session`, no login step, OTP field at save, review-reason list and crop/clean flow preserved; landing card links `/cropper` (replacing the wrong external URL); verify in the browser that the page renders, gates apply, and the flow works against fakes
|
||
|
|
|
||
|
|
## 4. Wiring and docs
|
||
|
|
|
||
|
|
- [x] 4.1 Mount the router in `server.js` (env-gated client construction), add `.env.example` with the credential names, rebuild the Docker image, and document the cropper + env vars in the README; verify the app boots with no env (other tools fine, cropper 503) and with a fake env in Docker
|
||
|
|
|
||
|
|
## 5. Field verification
|
||
|
|
|
||
|
|
- [x] 5.1 Playwright field pass with a real item: YOUreka login → gate check → load queued picture (or by ID) → crop → clean → review → save with OTP; confirm the picture lands in a2loft and a wrong-OTP save fails cleanly
|