30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
|
# Tasks
|
||
|
|
|
||
|
|
## 1. Proxies
|
||
|
|
|
||
|
|
- [x] 1.1 `tools/server.js`: `a2loftUrl`/`a2loftSaveUrl` drop `phone`/`otp`;
|
||
|
|
both handlers send `Authorization: Bearer ${req.session.token}`;
|
||
|
|
`validateProxy` drops the OTP/phone checks and keeps domain + reference.
|
||
|
|
Verified: the proxy tests assert the Bearer header and no query auth.
|
||
|
|
- [x] 1.2 Update the proxy tests: assert no `?otp`, assert the Bearer header,
|
||
|
|
and drop the no-OTP rejection case while the auth/domain rejection remains
|
||
|
|
(no a2loft call). Verified.
|
||
|
|
|
||
|
|
## 2. Wizard UI
|
||
|
|
|
||
|
|
- [x] 2.1 `tools/public/assets/fp/index.html`: remove the lookup and save OTP
|
||
|
|
inputs.
|
||
|
|
- [x] 2.2 `tools/public/assets/fp/app.js`: remove `otpLookup`/`otpSave`, the
|
||
|
|
`otp` request params, and the OTP resets; tighten `canLookup`/`canSave`.
|
||
|
|
Verified: the served page has no OTP field (server test) and both gates pass
|
||
|
|
without a credential (wizard test).
|
||
|
|
- [x] 2.3 Update the `fingerprint-wizard` and `tools-app` spec deltas, README
|
||
|
|
steps 1/3, the a2loft proxy paragraph, and the Help page.
|
||
|
|
|
||
|
|
## 3. Verify
|
||
|
|
|
||
|
|
- [x] 3.1 Run the full tools test suite (`node --test`) and confirm it passes.
|
||
|
|
(66/66 pass.)
|
||
|
|
- [ ] 3.2 Field pass against a real domain (a2loft deployed): look up a
|
||
|
|
reference and save both fingerprints with no OTP.
|