From 3a5edbfe7558ae970d0e2c72a809791837d21489 Mon Sep 17 00:00:00 2001 From: "Foluso ADEBISI (DevBox Aux)" Date: Thu, 1 Oct 2026 13:02:04 +0100 Subject: [PATCH] docs(openspec): cropper-token-auth field pass verified MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Loaded a real upload (panel: Domain ucth · picture target core), saved with no OTP — the proxy POSTed with the session token and no query auth, a2loft returned ok and the panel reset. --- openspec/changes/cropper-token-auth/tasks.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openspec/changes/cropper-token-auth/tasks.md b/openspec/changes/cropper-token-auth/tasks.md index fb55bdd..717e042 100644 --- a/openspec/changes/cropper-token-auth/tasks.md +++ b/openspec/changes/cropper-token-auth/tasks.md @@ -11,5 +11,8 @@ - [x] 4. Tests: save carries the bearer token and no query auth; the resolved domain wins over the body; unsafe values are refused; no OTP field in the served page; queue load exposes `domainCode` (46 tests pass). -- [ ] 5. Deploy a2loft and this app, then a field pass: load a queued picture → +- [x] 5. Deploy a2loft and this app, then a field pass: load a queued picture → save with no OTP → confirm the picture lands attributed to the token's phone. + Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target + core"), no OTP field, save POSTed with the session token and no query auth, + answered "Saved — Picture saved for +2348068287222" and reset the panel.