YOUreka/tools-legacy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(openspec): cropper-token-auth field pass verified

Browse Source 
Loaded a real upload (panel: Domain ucth · picture target core), saved with
no OTP — the proxy POSTed with the session token and no query auth, a2loft
returned ok and the panel reset.
This commit is contained in:
adebisi-fa
2026-10-01 13:02:04 +01:00
parent 796094f61b
commit 3a5edbfe75
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/cropper-token-auth/tasks.md
+4 -1
View File
@@ -11,5 +11,8 @@
- [x] 4. Tests: save carries the bearer token and no query auth; the resolved - [x] 4. Tests: save carries the bearer token and no query auth; the resolved
domain wins over the body; unsafe values are refused; no OTP field in the domain wins over the body; unsafe values are refused; no OTP field in the
served page; queue load exposes `domainCode` (46 tests pass). served page; queue load exposes `domainCode` (46 tests pass).
- [ ] 5. Deploy a2loft and this app, then a field pass: load a queued picture → - [x] 5. Deploy a2loft and this app, then a field pass: load a queued picture →
save with no OTP → confirm the picture lands attributed to the token's phone. save with no OTP → confirm the picture lands attributed to the token's phone.
Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target
core"), no OTP field, save POSTed with the session token and no query auth,
answered "Saved — Picture saved for +2348068287222" and reset the panel.