YOUreka/tools-legacy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(openspec): archive fingerprint-token-auth after the production pass

Browse Source 
The wizard's a2loft calls now authenticate with the session token and carry no
OTP. Field pass in production: the lookup and both fingerprint saves succeeded
with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app
deltas into the main specs and archived the change.
This commit is contained in:
adebisi-fa
2026-10-06 19:19:29 +01:00
parent 8d42faf707
commit 8a13fb527e
8 changed files with 43 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/specs/tools-app/spec.md
+14 -9
View File
@@ -17,6 +17,7 @@ Cropper (`/cropper`) and to the Fingerprint Agent page (`/fingerprint`).
- **WHEN** a user opens the app root URL
- **THEN** the page shows a link to the Image Cropper pointing at
`/cropper` and a link to `/fingerprint`
### Requirement: YOUreka Auth login establishes a cookie session
The app SHALL authenticate operators through the YOUreka portal web-auth
flow: create a web auth session at the portal with a local callback URL,
@@ -100,17 +101,21 @@ portal.
### Requirement: a2loft proxies inject operator identity
The app SHALL proxy staff lookup and fingerprint-save calls to
`https://apis.a2loft.net` under same-origin API routes. The proxy SHALL
attach the operator's phone from the server-side session and forward the
OTP supplied by the page as query parameters (`phone`, `otp`), preserving
the a2loft request and response shapes. The proxies SHALL require a
session; the OTP SHALL NOT be accepted without one.
authenticate the operator with the signed-in session's PocketBase token, sent
as an `Authorization: Bearer` credential, preserving the a2loft request and
response shapes. The proxies SHALL require a session; a request without one
SHALL be rejected without contacting a2loft. The proxies SHALL NOT forward or
require an OTP.
#### Scenario: Staff lookup via proxy
- **WHEN** the page requests staff details for a domain and reference with
an OTP
- **THEN** the app calls a2loft's identity endpoint with the operator's
phone from the session and the supplied OTP, and returns a2loft's
response unchanged
- **WHEN** the page requests staff details for a domain and reference
- **THEN** the app calls a2loft's identity endpoint with the session token as a
bearer credential and returns a2loft's response unchanged
#### Scenario: Fingerprint save via proxy
- **WHEN** the page saves fingerprints for a domain and reference
- **THEN** the app posts them to a2loft's fingerprint endpoint with the session
token as a bearer credential
#### Scenario: Unauthenticated proxy call rejected
- **WHEN** a proxy route is called without a valid session