-
+
Image Cropper
- Prepare and crop identity photos to the dimensions required by YOUreka profiles.
+ Review, crop and save identity photos submitted for YOUreka ID domain profiles.
Open Image Cropper
-
+
diff --git a/tools/server.js b/tools/server.js
index d70702a..84b286b 100644
--- a/tools/server.js
+++ b/tools/server.js
@@ -10,7 +10,8 @@ import express from 'express';
import path from 'node:path';
import { fileURLToPath, pathToFileURL } from 'node:url';
import { loadYrkaSession, extractPbCookieValue } from './yrka-auth.js';
-import { permittedDomains, stripPhonePrefix, CACHE_FRESH, DOMAIN_TTL_MS } from './permit.js';
+import { permittedDomains, stripPhonePrefix, CACHE_FRESH, DOMAIN_TTL_MS, cropPermission } from './permit.js';
+import { createCropperRouter, buildCropperClients } from './cropper.js';
// ── Hardcoded configuration ──────────────────────────────────────────────────
export const PORT = 4173;
@@ -57,9 +58,9 @@ function readProfile(raw) {
}
}
-function errorPage(res, title, message) {
+function errorPage(res, status, title, message) {
res
- .status(502)
+ .status(status)
.type('html')
.send(`
@@ -103,11 +104,12 @@ export function createApp(overrides = {}) {
};
const domainCodes = new Set(cfg.domains.map((d) => d.code));
const domainCache = new Map(); // phone → { codes, checkedAt }
+ const cropCache = cfg.cropCache || new Map(); // phone → { allowed, checkedAt }
const app = express();
app.disable('x-powered-by');
app.set('trust proxy', 1); // https termination upstream → correct Secure-cookie flag
- app.use(express.json());
+ app.use(express.json({ limit: '50mb' })); // cropper pictures travel as data URLs
const setSessionCookie = (req, res, value) =>
res.cookie('session', value, {
@@ -174,28 +176,29 @@ export function createApp(overrides = {}) {
});
const data = await r.json().catch(() => null);
if (!r.ok || !data?.ok || !data.loginUrl) {
- return errorPage(res, 'Login unavailable', data?.message || 'Could not start the YOUreka login flow. Please try again.');
+ return errorPage(res, 502, 'Login unavailable', data?.message || 'Could not start the YOUreka login flow. Please try again.');
}
res.redirect(data.loginUrl);
} catch {
- errorPage(res, 'Login unavailable', 'Could not reach the YOUreka portal. Please try again.');
+ errorPage(res, 502, 'Login unavailable', 'Could not reach the YOUreka portal. Please try again.');
}
});
app.get('/auth/callback', async (req, res) => {
const { sessionId } = req.query;
- if (!sessionId) return errorPage(res, 'Login failed', 'Missing login session. Please start again.');
+ if (!sessionId) return errorPage(res, 401, 'Login failed', 'Missing login session. Please start again.');
try {
const r = await cfg.fetch(
`${cfg.portalUrl.replace(/\/+$/, '')}/api/web/auth/${encodeURIComponent(sessionId)}/cookie`
);
const data = await r.json().catch(() => null);
if (!r.ok || !data?.ok) {
- return errorPage(res, 'Login failed', 'Authentication failed. The link may have expired — please try again.');
+ return errorPage(res, 401, 'Login failed', 'Authentication failed. The link may have expired — please try again.');
}
if (data.status === 'Initialized' || data.status === 'TimedOut') {
return errorPage(
res,
+ 401,
'Login failed',
data.status === 'TimedOut'
? 'Your login session timed out. Please start again.'
@@ -204,7 +207,7 @@ export function createApp(overrides = {}) {
}
const sessionValue = extractPbCookieValue(data.cookie || '');
if (!sessionValue) {
- return errorPage(res, 'Login failed', 'The portal did not return a usable session. Please try again.');
+ return errorPage(res, 401, 'Login failed', 'The portal did not return a usable session. Please try again.');
}
setSessionCookie(req, res, sessionValue);
setProfileCookie(req, res, {
@@ -214,7 +217,7 @@ export function createApp(overrides = {}) {
});
res.redirect('/fingerprint');
} catch {
- errorPage(res, 'Login failed', 'Could not reach the YOUreka portal. Please try again.');
+ errorPage(res, 401, 'Login failed', 'Could not reach the YOUreka portal. Please try again.');
}
});
@@ -279,6 +282,56 @@ export function createApp(overrides = {}) {
res.sendFile(path.join(__dirname, 'public', 'assets', 'fp', 'index.html'));
});
+ // ── cropper page + namespaced API (session + crop_image required) ────────
+ const cropGateContext = {
+ portalUrl: cfg.portalUrl,
+ fetchImpl: cfg.fetch,
+ cache: cropCache,
+ ttlMs: cfg.ttlMs,
+ now: cfg.now,
+ };
+ const pageCropGate = async (req, res, next) => {
+ let allowed = false;
+ try {
+ ({ allowed } = await cropPermission({
+ phone: stripPhonePrefix(req.session.phone),
+ ...cropGateContext,
+ }));
+ } catch {
+ allowed = false; // fail closed
+ }
+ if (!allowed) {
+ return errorPage(
+ res,
+ 403,
+ 'Not permitted',
+ 'You are not permitted to crop images. Contact your administrator if you believe this is a mistake.'
+ );
+ }
+ next();
+ };
+ app.get('/cropper', requirePage, pageCropGate, (req, res) => {
+ res.sendFile(path.join(__dirname, 'public', 'assets', 'cropper', 'index.html'));
+ });
+ const cropperClients = cfg.cropperClients !== undefined ? cfg.cropperClients : buildCropperClients();
+ if (cropperClients) {
+ app.use(
+ '/cropper',
+ createCropperRouter({
+ ...cropperClients,
+ a2loftBase: cfg.a2loftBase,
+ removebgUrl: cfg.removebgUrl,
+ noderedBase: cfg.noderedBase,
+ ...cropGateContext,
+ requireApi,
+ })
+ );
+ } else {
+ app.use('/cropper', (req, res) =>
+ res.status(503).json({ ok: false, message: 'The image cropper is not configured on this deployment.' })
+ );
+ }
+
// ── a2loft proxies: same-origin, phone injected from the session ──────────
const a2loftUrl = (domain, reference, otp, phone) => {
const q = new URLSearchParams({ phone, otp });
diff --git a/tools/test/cropper.test.js b/tools/test/cropper.test.js
new file mode 100644
index 0000000..e08f4d8
--- /dev/null
+++ b/tools/test/cropper.test.js
@@ -0,0 +1,420 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createApp } from '../server.js';
+import {
+ makeJwt,
+ makePbCookie,
+ startServer,
+ stopServer,
+ urlOf,
+ cookieValue,
+} from './helpers.js';
+
+// Fake portal: web-auth + openfga verify with a configurable crop_image verdict.
+async function startFakePortal({ cropAllowed = true } = {}) {
+ const state = { verifyCalls: 0 };
+ const server = await startServer((req, res) => {
+ let raw = '';
+ req.on('data', (c) => (raw += c));
+ req.on('end', () => {
+ const json = (status, body) => {
+ res.writeHead(status, { 'content-type': 'application/json' });
+ res.end(JSON.stringify(body));
+ };
+ if (req.method === 'POST' && req.url === '/api/web/auth') {
+ return json(200, { ok: true, sessionId: 's1', loginUrl: 'https://portal.example/login' });
+ }
+ if (req.url.startsWith('/api/web/auth/s1/cookie')) {
+ return json(200, {
+ ok: true,
+ sessionId: 's1',
+ status: 'Activated',
+ cookie: makePbCookie(makeJwt({ expiresInSec: 3600 })),
+ phone: '+2348068287222',
+ firstName: 'Ada',
+ lastName: 'Obi',
+ });
+ }
+ if (req.method === 'POST' && req.url === '/api/openfga/verify') {
+ state.verifyCalls += 1;
+ const body = JSON.parse(raw);
+ // capture_biometric checks (session endpoint) always pass; crop_image
+ // follows the configured verdict.
+ const allowed = body.relation === 'crop_image' ? cropAllowed : true;
+ return json(200, { ok: true, allowed });
+ }
+ json(404, { ok: false });
+ });
+ });
+ return { server, state, stop: () => stopServer(server) };
+}
+
+// Fake a2loft: dims load, save echo; records calls.
+async function startFakeA2loft() {
+ const calls = [];
+ const server = await startServer((req, res) => {
+ let raw = '';
+ req.on('data', (c) => (raw += c));
+ req.on('end', () => {
+ calls.push({ method: req.method, url: req.url, body: raw ? JSON.parse(raw) : null });
+ const json = (body) => {
+ res.writeHead(200, { 'content-type': 'application/json' });
+ res.end(JSON.stringify(body));
+ };
+ if (req.url.startsWith('/identity/dims/picture/')) {
+ return json({
+ ok: true,
+ data: {
+ upload_id: 'up-1',
+ file_name: 'id-domains/ucth/raw-pictures/x/img.jpg',
+ caption: '08068287222',
+ domain: 'ucth',
+ raw_file_id: 'raw-1',
+ },
+ });
+ }
+ if (req.url.includes('/profile/picture')) {
+ return json({ ok: true, message: 'Picture uploaded.' });
+ }
+ json({ ok: true });
+ });
+ });
+ return { calls, server, stop: () => stopServer(server) };
+}
+
+// Fake minio + azure queue — plain objects exposing just what the router uses.
+const fakeMinio = () => ({
+ presignedGetObject: async (_bucket, name) => `https://storage.example/${name}`,
+});
+const fakeQueue = () => {
+ const calls = { getMessage: 0, deleteMessage: 0 };
+ const item = {
+ messageId: 'm-1',
+ popReceipt: 'pop-1',
+ dequeueCount: 1,
+ messageText: JSON.stringify({
+ upload_id: 'up-1',
+ file_name: 'id-domains/ucth/raw-pictures/x/img.jpg',
+ caption: '08068287222',
+ domain: 'ucth',
+ raw_file_id: 'raw-1',
+ }),
+ };
+ return {
+ calls,
+ // azure-storage callback signatures
+ getMessage: (_queue, _opts, cb) => {
+ calls.getMessage += 1;
+ cb(null, item);
+ },
+ deleteMessage: (_queue, _id, _pop, cb) => {
+ calls.deleteMessage += 1;
+ cb(null, { isSuccessful: true });
+ },
+ };
+};
+
+// Fake removebg + nodered upstreams.
+async function startFakeRemovebg() {
+ const calls = [];
+ const server = await startServer((req, res) => {
+ let raw = '';
+ req.on('data', (c) => (raw += c));
+ req.on('end', () => {
+ calls.push({ url: req.url, key: req.headers['x-api-key'] });
+ res.writeHead(200, { 'content-type': 'image/png' });
+ res.end('PNGDATA');
+ });
+ });
+ return { calls, server, stop: () => stopServer(server) };
+}
+
+async function startFakeNodered() {
+ const calls = [];
+ const server = await startServer((req, res) => {
+ let raw = '';
+ req.on('data', (c) => (raw += c));
+ req.on('end', () => {
+ calls.push({ method: req.method, url: req.url, auth: req.headers.authorization });
+ const json = (body) => {
+ res.writeHead(200, { 'content-type': 'application/json' });
+ res.end(JSON.stringify(body));
+ };
+ if (req.url === '/idid/picture/review/up-1') {
+ return json({ ok: true, data: { agentPhoneHash: '12345' } });
+ }
+ if (req.url === '/unical/agents') {
+ return json([{ phoneHashes: [12345], name: 'Agent A', phone: '+2340000000000' }]);
+ }
+ if (req.url === '/zeebe/picture/review') {
+ return json({ ok: true });
+ }
+ json({ ok: false });
+ });
+ });
+ return { calls, server, stop: () => stopServer(server) };
+}
+
+async function boot({ cropAllowed = true, cropperClients } = {}) {
+ const portal = await startFakePortal({ cropAllowed });
+ const a2loft = await startFakeA2loft();
+ const removebg = await startFakeRemovebg();
+ const nodered = await startFakeNodered();
+ // presigned URLs from the fake minio must not hit the real network
+ const testFetch = async (url, init) => {
+ if (String(url).startsWith('https://storage.example/')) {
+ return {
+ ok: true,
+ status: 200,
+ headers: { get: () => 'image/png' },
+ arrayBuffer: async () => Buffer.from('PNGDATA'),
+ json: async () => ({}),
+ text: async () => 'PNGDATA',
+ };
+ }
+ return fetch(url, init);
+ };
+ const app = createApp({
+ portalUrl: urlOf(portal.server),
+ a2loftBase: urlOf(a2loft.server),
+ removebgUrl: urlOf(removebg.server),
+ noderedBase: urlOf(nodered.server),
+ fetch: testFetch,
+ cropperClients: cropperClients !== undefined ? cropperClients : {
+ minio: fakeMinio(),
+ queue: fakeQueue(),
+ noderedAuth: { username: 'nr', password: 'nr-secret' },
+ carvekitKey: 'carve-key',
+ },
+ });
+ const httpServer = await new Promise((resolve) => {
+ const s = app.listen(0, '127.0.0.1', () => resolve(s));
+ });
+ const base = urlOf(httpServer);
+ const stop = async () => {
+ await new Promise((r) => httpServer.close(r));
+ await portal.stop();
+ await a2loft.stop();
+ await removebg.stop();
+ await nodered.stop();
+ };
+ return { base, a2loft, removebg, nodered, portal, stop };
+}
+
+const manual = { redirect: 'manual' };
+
+async function login(base) {
+ const res = await fetch(`${base}/auth/callback?sessionId=s1`, manual);
+ assert.equal(res.status, 302);
+ return `session=${cookieValue(res, 'session')}; user_profile=${cookieValue(res, 'user_profile')}`;
+}
+
+test('unconfigured deployment: cropper answers 503, other tools unaffected', async () => {
+ const { base, stop } = await boot({ cropperClients: null });
+ try {
+ const cookies = await login(base);
+ const res = await fetch(`${base}/cropper/api/baseUrl`, { headers: { cookie: cookies } });
+ assert.equal(res.status, 503);
+ const landing = await fetch(`${base}/`);
+ assert.equal(landing.status, 200);
+ } finally {
+ await stop();
+ }
+});
+
+test('crop gate: permitted operator loads the page; denied operator does not', async () => {
+ const ok = await boot({ cropAllowed: true });
+ try {
+ const cookies = await login(ok.base);
+ const page = await fetch(`${ok.base}/cropper`, { headers: { cookie: cookies } });
+ assert.equal(page.status, 200);
+ assert.match(await page.text(), /Smart Photo Editor|Image Cropper/);
+ } finally {
+ await ok.stop();
+ }
+ const denied = await boot({ cropAllowed: false });
+ try {
+ const cookies = await login(denied.base);
+ const page = await fetch(`${denied.base}/cropper`, { headers: { cookie: cookies } });
+ assert.equal(page.status, 403);
+ assert.match(await page.text(), /not permitted/i);
+ } finally {
+ await denied.stop();
+ }
+});
+
+test('picture routes are gated and proxied; reads use the cached gate', async () => {
+ const { base, portal, stop } = await boot();
+ try {
+ const cookies = await login(base);
+ const before = portal.state.verifyCalls;
+ const next = await fetch(`${base}/cropper/picture/next`, { headers: { cookie: cookies } });
+ assert.equal(next.status, 200);
+ const body = await next.json();
+ assert.equal(body.ok, true);
+ assert.equal(body.data.message.upload_id, 'up-1');
+
+ // load-by-id goes to a2loft dims; image fetch returns a data URL
+ const loaded = await fetch(`${base}/cropper/picture/load/up-1`, { headers: { cookie: cookies } });
+ assert.equal((await loaded.json()).ok, true);
+ const image = await fetch(`${base}/cropper/picture/id-domains_ucth_raw-pictures_x_img.jpg`, {
+ headers: { cookie: cookies },
+ });
+ const imageBody = await image.json();
+ assert.equal(imageBody.ok, true);
+ assert.match(imageBody.data, /^data:image\/png;base64,/);
+
+ // several reads, but only one crop verify within the TTL
+ assert.equal(portal.state.verifyCalls - before, 1);
+ } finally {
+ await stop();
+ }
+});
+
+test('removebg is gated and proxies the cleanup service', async () => {
+ const denied = await boot({ cropAllowed: false });
+ try {
+ const cookies = await login(denied.base);
+ const res = await fetch(`${denied.base}/cropper/api/removebg`, {
+ method: 'POST',
+ headers: { cookie: cookies, 'content-type': 'application/json' },
+ body: JSON.stringify({ image_file_b64: 'QUJD' }),
+ });
+ assert.equal(res.status, 403);
+ assert.equal(denied.removebg.calls.length, 0, 'cleanup service not contacted');
+ } finally {
+ await denied.stop();
+ }
+ const ok = await boot({ cropAllowed: true });
+ try {
+ const cookies = await login(ok.base);
+ const res = await fetch(`${ok.base}/cropper/api/removebg`, {
+ method: 'POST',
+ headers: { cookie: cookies, 'content-type': 'application/json' },
+ body: JSON.stringify({ image_file_b64: 'QUJD' }),
+ });
+ assert.equal(res.status, 200);
+ assert.equal(await res.text(), 'PNGDATA');
+ assert.equal(ok.removebg.calls[0].key, 'carve-key');
+ } finally {
+ await ok.stop();
+ }
+});
+
+test('save verifies the gate live and proxies to a2loft with session identity', async () => {
+ const { base, a2loft, portal, stop } = await boot();
+ try {
+ const cookies = await login(base);
+ // prime the cache with a denied verdict for the reads, then flip the
+ // portal to allowed — the live save check must see the new verdict.
+ const payload = {
+ pictureDataUrl: 'data:image/jpeg;base64,QUJD',
+ phone: '08068287222',
+ requiresCleaning: true,
+ message: {
+ pop_receipt: 'pop-1',
+ message_id: 'm-1',
+ message: {
+ upload_id: 'up-1',
+ domain: 'ucth',
+ agentDeviceHash: 'agent-1',
+ caption: '08068287222',
+ file_url: null,
+ },
+ },
+ };
+ const res = await fetch(`${base}/cropper/profile/picture?otp=778899`, {
+ method: 'POST',
+ headers: { cookie: cookies, 'content-type': 'application/json' },
+ body: JSON.stringify(payload),
+ });
+ assert.equal(res.status, 200);
+ const body = await res.json();
+ assert.equal(body.ok, true);
+
+ const save = a2loft.calls.find((c) => c.url.includes('/profile/picture'));
+ assert.ok(save, 'a2loft save contacted');
+ const u = new URL(save.url, 'http://x');
+ assert.equal(decodeURIComponent(u.pathname), '/identity/ucth/profile/picture');
+ assert.equal(u.searchParams.get('phone'), '+2348068287222', 'session phone is the validating identity');
+ assert.equal(u.searchParams.get('otp'), '778899');
+ assert.equal(save.body.phone, '08068287222', 'profile phone from the picture');
+ assert.equal(save.body.uploadId, 'up-1');
+ assert.ok(portal.state.verifyCalls > 0);
+ } finally {
+ await stop();
+ }
+});
+
+test('save refuses without an OTP and without the crop permission', async () => {
+ const { base, a2loft, stop } = await boot({ cropAllowed: false });
+ try {
+ const cookies = await login(base);
+ const payload = {
+ pictureDataUrl: 'data:image/jpeg;base64,QUJD',
+ phone: '08068287222',
+ message: {
+ pop_receipt: 'custom',
+ message_id: 'm-1',
+ message: { upload_id: 'up-1', domain: 'ucth', caption: '08068287222', file_url: null },
+ },
+ };
+ const noOtp = await fetch(`${base}/cropper/profile/picture`, {
+ method: 'POST',
+ headers: { cookie: cookies, 'content-type': 'application/json' },
+ body: JSON.stringify(payload),
+ });
+ // permission denial dominates; 400 (missing OTP) or 403 both satisfy the spec
+ assert.ok([400, 403].includes(noOtp.status), `got ${noOtp.status}`);
+ const denied = await fetch(`${base}/cropper/profile/picture?otp=778899`, {
+ method: 'POST',
+ headers: { cookie: cookies, 'content-type': 'application/json' },
+ body: JSON.stringify(payload),
+ });
+ assert.equal(denied.status, 403);
+ assert.equal(a2loft.calls.filter((c) => c.url.includes('/profile/picture')).length, 0, 'a2loft never contacted');
+ } finally {
+ await stop();
+ }
+});
+
+test('review and dequeue proxy with the queued message', async () => {
+ const { base, nodered, stop } = await boot();
+ try {
+ const cookies = await login(base);
+ const agent = await fetch(`${base}/cropper/picture/review/up-1`, { headers: { cookie: cookies } });
+ const agentBody = await agent.json();
+ assert.equal(agentBody.ok, true, JSON.stringify(agentBody));
+ assert.equal(agentBody.data.name, 'Agent A');
+
+ const review = await fetch(`${base}/cropper/picture/review`, {
+ method: 'POST',
+ headers: { cookie: cookies, 'content-type': 'application/json' },
+ body: JSON.stringify({
+ deleteFromQueue: true,
+ message: { message_id: 'm-1', pop_receipt: 'pop-1', message: { domain: 'ucth' } },
+ mode: 'raw',
+ raw: { phone: '08068287222', reviewRejectMessage: 'blurry' },
+ }),
+ });
+ const reviewBody = await review.json();
+ assert.equal(reviewBody.ok, true, JSON.stringify(reviewBody));
+ assert.ok(nodered.calls.find((c) => c.url === '/zeebe/picture/review'));
+ } finally {
+ await stop();
+ }
+});
+
+test('baseUrl exposes the identity-prefixed a2loft base', async () => {
+ const { base, stop } = await boot();
+ try {
+ const cookies = await login(base);
+ const res = await fetch(`${base}/cropper/api/baseUrl`, { headers: { cookie: cookies } });
+ const body = await res.json();
+ assert.equal(body.ok, true);
+ assert.match(body.data, /\/identity$/);
+ assert.ok(body.data.startsWith('http://127.0.0.1:'));
+ } finally {
+ await stop();
+ }
+});
diff --git a/tools/test/server.test.js b/tools/test/server.test.js
index 113d38d..5636153 100644
--- a/tools/test/server.test.js
+++ b/tools/test/server.test.js
@@ -124,8 +124,8 @@ test('landing page links both tools', async () => {
const res = await fetch(`${base}/`);
const html = await res.text();
assert.equal(res.status, 200);
- assert.match(html, /smart-pxa\.yrka\.app/);
- assert.match(html, /\/fingerprint/);
+ assert.match(html, /href="\/cropper"/);
+ assert.match(html, /href="\/fingerprint"/);
} finally {
await stop();
}
@@ -148,7 +148,7 @@ test('auth callback rejects unredeemable sessions without setting cookies', asyn
const { base, stop } = await bootApp({}, { cookieStatus: 'TimedOut' });
try {
const res = await fetch(`${base}/auth/callback?sessionId=s1`, manual);
- assert.equal(res.status, 502);
+ assert.equal(res.status, 401);
assert.equal(cookieValue(res, 'session'), undefined);
const html = await res.text();
assert.match(html, /timed out/i);