# Proposal: fingerprint-token-auth

## Why

The Fingerprint Agent wizard's two a2loft calls — staff lookup and fingerprint
save — prove the operator with a phone number and an OTP forwarded through
same-origin proxies. a2loft resolves that phone against the domain being
addressed, so an operator who holds the OpenFGA `capture_biometric` relation
but is not a super-user of that domain's uploader list is rejected. The cropper
already saves with the session's PocketBase token; the wizard's a2loft calls
should use the same token flow.

## What Changes

- The `/api/:domain/staff/:reference` and
  `/api/:domain/staff/:reference/fingerprints` proxies send the session's
  PocketBase token as an `Authorization: Bearer` header instead of forwarding
  `phone`+`otp` query parameters.
- The OTP validation is removed from the proxies; the session token is the
  credential.
- The wizard's lookup and save steps drop their OTP fields and OTP state.
- The Fingerprint Agent and tools-app specs, the README, and the Help page are
  updated.
- Requires the a2loft `fingerprint-token-auth` change deployed first.

## Capabilities

### New Capabilities

(none)

### Modified Capabilities

- `fingerprint-wizard`: the two-finger enrollment flow and the per-call OTP
  requirement become token-authenticated.
- `tools-app`: the a2loft proxies requirement now injects the session token
  instead of forwarding `phone`+`otp`.

## Impact

- `tools/server.js`: the two a2loft proxy handlers and `validateProxy`.
- `tools/public/assets/fp/index.html`, `tools/public/assets/fp/app.js`: the OTP
  fields, state and request parameters removed.
- `tools/test/server.test.js`: proxy assertions.
- Documentation: README and the Help page.