# Spec Delta: tools-app

## MODIFIED Requirements

### Requirement: a2loft proxies inject operator identity
The app SHALL proxy staff lookup and fingerprint-save calls to
`https://apis.a2loft.net` under same-origin API routes. The proxy SHALL
authenticate the operator with the signed-in session's PocketBase token, sent
as an `Authorization: Bearer` credential, preserving the a2loft request and
response shapes. The proxies SHALL require a session; a request without one
SHALL be rejected without contacting a2loft. The proxies SHALL NOT forward or
require an OTP.

#### Scenario: Staff lookup via proxy
- **WHEN** the page requests staff details for a domain and reference
- **THEN** the app calls a2loft's identity endpoint with the session token as a
  bearer credential and returns a2loft's response unchanged

#### Scenario: Fingerprint save via proxy
- **WHEN** the page saves fingerprints for a domain and reference
- **THEN** the app posts them to a2loft's fingerprint endpoint with the session
  token as a bearer credential

#### Scenario: Unauthenticated proxy call rejected
- **WHEN** a proxy route is called without a valid session
- **THEN** the app rejects the call without contacting a2loft