adebisi-fa
528eaafb18
The cropper upload POSTs with the session token and no OTP query auth, and the panel shows the profile's domain and picture target. Field pass was verified earlier (upload 0b90075b, saved with no OTP). Merged the image-cropper delta into the main spec and archived the change.
1.8 KiB
1.8 KiB
Proposal: cropper-token-auth
Why
The cropper's save proves the operator with a phone number and an OTP. a2loft
resolves that phone against the domain being saved to, so an operator without
super-user rights in that domain is rejected with a blanket Invalid OTP specified. — even though they are authorized to crop images for the domain.
The a2loft endpoints now accept a PocketBase token (see the a2loft change
cropper-token-auth), which authorizes with OpenFGA crop_image and takes the
actor's identity from the token.
What Changes
- The cropper's save posts the session token to a2loft instead of
phone+otp; the OTP input is removed from the UI. - The save's domain comes from a2loft's own picture record
(
dims/picture/{uploadId}→domainCode), falling back to the queue item's label, and the panel shows both (the profile's domain and the picture target). - The
core → ucalias is deleted:coreis a2loft's own pseudo-domain for a profile picture, not an alias foruc. - The fingerprint wizard's staff lookup and fingerprint save keep their OTP; only the cropper's calls change.
Capabilities
New Capabilities
(none)
Modified Capabilities
image-cropper: the save is token-authenticated (no OTP), the domain comes from a2loft's record, and the OTP requirement is removed.
Impact
tools/cropper.js: save handler (Bearer token, no?otp=), domain resolution via dims with the label as fallback, path-safety check replacing the catalog check, queue loads enriched with the profile's domain.tools/public/assets/cropper/: the OTP field and allotpstate removed; the panel shows the profile's domain and the picture target.- Requires the a2loft
cropper-token-authchange to be deployed first.