adebisi-fa
528eaafb18
The cropper upload POSTs with the session token and no OTP query auth, and the panel shows the profile's domain and picture target. Field pass was verified earlier (upload 0b90075b, saved with no OTP). Merged the image-cropper delta into the main spec and archived the change.
45 lines
1.8 KiB
Markdown
45 lines
1.8 KiB
Markdown
# Proposal: cropper-token-auth
|
|
|
|
## Why
|
|
|
|
The cropper's save proves the operator with a phone number and an OTP. a2loft
|
|
resolves that phone against the domain being saved to, so an operator without
|
|
super-user rights in that domain is rejected with a blanket `Invalid OTP
|
|
specified.` — even though they are authorized to crop images for the domain.
|
|
The a2loft endpoints now accept a PocketBase token (see the a2loft change
|
|
`cropper-token-auth`), which authorizes with OpenFGA `crop_image` and takes the
|
|
actor's identity from the token.
|
|
|
|
## What Changes
|
|
|
|
- The cropper's save posts the **session token** to a2loft instead of `phone` +
|
|
`otp`; the OTP input is removed from the UI.
|
|
- The save's domain comes from **a2loft's own picture record**
|
|
(`dims/picture/{uploadId}` → `domainCode`), falling back to the queue item's
|
|
label, and the panel shows both (the profile's domain and the picture
|
|
target).
|
|
- The `core → uc` alias is deleted: `core` is a2loft's own pseudo-domain for a
|
|
profile picture, not an alias for `uc`.
|
|
- The fingerprint wizard's staff lookup and fingerprint save keep their OTP;
|
|
only the cropper's calls change.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
(none)
|
|
|
|
### Modified Capabilities
|
|
|
|
- `image-cropper`: the save is token-authenticated (no OTP), the domain comes
|
|
from a2loft's record, and the OTP requirement is removed.
|
|
|
|
## Impact
|
|
|
|
- `tools/cropper.js`: save handler (Bearer token, no `?otp=`), domain
|
|
resolution via dims with the label as fallback, path-safety check replacing
|
|
the catalog check, queue loads enriched with the profile's domain.
|
|
- `tools/public/assets/cropper/`: the OTP field and all `otp` state removed;
|
|
the panel shows the profile's domain and the picture target.
|
|
- Requires the a2loft `cropper-token-auth` change to be deployed first.
|