adebisi-fa
528eaafb18
The cropper upload POSTs with the session token and no OTP query auth, and the panel shows the profile's domain and picture target. Field pass was verified earlier (upload 0b90075b, saved with no OTP). Merged the image-cropper delta into the main spec and archived the change.
1.1 KiB
1.1 KiB
Tasks
- 1. Save handler:
Authorization: Bearer <session token>, no?phone/otp; domain resolved fromdims/picture/{uploadId}(domainCode) with the queue label as fallback, guarded by a path-safety pattern;requireOtpand thecore → ucalias deleted. - 2. Queue loads enriched with the profile's
domainCodefor display; load-by-id passes it through. - 3. UI: OTP field, state and call parameters removed; panel shows the profile's domain and the picture target.
- 4. Tests: save carries the bearer token and no query auth; the resolved
domain wins over the body; unsafe values are refused; no OTP field in the
served page; queue load exposes
domainCode(46 tests pass). - 5. Deploy a2loft and this app, then a field pass: load a queued picture → save with no OTP → confirm the picture lands attributed to the token's phone. Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target core"), no OTP field, save POSTed with the session token and no query auth, answered "Saved — Picture saved for +2348068287222" and reset the panel.