adebisi-fa
528eaafb18
The cropper upload POSTs with the session token and no OTP query auth, and the panel shows the profile's domain and picture target. Field pass was verified earlier (upload 0b90075b, saved with no OTP). Merged the image-cropper delta into the main spec and archived the change.
19 lines
1.1 KiB
Markdown
19 lines
1.1 KiB
Markdown
# Tasks
|
|
|
|
- [x] 1. Save handler: `Authorization: Bearer <session token>`, no `?phone/otp`;
|
|
domain resolved from `dims/picture/{uploadId}` (`domainCode`) with the queue
|
|
label as fallback, guarded by a path-safety pattern; `requireOtp` and the
|
|
`core → uc` alias deleted.
|
|
- [x] 2. Queue loads enriched with the profile's `domainCode` for display;
|
|
load-by-id passes it through.
|
|
- [x] 3. UI: OTP field, state and call parameters removed; panel shows the
|
|
profile's domain and the picture target.
|
|
- [x] 4. Tests: save carries the bearer token and no query auth; the resolved
|
|
domain wins over the body; unsafe values are refused; no OTP field in the
|
|
served page; queue load exposes `domainCode` (46 tests pass).
|
|
- [x] 5. Deploy a2loft and this app, then a field pass: load a queued picture →
|
|
save with no OTP → confirm the picture lands attributed to the token's phone.
|
|
Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target
|
|
core"), no OTP field, save POSTed with the session token and no query auth,
|
|
answered "Saved — Picture saved for +2348068287222" and reset the panel.
|