adebisi-fa
8a13fb527e
The wizard's a2loft calls now authenticate with the session token and carry no OTP. Field pass in production: the lookup and both fingerprint saves succeeded with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app deltas into the main specs and archived the change.
50 lines
2.0 KiB
Markdown
50 lines
2.0 KiB
Markdown
# Design
|
|
|
|
## Context
|
|
|
|
See proposal.md for motivation. The wizard already holds the PocketBase token
|
|
in the page (`window.__SESSION__.token`) for fpagent enrollment, and the
|
|
cropper's save already sends `Authorization: Bearer ${req.session.token}` to
|
|
a2loft through its own proxy (`tools/cropper.js`). The two remaining OTP calls
|
|
are the wizard's staff-lookup and fingerprint-save proxies in `tools/server.js`;
|
|
their handlers receive the a2loft URL from `a2loftUrl`/`a2loftSaveUrl`, which
|
|
currently append `phone`+`otp`, and `validateProxy` rejects a missing `otp`.
|
|
|
|
## Goals / Non-Goals
|
|
|
|
**Goals:** both wizard a2loft calls use the session token; no OTP in the
|
|
wizard; proxy validation keeps rejecting unauthenticated calls; deployable
|
|
after the a2loft change with a clean rollback.
|
|
|
|
**Non-Goals:** fpagent capture (already carries the token); the cropper; a2loft's
|
|
own OTP compatibility; the legacy singular fingerprint endpoint.
|
|
|
|
## Decisions
|
|
|
|
1. **Bearer from the server session**, never the browser: the proxy attaches
|
|
`Authorization: Bearer ${req.session.token}`, mirroring `tools/cropper.js`.
|
|
The page's token copy stays for fpagent only.
|
|
2. **Drop the OTP check in `validateProxy`**, along with the now-unnecessary
|
|
phone check; keep the hardcoded-domain and reference checks. `requireApi`
|
|
already guarantees a session.
|
|
3. **Remove the OTP inputs and state** rather than hiding them;
|
|
`canLookup`/`canSave` no longer require an OTP.
|
|
|
|
## Risks / Trade-offs
|
|
|
|
- [a2loft not yet dual-mode] → deploy the a2loft change first; this proxy change
|
|
depends on it.
|
|
- [Operators outside a domain's uploader list can now enroll] → intended;
|
|
a2loft authorizes `capture_biometric` with the `domain:idid` fallback.
|
|
- [Rollback] → revert the proxy and re-add the OTP fields; a2loft stays
|
|
dual-mode.
|
|
|
|
## Migration Plan
|
|
|
|
Deploy a2loft dual-mode → deploy this app → field pass: look up a reference and
|
|
save both fingerprints with no OTP; a bogus-token call fails cleanly.
|
|
|
|
## Open Questions
|
|
|
|
None.
|