adebisi-fa
8a13fb527e
The wizard's a2loft calls now authenticate with the session token and carry no OTP. Field pass in production: the lookup and both fingerprint saves succeeded with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app deltas into the main specs and archived the change.
27 lines
1.2 KiB
Markdown
27 lines
1.2 KiB
Markdown
# Spec Delta: tools-app
|
|
|
|
## MODIFIED Requirements
|
|
|
|
### Requirement: a2loft proxies inject operator identity
|
|
The app SHALL proxy staff lookup and fingerprint-save calls to
|
|
`https://apis.a2loft.net` under same-origin API routes. The proxy SHALL
|
|
authenticate the operator with the signed-in session's PocketBase token, sent
|
|
as an `Authorization: Bearer` credential, preserving the a2loft request and
|
|
response shapes. The proxies SHALL require a session; a request without one
|
|
SHALL be rejected without contacting a2loft. The proxies SHALL NOT forward or
|
|
require an OTP.
|
|
|
|
#### Scenario: Staff lookup via proxy
|
|
- **WHEN** the page requests staff details for a domain and reference
|
|
- **THEN** the app calls a2loft's identity endpoint with the session token as a
|
|
bearer credential and returns a2loft's response unchanged
|
|
|
|
#### Scenario: Fingerprint save via proxy
|
|
- **WHEN** the page saves fingerprints for a domain and reference
|
|
- **THEN** the app posts them to a2loft's fingerprint endpoint with the session
|
|
token as a bearer credential
|
|
|
|
#### Scenario: Unauthenticated proxy call rejected
|
|
- **WHEN** a proxy route is called without a valid session
|
|
- **THEN** the app rejects the call without contacting a2loft
|