Files

T

adebisi-fa 8a13fb527e docs(openspec): archive fingerprint-token-auth after the production pass

The wizard's a2loft calls now authenticate with the session token and carry no
OTP. Field pass in production: the lookup and both fingerprint saves succeeded
with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app
deltas into the main specs and archived the change.

2026-10-06 19:19:29 +01:00

1.3 KiB

Raw Permalink Blame History

Tasks

1. Proxies

1.1 tools/server.js: a2loftUrl/a2loftSaveUrl drop phone/otp; both handlers send Authorization: Bearer ${req.session.token}; validateProxy drops the OTP/phone checks and keeps domain + reference. Verified: the proxy tests assert the Bearer header and no query auth.
1.2 Update the proxy tests: assert no ?otp, assert the Bearer header, and drop the no-OTP rejection case while the auth/domain rejection remains (no a2loft call). Verified.

2. Wizard UI

2.1 tools/public/assets/fp/index.html: remove the lookup and save OTP inputs.
2.2 tools/public/assets/fp/app.js: remove otpLookup/otpSave, the otp request params, and the OTP resets; tighten canLookup/canSave. Verified: the served page has no OTP field (server test) and both gates pass without a credential (wizard test).
2.3 Update the fingerprint-wizard and tools-app spec deltas, README steps 1/3, the a2loft proxy paragraph, and the Help page.

3. Verify

3.1 Run the full tools test suite (node --test) and confirm it passes. (66/66 pass.)
3.2 Field pass against a real domain (a2loft deployed): look up a reference and save both fingerprints with no OTP. Verified in production: the lookup and both fingerprint saves succeeded with no OTP.

1.3 KiB Raw Permalink Blame History

Tasks

1. Proxies

2. Wizard UI

3. Verify

1.3 KiB

Raw Permalink Blame History