adebisi-fa
3a5edbfe75
Loaded a real upload (panel: Domain ucth · picture target core), saved with no OTP — the proxy POSTed with the session token and no query auth, a2loft returned ok and the panel reset.
1.1 KiB
1.1 KiB
Tasks
- 1. Save handler:
Authorization: Bearer <session token>, no?phone/otp; domain resolved fromdims/picture/{uploadId}(domainCode) with the queue label as fallback, guarded by a path-safety pattern;requireOtpand thecore → ucalias deleted. - 2. Queue loads enriched with the profile's
domainCodefor display; load-by-id passes it through. - 3. UI: OTP field, state and call parameters removed; panel shows the profile's domain and the picture target.
- 4. Tests: save carries the bearer token and no query auth; the resolved
domain wins over the body; unsafe values are refused; no OTP field in the
served page; queue load exposes
domainCode(46 tests pass). - 5. Deploy a2loft and this app, then a field pass: load a queued picture → save with no OTP → confirm the picture lands attributed to the token's phone. Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target core"), no OTP field, save POSTed with the session token and no query auth, answered "Saved — Picture saved for +2348068287222" and reset the panel.