adebisi-fa
3a5edbfe75
Loaded a real upload (panel: Domain ucth · picture target core), saved with no OTP — the proxy POSTed with the session token and no query auth, a2loft returned ok and the panel reset.
19 lines
1.1 KiB
Markdown
19 lines
1.1 KiB
Markdown
# Tasks
|
|
|
|
- [x] 1. Save handler: `Authorization: Bearer <session token>`, no `?phone/otp`;
|
|
domain resolved from `dims/picture/{uploadId}` (`domainCode`) with the queue
|
|
label as fallback, guarded by a path-safety pattern; `requireOtp` and the
|
|
`core → uc` alias deleted.
|
|
- [x] 2. Queue loads enriched with the profile's `domainCode` for display;
|
|
load-by-id passes it through.
|
|
- [x] 3. UI: OTP field, state and call parameters removed; panel shows the
|
|
profile's domain and the picture target.
|
|
- [x] 4. Tests: save carries the bearer token and no query auth; the resolved
|
|
domain wins over the body; unsafe values are refused; no OTP field in the
|
|
served page; queue load exposes `domainCode` (46 tests pass).
|
|
- [x] 5. Deploy a2loft and this app, then a field pass: load a queued picture →
|
|
save with no OTP → confirm the picture lands attributed to the token's phone.
|
|
Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target
|
|
core"), no OTP field, save POSTed with the session token and no query auth,
|
|
answered "Saved — Picture saved for +2348068287222" and reset the panel.
|