adebisi-fa
14f6fd6a8e
The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token. - tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks. - tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP. - Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass). - README and Help page updated. Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.
1.2 KiB
1.2 KiB
Spec Delta: tools-app
MODIFIED Requirements
Requirement: a2loft proxies inject operator identity
The app SHALL proxy staff lookup and fingerprint-save calls to
https://apis.a2loft.net under same-origin API routes. The proxy SHALL
authenticate the operator with the signed-in session's PocketBase token, sent
as an Authorization: Bearer credential, preserving the a2loft request and
response shapes. The proxies SHALL require a session; a request without one
SHALL be rejected without contacting a2loft. The proxies SHALL NOT forward or
require an OTP.
Scenario: Staff lookup via proxy
- WHEN the page requests staff details for a domain and reference
- THEN the app calls a2loft's identity endpoint with the session token as a bearer credential and returns a2loft's response unchanged
Scenario: Fingerprint save via proxy
- WHEN the page saves fingerprints for a domain and reference
- THEN the app posts them to a2loft's fingerprint endpoint with the session token as a bearer credential
Scenario: Unauthenticated proxy call rejected
- WHEN a proxy route is called without a valid session
- THEN the app rejects the call without contacting a2loft