Files

T

image-cropper capability added; tools-app landing + config requirements
updated (internal /cropper link, credentials-via-env carve-out).

2026-10-01 01:13:52 +01:00

Tasks

1. Permission plumbing

1.1 Generalize permit.js: single-object checkPermission for an arbitrary relation, plus cropPermission(phone, {force}) with the 5-minute per-phone cache; verify with node --test and stubbed fetch covering allow, deny, cache-hit (no portal call), expiry, and live-at-save

2.1 Add tools/cropper.js — createCropperRouter with DI (minio, azure queue, fetch, nodered/removebg/a2loft config): router-level session + crop gate, picture next/load-by-id/image routes, review + review-agent routes, dequeue, removebg proxy (native FormData), save proxy (live gate + OTP + session phone + picture domain), baseUrl; 503 when credentials are absent; verify with node --test and fake clients/upstreams covering gate denials (403, no upstream calls), cache behavior, save proxying, and the unconfigured 503 path

3.1 Port the Smart Photo Editor to tools/public/assets/cropper/ restyled to the tools design language (navbar, panels, badges): relative API paths, phone prefilled from /auth/session, no login step, OTP field at save, review-reason list and crop/clean flow preserved; landing card links /cropper (replacing the wrong external URL); verify in the browser that the page renders, gates apply, and the flow works against fakes

4.1 Mount the router in server.js (env-gated client construction), add .env.example with the credential names, rebuild the Docker image, and document the cropper + env vars in the README; verify the app boots with no env (other tools fine, cropper 503) and with a fake env in Docker

5.1 Playwright field pass with a real item: YOUreka login → gate check → load queued picture (or by ID) → crop → clean → review → save with OTP; confirm the picture lands in a2loft and a wrong-OTP save fails cleanly