Files

T

adebisi-fa 528eaafb18 docs(openspec): archive cropper-token-auth and sync specs

The cropper upload POSTs with the session token and no OTP query auth, and the
panel shows the profile's domain and picture target. Field pass was verified
earlier (upload 0b90075b, saved with no OTP). Merged the image-cropper delta
into the main spec and archived the change.

2026-10-06 19:29:45 +01:00

1.8 KiB

Raw Blame History

Proposal: cropper-token-auth

Why

The cropper's save proves the operator with a phone number and an OTP. a2loft resolves that phone against the domain being saved to, so an operator without super-user rights in that domain is rejected with a blanket Invalid OTP specified. — even though they are authorized to crop images for the domain. The a2loft endpoints now accept a PocketBase token (see the a2loft change cropper-token-auth), which authorizes with OpenFGA crop_image and takes the actor's identity from the token.

What Changes

The cropper's save posts the session token to a2loft instead of phone + otp; the OTP input is removed from the UI.
The save's domain comes from a2loft's own picture record (dims/picture/{uploadId} → domainCode), falling back to the queue item's label, and the panel shows both (the profile's domain and the picture target).
The core → uc alias is deleted: core is a2loft's own pseudo-domain for a profile picture, not an alias for uc.
The fingerprint wizard's staff lookup and fingerprint save keep their OTP; only the cropper's calls change.

Capabilities

New Capabilities

(none)

Modified Capabilities

image-cropper: the save is token-authenticated (no OTP), the domain comes from a2loft's record, and the OTP requirement is removed.

Impact

tools/cropper.js: save handler (Bearer token, no ?otp=), domain resolution via dims with the label as fallback, path-safety check replacing the catalog check, queue loads enriched with the profile's domain.
tools/public/assets/cropper/: the OTP field and all otp state removed; the panel shows the profile's domain and the picture target.
Requires the a2loft cropper-token-auth change to be deployed first.

1.8 KiB Raw Blame History