adebisi-fa
8a13fb527e
The wizard's a2loft calls now authenticate with the session token and carry no OTP. Field pass in production: the lookup and both fingerprint saves succeeded with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app deltas into the main specs and archived the change.
61 lines
2.6 KiB
Markdown
61 lines
2.6 KiB
Markdown
# Spec Delta: fingerprint-wizard
|
|
|
|
## MODIFIED Requirements
|
|
|
|
### Requirement: Two-finger enrollment flow
|
|
The wizard SHALL enroll a profile by: selecting a permitted domain, looking
|
|
up staff by reference (token-validated through the a2loft proxy), displaying
|
|
the staff details, capturing the right thumb and right index finger, and
|
|
saving both fingerprints through the a2loft proxy authenticated with the
|
|
session token. The wizard SHALL offer per-finger recapture until save, SHALL
|
|
require both fingers before save, and SHALL reset domain-independent state
|
|
(reference, staff details, captured artifacts) when starting a new
|
|
enrollment.
|
|
|
|
#### Scenario: Complete enrollment
|
|
- **WHEN** the operator looks up staff, captures both fingers, and saves
|
|
- **THEN** both fingerprints are saved through the a2loft proxy and the
|
|
wizard reports success
|
|
|
|
#### Scenario: Save requires both fingers
|
|
- **WHEN** the operator attempts to save with only one finger captured
|
|
- **THEN** the wizard rejects the save and explains both fingers are
|
|
required
|
|
|
|
#### Scenario: New enrollment resets state
|
|
- **WHEN** the operator starts a new enrollment after a save
|
|
- **THEN** the reference, staff details, and captured finger artifacts are
|
|
cleared while the permitted domain list persists
|
|
|
|
## REMOVED Requirements
|
|
|
|
### Requirement: OTP validated on every a2loft call
|
|
**Reason**: a2loft's fingerprint staff-lookup and save endpoints now accept the
|
|
session's PocketBase token, so the operator proves identity with the session
|
|
instead of a per-call OTP. The OTP scoped operators to the domain's uploader
|
|
list and rejected capture agents who hold only `capture_biometric`.
|
|
**Migration**: the wizard sends the session token through the same-origin
|
|
proxy and collects no OTP; a2loft keeps OTP mode for other clients.
|
|
|
|
## ADDED Requirements
|
|
|
|
### Requirement: Token authenticated on every a2loft call
|
|
The wizard SHALL authenticate each a2loft call — staff lookup and fingerprint
|
|
save — with the signed-in operator's PocketBase session token, sent by the
|
|
same-origin proxy as an `Authorization: Bearer` credential. The wizard SHALL
|
|
NOT collect an OTP.
|
|
|
|
#### Scenario: Lookup uses the session token
|
|
- **WHEN** the operator submits a reference
|
|
- **THEN** the wizard calls the staff-lookup proxy and a2loft authenticates the
|
|
session token
|
|
|
|
#### Scenario: Save uses the session token
|
|
- **WHEN** the operator saves the captured fingerprints
|
|
- **THEN** the wizard calls the fingerprint-save proxy and a2loft authenticates
|
|
the session token
|
|
|
|
#### Scenario: No OTP field
|
|
- **WHEN** the wizard page is served
|
|
- **THEN** it offers no OTP input for lookup or save
|