Files

T

adebisi-fa 8a13fb527e docs(openspec): archive fingerprint-token-auth after the production pass

The wizard's a2loft calls now authenticate with the session token and carry no
OTP. Field pass in production: the lookup and both fingerprint saves succeeded
with no OTP, so task 3.2 is done. Merged the fingerprint-wizard and tools-app
deltas into the main specs and archived the change.

2026-10-06 19:19:29 +01:00

1.2 KiB

Raw Blame History

Spec Delta: tools-app

MODIFIED Requirements

Requirement: a2loft proxies inject operator identity

The app SHALL proxy staff lookup and fingerprint-save calls to https://apis.a2loft.net under same-origin API routes. The proxy SHALL authenticate the operator with the signed-in session's PocketBase token, sent as an Authorization: Bearer credential, preserving the a2loft request and response shapes. The proxies SHALL require a session; a request without one SHALL be rejected without contacting a2loft. The proxies SHALL NOT forward or require an OTP.

Scenario: Staff lookup via proxy

WHEN the page requests staff details for a domain and reference
THEN the app calls a2loft's identity endpoint with the session token as a bearer credential and returns a2loft's response unchanged

Scenario: Fingerprint save via proxy

WHEN the page saves fingerprints for a domain and reference
THEN the app posts them to a2loft's fingerprint endpoint with the session token as a bearer credential

Scenario: Unauthenticated proxy call rejected

WHEN a proxy route is called without a valid session
THEN the app rejects the call without contacting a2loft

1.2 KiB Raw Blame History