Files

T

adebisi-fa 14f6fd6a8e feat(fpagent): authenticate the wizard's a2loft calls with the session token

The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token.

- tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks.
- tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP.
- Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass).
- README and Help page updated.

Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.

2026-10-02 20:41:43 +01:00

1.7 KiB

Raw Blame History

Proposal: fingerprint-token-auth

Why

The Fingerprint Agent wizard's two a2loft calls — staff lookup and fingerprint save — prove the operator with a phone number and an OTP forwarded through same-origin proxies. a2loft resolves that phone against the domain being addressed, so an operator who holds the OpenFGA capture_biometric relation but is not a super-user of that domain's uploader list is rejected. The cropper already saves with the session's PocketBase token; the wizard's a2loft calls should use the same token flow.

What Changes

The /api/:domain/staff/:reference and /api/:domain/staff/:reference/fingerprints proxies send the session's PocketBase token as an Authorization: Bearer header instead of forwarding phone+otp query parameters.
The OTP validation is removed from the proxies; the session token is the credential.
The wizard's lookup and save steps drop their OTP fields and OTP state.
The Fingerprint Agent and tools-app specs, the README, and the Help page are updated.
Requires the a2loft fingerprint-token-auth change deployed first.

Capabilities

New Capabilities

(none)

Modified Capabilities

fingerprint-wizard: the two-finger enrollment flow and the per-call OTP requirement become token-authenticated.
tools-app: the a2loft proxies requirement now injects the session token instead of forwarding phone+otp.

Impact

tools/server.js: the two a2loft proxy handlers and validateProxy.
tools/public/assets/fp/index.html, tools/public/assets/fp/app.js: the OTP fields, state and request parameters removed.
tools/test/server.test.js: proxy assertions.
Documentation: README and the Help page.

1.7 KiB Raw Blame History