adebisi-fa
14f6fd6a8e
The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token. - tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks. - tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP. - Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass). - README and Help page updated. Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.
1.2 KiB
1.2 KiB
Tasks
1. Proxies
- 1.1
tools/server.js:a2loftUrl/a2loftSaveUrldropphone/otp; both handlers sendAuthorization: Bearer ${req.session.token};validateProxydrops the OTP/phone checks and keeps domain + reference. Verified: the proxy tests assert the Bearer header and no query auth. - 1.2 Update the proxy tests: assert no
?otp, assert the Bearer header, and drop the no-OTP rejection case while the auth/domain rejection remains (no a2loft call). Verified.
2. Wizard UI
- 2.1
tools/public/assets/fp/index.html: remove the lookup and save OTP inputs. - 2.2
tools/public/assets/fp/app.js: removeotpLookup/otpSave, theotprequest params, and the OTP resets; tightencanLookup/canSave. Verified: the served page has no OTP field (server test) and both gates pass without a credential (wizard test). - 2.3 Update the
fingerprint-wizardandtools-appspec deltas, README steps 1/3, the a2loft proxy paragraph, and the Help page.
3. Verify
- 3.1 Run the full tools test suite (
node --test) and confirm it passes. (66/66 pass.) - 3.2 Field pass against a real domain (a2loft deployed): look up a reference and save both fingerprints with no OTP.