adebisi-fa
14f6fd6a8e
The fingerprint wizard's staff-lookup and fingerprint-save proxies forwarded the page's OTP with the session phone. a2loft resolves that phone against the domain being addressed, so an operator who holds only capture_biometric was rejected unless they were a domain super-user. The cropper already saves with the session token. - tools/server.js: both a2loft proxies send Authorization: Bearer <session token>, no phone/otp; validateProxy drops the OTP and phone checks. - tools/public/assets/fp: both OTP fields, otpLookup/otpSave state, request params and resets removed; canLookup/canSave no longer gate on OTP. - Tests assert the Bearer header, no query auth, no OTP field in the served page, and both gates without a credential (66/66 pass). - README and Help page updated. Requires the a2loft fingerprint-token-auth change deployed first. OpenSpec change: fingerprint-token-auth.
46 lines
1.7 KiB
Markdown
46 lines
1.7 KiB
Markdown
# Proposal: fingerprint-token-auth
|
|
|
|
## Why
|
|
|
|
The Fingerprint Agent wizard's two a2loft calls — staff lookup and fingerprint
|
|
save — prove the operator with a phone number and an OTP forwarded through
|
|
same-origin proxies. a2loft resolves that phone against the domain being
|
|
addressed, so an operator who holds the OpenFGA `capture_biometric` relation
|
|
but is not a super-user of that domain's uploader list is rejected. The cropper
|
|
already saves with the session's PocketBase token; the wizard's a2loft calls
|
|
should use the same token flow.
|
|
|
|
## What Changes
|
|
|
|
- The `/api/:domain/staff/:reference` and
|
|
`/api/:domain/staff/:reference/fingerprints` proxies send the session's
|
|
PocketBase token as an `Authorization: Bearer` header instead of forwarding
|
|
`phone`+`otp` query parameters.
|
|
- The OTP validation is removed from the proxies; the session token is the
|
|
credential.
|
|
- The wizard's lookup and save steps drop their OTP fields and OTP state.
|
|
- The Fingerprint Agent and tools-app specs, the README, and the Help page are
|
|
updated.
|
|
- Requires the a2loft `fingerprint-token-auth` change deployed first.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
(none)
|
|
|
|
### Modified Capabilities
|
|
|
|
- `fingerprint-wizard`: the two-finger enrollment flow and the per-call OTP
|
|
requirement become token-authenticated.
|
|
- `tools-app`: the a2loft proxies requirement now injects the session token
|
|
instead of forwarding `phone`+`otp`.
|
|
|
|
## Impact
|
|
|
|
- `tools/server.js`: the two a2loft proxy handlers and `validateProxy`.
|
|
- `tools/public/assets/fp/index.html`, `tools/public/assets/fp/app.js`: the OTP
|
|
fields, state and request parameters removed.
|
|
- `tools/test/server.test.js`: proxy assertions.
|
|
- Documentation: README and the Help page.
|