27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Fingerprint on scans
|
|
The tag page SHALL compute a lightweight browser fingerprint (UA, language, timezone, screen, platform hash) and include it with every scan POST and finder-contact POST. The scan SHALL store it in `scans.fingerprint`.
|
|
|
|
#### Scenario: Scan carries fingerprint
|
|
- **WHEN** the tag page scripts a scan POST
|
|
- **THEN** the request includes a fingerprint and the scan row stores it
|
|
|
|
### Requirement: 24-hour per-device alert block
|
|
When a scan arrives with a fingerprint that was seen on an earlier scan within the last 24 hours, the system SHALL record the scan but SHALL NOT send an alert.
|
|
|
|
#### Scenario: Same device within 24 h
|
|
- **WHEN** a scan arrives with a fingerprint matching a scan from under 24 h ago
|
|
- **THEN** the scan is recorded with `alert_sent = false` and no SMS is sent
|
|
|
|
#### Scenario: Fresh device
|
|
- **WHEN** a scan arrives with a fingerprint not seen in the last 24 h
|
|
- **THEN** normal alert rules apply (an alert is sent if the throttle conditions permit)
|
|
|
|
### Requirement: Contact path coverage
|
|
The finder-contact submission SHALL also be subject to the fingerprint block when a fingerprint is provided.
|
|
|
|
#### Scenario: Contact from a blocked device
|
|
- **WHEN** a contact submission carries a fingerprint seen within 24 h
|
|
- **THEN** the number is stored but no owner SMS is sent
|