# Tasks

## 1. Adapter and configuration

- [x] 1.1 Add `auth` to the default `liveDomains` in `apps/mall/nuxt.config.ts` and confirm `LIVE_PICKS.auth` in `apps/mall/plugins/api.ts` already covers `register`/`login`/`me`; verify a sign-in request reaches `:8080` while `getCart` still resolves from fixed data
- [x] 1.2 Confirm the rollback path: with `NUXT_PUBLIC_LIVE_DOMAINS` set to catalog and currency only, sign-in returns the fixed demo user again; verify by signing in with any password

## 2. Session and route guard

- [x] 2.1 Add a session action that validates a restored token through `$api.me()`, clearing the stored session and returning to sign-in on 401/403 but leaving the session intact when the API is merely unreachable; verify with a tampered `vmall.token` and again with the backend stopped
- [x] 2.2 Make `middleware/auth.ts` rely on the validated session rather than `localStorage` alone; verify a shopper with a stale token lands on `/login` while a valid one reaches `/user`
- [x] 2.3 Render the session-dependent header and profile name client-only (`components/shell/TopBar.vue`, `pages/user.vue`); added during implementation because validating the session before hydration made those `localStorage`-backed branches report hydration mismatches that the pre-change code did not; verified by A/B that the sign-in flow now produces no mismatch warnings

## 3. Sign-in panel

- [x] 3.1 Map failures on `ApiError.status`/`code` so a 401 reports invalid credentials rather than the current generic message, adding the key to `apps/mall/locales/auth.ts` in en and zh (the per-domain module behind `locales-extra.ts`); verify with a deliberately wrong password

## 4. Registration panel

- [x] 4.1 Raise the client password rule to 8 characters with its own message; verify a 7-character password is refused without any network call. `apps/mall/pages/forgot-password.vue` was aligned to the same rule because it shares the `validationPassword` message
- [x] 4.2 Remove the verification-code field and its countdown so the form no longer requires it; verify registration submits with display name, email and password only
- [x] 4.3 Report a duplicate email (409) distinctly from other failures, adding the key to `apps/mall/locales/auth.ts` in en and zh; verify by registering an address that already exists

## 5. Verification

- [x] 5.1 Run `pnpm --filter @vmall/mall build` and confirm it passes
- [x] 5.2 With the backend running and seeded, verify in a browser: sign in as `customer@vmall.local`, see the utility-bar welcome/sign-out state, reach `/user`, and confirm the only console entries are the deliberately triggered 401/409 responses plus a pre-existing hydration warning on the unauthenticated `/user` redirect (A/B verified identical before this change)
- [x] 5.3 With every domain set to fixed data and the backend stopped, verify sign-in and browsing still work, so the rollback path is intact