# Spec Delta

## MODIFIED Requirements

### Requirement: Auth and buyer center
The mall SHALL provide B2B2C mall-style login, register and forgot-password panels backed by the live auth API, so credentials, roles and tokens belong to the real user rather than a fixed demo account. Registration SHALL require a password of at least 8 characters, matching the API's rule, and the register panel SHALL NOT ask for a verification code because no endpoint issues one. Failures SHALL be reported distinctly: invalid credentials on sign-in, and an already-registered email on registration. A token restored from storage SHALL be validated against the auth API on load, and a rejected token SHALL clear the session and return the shopper to sign-in. `/user` SHALL render a two-column buyer center with dashboard, order list/detail, addresses, favorites, coupons and invoices.

#### Scenario: sign in and inspect buyer data
- **WHEN** a shopper signs in with valid credentials and opens `/user`
- **THEN** the session carries the authenticated user, and the buyer-center shell and its fixed account/order/address/favorite/coupon/invoice data render

#### Scenario: wrong password rejected
- **WHEN** a shopper submits a password that does not match the account
- **THEN** sign-in fails with an invalid-credentials message and no session is established

#### Scenario: short password refused before the API call
- **WHEN** a shopper submits a registration password shorter than 8 characters
- **THEN** the panel asks for at least 8 characters without calling the API

#### Scenario: duplicate email reported
- **WHEN** a shopper registers an email that already has an account
- **THEN** the panel reports that the email is already registered rather than a generic failure

#### Scenario: rejected token clears the session
- **WHEN** a token restored from storage is rejected by the auth API
- **THEN** the stored session is cleared and the shopper is returned to sign-in