Files

T

james 2136a48fbe chore(openspec): archive the mock-migration waves and green the spec set

Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each
merge applied cleanly to the main specs:

- catalog gains the Public product browse requirement (subtree filtering and
  price sort)
- frontend-mall picks up the per-domain adapter, the pinned home page, the
  discovery-page changes, the live auth panels and the live transaction flows
- cart's Server-side cart requirement now documents the shop and stock carried
  by every line

Also replace the TBD Purpose placeholder in all eleven specs with a one-line
description of what each capability covers. Those placeholders predate this
work and were the only reason `openspec validate --all --strict` reported
0 passed / 11 failed; it now reports 11 passed / 0 failed.

2026-09-17 16:36:10 +00:00

1.3 KiB

Raw Permalink Blame History

auth Specification

Purpose

Buyer registration, sign-in and current-user lookup backed by the API's JWT auth.

Requirements

Requirement: Customer registration

The API SHALL provide POST /api/auth/register accepting email, password, display_name. New users are created with role customer. Duplicate emails MUST be rejected with 409.

Scenario: successful registration

WHEN a client posts a unique email with password ≥ 8 chars
THEN the API returns 201 with { token, user } and the user can call /api/auth/me with the token

Scenario: duplicate email

WHEN the email already exists
THEN the API returns 409 with code CONFLICT

The API SHALL provide POST /api/auth/login issuing a signed JWT (24h TTL) containing user id and role.

Scenario: valid credentials

WHEN email + correct password are posted
THEN the API returns { token, user }

Scenario: invalid credentials

WHEN the password is wrong or email unknown
THEN the API returns 401 with code UNAUTHORIZED and no token

Requirement: Current user

GET /api/auth/me SHALL return the authenticated user profile.

Scenario: missing token

WHEN no Bearer token is supplied
THEN the API returns 401

1.3 KiB Raw Permalink Blame History