james
2136a48fbe
Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each merge applied cleanly to the main specs: - catalog gains the Public product browse requirement (subtree filtering and price sort) - frontend-mall picks up the per-domain adapter, the pinned home page, the discovery-page changes, the live auth panels and the live transaction flows - cart's Server-side cart requirement now documents the shop and stock carried by every line Also replace the TBD Purpose placeholder in all eleven specs with a one-line description of what each capability covers. Those placeholders predate this work and were the only reason `openspec validate --all --strict` reported 0 passed / 11 failed; it now reports 11 passed / 0 failed.
35 lines
1.3 KiB
Markdown
35 lines
1.3 KiB
Markdown
# auth Specification
|
|
|
|
## Purpose
|
|
Buyer registration, sign-in and current-user lookup backed by the API's JWT auth.
|
|
## Requirements
|
|
### Requirement: Customer registration
|
|
The API SHALL provide `POST /api/auth/register` accepting email, password, display_name. New users are created with role `customer`. Duplicate emails MUST be rejected with 409.
|
|
|
|
#### Scenario: successful registration
|
|
- **WHEN** a client posts a unique email with password ≥ 8 chars
|
|
- **THEN** the API returns 201 with `{ token, user }` and the user can call `/api/auth/me` with the token
|
|
|
|
#### Scenario: duplicate email
|
|
- **WHEN** the email already exists
|
|
- **THEN** the API returns 409 with code `CONFLICT`
|
|
|
|
### Requirement: Login
|
|
The API SHALL provide `POST /api/auth/login` issuing a signed JWT (24h TTL) containing user id and role.
|
|
|
|
#### Scenario: valid credentials
|
|
- **WHEN** email + correct password are posted
|
|
- **THEN** the API returns `{ token, user }`
|
|
|
|
#### Scenario: invalid credentials
|
|
- **WHEN** the password is wrong or email unknown
|
|
- **THEN** the API returns 401 with code `UNAUTHORIZED` and no token
|
|
|
|
### Requirement: Current user
|
|
`GET /api/auth/me` SHALL return the authenticated user profile.
|
|
|
|
#### Scenario: missing token
|
|
- **WHEN** no Bearer token is supplied
|
|
- **THEN** the API returns 401
|
|
|