Files

T

james 0ceb4a2b25 feat(mall): authenticate against the live API

Wave 2 of replacing the fixed-data mock adapter: the auth domain joins the live
list, so credentials, roles and tokens belong to the real user.

- session: validate a restored token through /auth/me instead of trusting
  localStorage, clearing it on 401/403 but keeping it when the API is merely
  unreachable; the route guard now uses the validated session
- login: report a 401 as invalid credentials rather than a generic failure, and
  drop the 6-character client rule so the API owns the password policy
- register: raise the rule to the API's 8 characters, remove the
  verification-code field (its button only counted down and the value was never
  sent), and report a duplicate email (409) distinctly
- TopBar and the user profile render their session-dependent branch client-only:
  validating the session before hydration made those localStorage-backed
  branches report hydration mismatches the previous code did not

Verified against the running backend: wrong password rejected, real JWT issued,
/user reachable, a short password refused with no network call, duplicate email
reported, a tampered token cleared and bounced to sign-in, a stale token kept
when the API is down, and the fixed-data rollback still signs in with the
backend stopped.

Also re-cuts docs/TBD-migrate-wave.md: auth is done, and cart, orders,
shipments and invoices must move together, because the mock adapter keeps their
state in one shared object and a partial flip fails at checkout.

OpenSpec change: openspec/changes/replace-mock-api-wave-2

2026-09-17 16:13:16 +00:00

1.9 KiB

Raw Blame History

Proposal

Why

Auth is the last thing between the mall and real accounts. The fixed-data adapter accepts any credentials and always returns the same demo user, so login, register and "me" are theatre — and every domain needing a bearer token (cart, orders, invoices) is pinned behind them. shop-admin and admin already authenticate against the live backend.

What Changes

Flip the auth domain to live via liveDomains; cart, orders, shipments and invoices stay on fixed data.
Align the client password rule with the API: the panels require 6 characters, but /auth/register requires 8 and answers 400 (apps/api/src/routes/auth.rs:32).
Map real failures to distinct messages — 401 for bad credentials, 409 when an email is taken — instead of one generic "request failed".
Drop the register SMS-code field: its button only runs a countdown, there is no endpoint, and the value is never sent, so it is a mandatory no-op once auth is real.
Validate a stored token through /auth/me on load rather than trusting localStorage alone.
BREAKING (auth UX): the demo's "log in as anyone, any password" behaviour ends; wrong credentials now fail.

Capabilities

New Capabilities

(none)

Modified Capabilities

frontend-mall: the "Auth and buyer center" requirement stops being backed by deterministic mock auth and uses the live auth API.

Impact

apps/mall/plugins/api.ts and apps/mall/nuxt.config.ts (liveDomains), pages/login.vue, pages/register.vue, stores/session.ts, middleware/auth.ts, and locales-extra.ts for the new error strings. No backend or shop-admin/admin change.

Non-goals

Cart, orders, shipments and invoices stay on fixed data: the mock adapter holds cart -> orders -> shipments as one shared state, so flipping cart alone would fail checkout with EMPTY_CART. They move together in a later wave. No store, address, favourite or coupon work.

1.9 KiB Raw Blame History