james
0ceb4a2b25
Wave 2 of replacing the fixed-data mock adapter: the auth domain joins the live list, so credentials, roles and tokens belong to the real user. - session: validate a restored token through /auth/me instead of trusting localStorage, clearing it on 401/403 but keeping it when the API is merely unreachable; the route guard now uses the validated session - login: report a 401 as invalid credentials rather than a generic failure, and drop the 6-character client rule so the API owns the password policy - register: raise the rule to the API's 8 characters, remove the verification-code field (its button only counted down and the value was never sent), and report a duplicate email (409) distinctly - TopBar and the user profile render their session-dependent branch client-only: validating the session before hydration made those localStorage-backed branches report hydration mismatches the previous code did not Verified against the running backend: wrong password rejected, real JWT issued, /user reachable, a short password refused with no network call, duplicate email reported, a tampered token cleared and bounced to sign-in, a stale token kept when the API is down, and the fixed-data rollback still signs in with the backend stopped. Also re-cuts docs/TBD-migrate-wave.md: auth is done, and cart, orders, shipments and invoices must move together, because the mock adapter keeps their state in one shared object and a partial flip fails at checkout. OpenSpec change: openspec/changes/replace-mock-api-wave-2
33 lines
1.9 KiB
Markdown
33 lines
1.9 KiB
Markdown
# Proposal
|
|
|
|
## Why
|
|
|
|
Auth is the last thing between the mall and real accounts. The fixed-data adapter accepts any credentials and always returns the same demo user, so login, register and "me" are theatre — and every domain needing a bearer token (cart, orders, invoices) is pinned behind them. `shop-admin` and `admin` already authenticate against the live backend.
|
|
|
|
## What Changes
|
|
|
|
- Flip the `auth` domain to live via `liveDomains`; cart, orders, shipments and invoices stay on fixed data.
|
|
- Align the client password rule with the API: the panels require 6 characters, but `/auth/register` requires 8 and answers 400 (`apps/api/src/routes/auth.rs:32`).
|
|
- Map real failures to distinct messages — 401 for bad credentials, 409 when an email is taken — instead of one generic "request failed".
|
|
- Drop the register SMS-code field: its button only runs a countdown, there is no endpoint, and the value is never sent, so it is a mandatory no-op once auth is real.
|
|
- Validate a stored token through `/auth/me` on load rather than trusting `localStorage` alone.
|
|
- **BREAKING** (auth UX): the demo's "log in as anyone, any password" behaviour ends; wrong credentials now fail.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
(none)
|
|
|
|
### Modified Capabilities
|
|
|
|
- `frontend-mall`: the "Auth and buyer center" requirement stops being backed by deterministic mock auth and uses the live auth API.
|
|
|
|
## Impact
|
|
|
|
`apps/mall/plugins/api.ts` and `apps/mall/nuxt.config.ts` (`liveDomains`), `pages/login.vue`, `pages/register.vue`, `stores/session.ts`, `middleware/auth.ts`, and `locales-extra.ts` for the new error strings. No backend or `shop-admin`/`admin` change.
|
|
|
|
## Non-goals
|
|
|
|
Cart, orders, shipments and invoices stay on fixed data: the mock adapter holds `cart -> orders -> shipments` as one shared state, so flipping cart alone would fail checkout with `EMPTY_CART`. They move together in a later wave. No store, address, favourite or coupon work.
|