james
2136a48fbe
Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each merge applied cleanly to the main specs: - catalog gains the Public product browse requirement (subtree filtering and price sort) - frontend-mall picks up the per-domain adapter, the pinned home page, the discovery-page changes, the live auth panels and the live transaction flows - cart's Server-side cart requirement now documents the shop and stock carried by every line Also replace the TBD Purpose placeholder in all eleven specs with a one-line description of what each capability covers. Those placeholders predate this work and were the only reason `openspec validate --all --strict` reported 0 passed / 11 failed; it now reports 11 passed / 0 failed.
1.9 KiB
Spec Delta
MODIFIED Requirements
Requirement: Auth and buyer center
The mall SHALL provide B2B2C mall-style login, register and forgot-password panels backed by the live auth API, so credentials, roles and tokens belong to the real user rather than a fixed demo account. Registration SHALL require a password of at least 8 characters, matching the API's rule, and the register panel SHALL NOT ask for a verification code because no endpoint issues one. Failures SHALL be reported distinctly: invalid credentials on sign-in, and an already-registered email on registration. A token restored from storage SHALL be validated against the auth API on load, and a rejected token SHALL clear the session and return the shopper to sign-in. /user SHALL render a two-column buyer center with dashboard, order list/detail, addresses, favorites, coupons and invoices.
Scenario: sign in and inspect buyer data
- WHEN a shopper signs in with valid credentials and opens
/user - THEN the session carries the authenticated user, and the buyer-center shell and its fixed account/order/address/favorite/coupon/invoice data render
Scenario: wrong password rejected
- WHEN a shopper submits a password that does not match the account
- THEN sign-in fails with an invalid-credentials message and no session is established
Scenario: short password refused before the API call
- WHEN a shopper submits a registration password shorter than 8 characters
- THEN the panel asks for at least 8 characters without calling the API
Scenario: duplicate email reported
- WHEN a shopper registers an email that already has an account
- THEN the panel reports that the email is already registered rather than a generic failure
Scenario: rejected token clears the session
- WHEN a token restored from storage is rejected by the auth API
- THEN the stored session is cleared and the shopper is returned to sign-in