james
2136a48fbe
Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each merge applied cleanly to the main specs: - catalog gains the Public product browse requirement (subtree filtering and price sort) - frontend-mall picks up the per-domain adapter, the pinned home page, the discovery-page changes, the live auth panels and the live transaction flows - cart's Server-side cart requirement now documents the shop and stock carried by every line Also replace the TBD Purpose placeholder in all eleven specs with a one-line description of what each capability covers. Those placeholders predate this work and were the only reason `openspec validate --all --strict` reported 0 passed / 11 failed; it now reports 11 passed / 0 failed.
27 lines
1.9 KiB
Markdown
27 lines
1.9 KiB
Markdown
# Spec Delta
|
|
|
|
## MODIFIED Requirements
|
|
|
|
### Requirement: Auth and buyer center
|
|
The mall SHALL provide B2B2C mall-style login, register and forgot-password panels backed by the live auth API, so credentials, roles and tokens belong to the real user rather than a fixed demo account. Registration SHALL require a password of at least 8 characters, matching the API's rule, and the register panel SHALL NOT ask for a verification code because no endpoint issues one. Failures SHALL be reported distinctly: invalid credentials on sign-in, and an already-registered email on registration. A token restored from storage SHALL be validated against the auth API on load, and a rejected token SHALL clear the session and return the shopper to sign-in. `/user` SHALL render a two-column buyer center with dashboard, order list/detail, addresses, favorites, coupons and invoices.
|
|
|
|
#### Scenario: sign in and inspect buyer data
|
|
- **WHEN** a shopper signs in with valid credentials and opens `/user`
|
|
- **THEN** the session carries the authenticated user, and the buyer-center shell and its fixed account/order/address/favorite/coupon/invoice data render
|
|
|
|
#### Scenario: wrong password rejected
|
|
- **WHEN** a shopper submits a password that does not match the account
|
|
- **THEN** sign-in fails with an invalid-credentials message and no session is established
|
|
|
|
#### Scenario: short password refused before the API call
|
|
- **WHEN** a shopper submits a registration password shorter than 8 characters
|
|
- **THEN** the panel asks for at least 8 characters without calling the API
|
|
|
|
#### Scenario: duplicate email reported
|
|
- **WHEN** a shopper registers an email that already has an account
|
|
- **THEN** the panel reports that the email is already registered rather than a generic failure
|
|
|
|
#### Scenario: rejected token clears the session
|
|
- **WHEN** a token restored from storage is rejected by the auth API
|
|
- **THEN** the stored session is cleared and the shopper is returned to sign-in
|