james
2136a48fbe
Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each merge applied cleanly to the main specs: - catalog gains the Public product browse requirement (subtree filtering and price sort) - frontend-mall picks up the per-domain adapter, the pinned home page, the discovery-page changes, the live auth panels and the live transaction flows - cart's Server-side cart requirement now documents the shop and stock carried by every line Also replace the TBD Purpose placeholder in all eleven specs with a one-line description of what each capability covers. Those placeholders predate this work and were the only reason `openspec validate --all --strict` reported 0 passed / 11 failed; it now reports 11 passed / 0 failed.
1.3 KiB
1.3 KiB
auth Specification
Purpose
Buyer registration, sign-in and current-user lookup backed by the API's JWT auth.
Requirements
Requirement: Customer registration
The API SHALL provide POST /api/auth/register accepting email, password, display_name. New users are created with role customer. Duplicate emails MUST be rejected with 409.
Scenario: successful registration
- WHEN a client posts a unique email with password ≥ 8 chars
- THEN the API returns 201 with
{ token, user }and the user can call/api/auth/mewith the token
Scenario: duplicate email
- WHEN the email already exists
- THEN the API returns 409 with code
CONFLICT
Requirement: Login
The API SHALL provide POST /api/auth/login issuing a signed JWT (24h TTL) containing user id and role.
Scenario: valid credentials
- WHEN email + correct password are posted
- THEN the API returns
{ token, user }
Scenario: invalid credentials
- WHEN the password is wrong or email unknown
- THEN the API returns 401 with code
UNAUTHORIZEDand no token
Requirement: Current user
GET /api/auth/me SHALL return the authenticated user profile.
Scenario: missing token
- WHEN no Bearer token is supplied
- THEN the API returns 401