Files
where_woof/openspec/changes/frontend-foundation/specs/user-auth/spec.md

1.5 KiB

ADDED Requirements

Requirement: Account registration

The system SHALL allow a new owner to register with a unique email address and a password. The password SHALL be stored only as a salted hash.

Scenario: Successful registration

  • WHEN a visitor submits a new email and password on the register page
  • THEN an account is created and the visitor is logged in

Scenario: Duplicate email

  • WHEN a visitor registers with an email that already exists
  • THEN registration is rejected with an error message

Requirement: Login and logout

The system SHALL allow an owner to log in with email and password and to log out, maintaining an authenticated session via a signed session cookie.

Scenario: Successful login

  • WHEN an owner submits the correct email and password
  • THEN a session cookie is set and the owner is authenticated

Scenario: Incorrect password

  • WHEN an owner submits a wrong password
  • THEN login is rejected with an error message and no session is created

Scenario: Logout

  • WHEN an authenticated owner clicks logout
  • THEN the session is destroyed and the owner is redirected to the home page

Requirement: Session-protected routes

Routes that manage tags SHALL require an authenticated session and redirect unauthenticated visitors to the login page.

Scenario: Unauthenticated access to account

  • WHEN a visitor who is not logged in opens the account page
  • THEN they are redirected to the login page