GuilanCE/guilan-ace-deployment
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: approve authentication checkpoint I

Browse Source
This commit is contained in:
Amirhossein Khalili
2026-09-28 22:06:42 +03:30
parent 52646c480c
commit c04d3bed5b
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
tasks/todo.md
View File

@@ -43,11 +43,11 @@ Checkpoint C was approved by the owner on 2026-09-27 after reviewing [the schema
## 3. Authentication (5–7 person-days) ## 3. Authentication (5–7 person-days)
- [ ] **T20 — Simplify auth entry and navigation (M; deps: T15, T02).** Files: F Auth view/auth shell/tests. Acceptance: login/signup choice, intent, next step, and back path are clear on phone/desktop without changing backend auth rules. Verify: first-time student and returning-user walkthroughs. - [x] **T20 — Simplify auth entry and navigation (M; deps: T15, T02).** Files: F Auth view/auth shell/tests. Acceptance: mobile entry automatically routes password accounts to password entry, passwordless existing accounts to login OTP, and new numbers to registration OTP then details, with a clear way to edit the phone and no backend auth-rule changes. Implemented this single phone-first path and removed the separate login/signup selector.
- [ ] **T21 — Clarify form, OTP, loading, and error states (M; deps: T20).** Files: F auth components/tests. Acceptance: each step has one clear action, input constraints and errors are accessible, resend/countdown are understandable, and retry does not lose valid input. Verify: keyboard, slow-network, invalid-input, and duplicate-submit tests. - [x] **T21 — Clarify form, OTP, loading, and error states (M; deps: T20).** Files: F auth components/tests. Acceptance: each step has one clear action, input constraints and errors are accessible, resend/countdown are understandable, and retry does not lose valid input. Added inline announced errors, field autocomplete/constraints, an accessible OTP label, cooldown display, duplicate-submit protection, and automatic sign-in after successful registration. Removed forgotten-password UI because OTP login covers account access, improved dark-mode error contrast, and standardized outline/toggle/nav hovers on the theme's secondary color. Frontend lint/build pass.
- [ ] **Checkpoint I (deps: T20–T21).** Core login/signup behavior unchanged and clear in RTL/mobile. - [x] **Checkpoint I (deps: T20–T21).** Owner reviewed and approved the phone → password/OTP → registration details flow, dark-mode errors, and button hover colors in RTL/mobile on 2026-09-28; backend auth rules remain unchanged.
- [ ] **T22 — Align recovery and verification screens (M; deps: T20).** Files: F reset/verify/callback views/tests. Acceptance: expired token, failed Google callback, success, and return-to-intent states follow same system; no dead end. Verify: browser tests for link/token variants. - [ ] **T22 — Align verification and OAuth callback screens (M; deps: T20).** Files: F verification/callback views/tests. Acceptance: expired token, failed Google callback, success, and return-to-intent states follow the same system; forgotten-password recovery stays removed in favor of OTP login. Verify: browser tests for link/token variants.
- [ ] **T23 — Auth regression gate (M; deps: T21–T22).** Files: F end-to-end tests, B focused auth tests if needed. Acceptance: login, signup, verification, reset, logout, and protected redirect pass with existing API semantics. Verify: full focused automated suite plus manual mobile smoke. - [ ] **T23 — Auth regression gate (M; deps: T21–T22).** Files: F end-to-end tests, B focused auth tests if needed. Acceptance: password login, OTP login, signup, verification, logout, protected redirects, and the retired recovery URL behave with existing API semantics. Verify: focused automated suite plus manual mobile smoke.
## 4. Events and registration (9–12 person-days) ## 4. Events and registration (9–12 person-days)