OMS Web

Overview¶

Feature for the web side.

Requirement¶

"Implement the attached requirement"

Attached file (read it directly for the real content): /tmp/dev-hub-spec-XsfEF27Z3dGLANp6b-requirement.md

Additional requirement update: TEST-ONLY verification of driver.py fix — this line will be visible in the requirement text, harmless

Additional requirement update: Design reference attached.

Attached file (read it directly for the real content): /tmp/dev-hub-spec-wnwKXeXb3ihejykmF-OMS_Screens__standalone___1_.html

Explicit Constraints¶

• No new visual language is to be introduced. The feature SHALL reuse the existing OMS design system, typography, colour tokens and component library. screens/UI, existing components
• No parallel auth path is to be created. The feature SHALL reuse the existing authentication and session mechanisms. authentication/scope
• No changes SHALL be made to the OMS order lifecycle, order data model, or any existing module behaviour. existing behavior/scope
• Database schema changes SHALL be additive only, delivered as reversible migrations. database schema
• Passwords SHALL never be logged, echoed in an API response, stored in plaintext, or transmitted over a non-TLS channel. security/passwords
• The header profile icon SHALL NOT displace or overlap existing header controls at any supported viewport width. screens/UI
• All new endpoints SHALL conform to the existing OMS API standard and error envelope (REF-06). API endpoints
• The icon SHALL NOT be rendered on the login page or on any other unauthenticated page. screens/UI
• The dropdown SHALL contain exactly three actionable options, in this order: (1) My Profile, (2) Reset Password, (3) Logout. No additional options SHALL be present in this release. screens/UI, dropdown menu
• A user identifier SHALL NEVER be accepted from the request body or path for these self-service operations. API endpoints/backend
• Plain HTTP SHALL be refused. All endpoints SHALL be served over TLS 1.2 or higher. API security
• No endpoint SHALL return a password, password hash, or one-time code in any response body, header or log entry. API security/logging
• Error messages SHALL NOT disclose whether a given email address or mobile number belongs to another account beyond the generic conflict message. API security/error handling
• New Password SHALL NOT be identical to the Current Password. password logic
• New Password SHALL NOT match any of the user's previous [PLACEHOLDER - default 3] passwords. password logic
• The plaintext password SHALL NOT be logged or returned in any response. security/logging
• Session termination SHALL be performed server-side. Clearing client-side storage alone SHALL NOT be considered sufficient. logout/backend
• No feature, field, menu option, screen or capability beyond those specified SHALL be added. Where an addition appears desirable, raise it as a change request; do not implement it. scope
• The dropdown SHALL contain exactly three options. Settings, Help, Notifications, Theme and similar additions are explicitly excluded. screens/UI, scope
• All user-facing copy SHALL be taken verbatim from Sections 5.4 and 11. Do not paraphrase. content/copy
• Where a requirement carries a [PLACEHOLDER], implementation of that requirement SHALL NOT begin until the placeholder is resolved. Do not substitute an assumed value silently. scope/implementation process
• Existing OMS components, utilities, styles and API conventions SHALL be reused. Do not introduce parallel implementations of functionality that already exists. existing components/scope
• No new third-party UI dependency introduced without written approval. screens/UI, dependencies
• Where a requirement is found to be ambiguous, contradictory or technically infeasible, halt and raise the question. Do not resolve it by assumption. implementation process
• Administrative management of other users' profiles is out of scope. scope
• Role and permission management is out of scope. scope
• Profile photograph or avatar image upload is out of scope. Initials-based icon is sufficient for this release. scope/screens/UI
• Forgotten-password recovery from the login page is out of scope. scope
• Multi-factor authentication enrolment and management is out of scope. scope
• Active session listing and remote sign-out is out of scope. scope
• Account deactivation or deletion by the user is out of scope. scope
• Language and theme preferences are out of scope. scope
• Editing of Username, User ID or Role is out of scope. These are administrator-controlled per BR-02. scope/screens/UI
• Database migrations SHALL be additive and reversible, with a tested rollback path. database schema/migrations

Acceptance Criteria¶

(none extracted — spec-extract has not run for this session)

Test Cases¶

(Test case checklist not available — test-gen has not run for this session; see spec-extract/test-gen in v2-graph/graph.yaml.)

Implementation Details¶

(populated once implementation completes — see the run's completion note on this ticket for the real commit list and MR link)

Verification¶

(populated once verification completes — see the run's completion note on this ticket for UI/live-verification evidence)

Orchestration slug: oms-major-bug (side: web)