OMS Web

Overview¶

Feature for the web side. 24 acceptance criteria identified. 25 test case(s) generated.

Requirement¶

"Forgot Password"

Attached file (read it directly for the real content): /opt/drcarrot-deploy/cross-repo-orchestration/contracts/.attachments/dev-hub-spec-Dgmh6qJGCie8RSLpN-requirement.md

Acceptance Criteria¶

• A "Forgot Password?" option/link is present on the Login screen. (AC-deb37534)
• Clicking "Forgot Password?" navigates the user to the Forgot Password flow. (AC-116428d9)
• The Forgot Password screen allows the user to enter their registered email/username consistent with the existing authentication design. (AC-1f04eb1c)
• Submitting a registered email/username on the Forgot Password screen sends a verification code (OTP) to the user's registered email/contact. (AC-cc3fc602)
• After submitting the registered email/username, the user is navigated to the Verification Code screen. (AC-3eb8e31b)
• The Verification Code screen allows the user to enter the received verification code. (AC-79e78551)
• The Verification Code screen provides a "Resend Code" action. (AC-0285ce85)
• The Verification Code screen displays a resend countdown/timer that governs when Resend Code can be used again. (AC-669f13f4)
• Submitting an invalid verification code displays an appropriate error message and does not verify the user. (AC-768358bd)
• Submitting an expired verification code displays an appropriate error message and does not verify the user. (AC-fb9cc849)
• Submitting an incorrect verification code displays an appropriate error message and does not verify the user. (AC-1fe78feb)
• Successful verification of the code navigates the user to the Reset Password screen. (AC-2f911217)
• The Reset Password screen provides "New Password" and "Confirm Password" fields. (AC-d3862268)
• The Reset Password screen validates the new password against password policy rules and shows an error message when invalid. (AC-02d8e457)
• The Reset Password screen requires "New Password" and "Confirm Password" to match, and shows an error message when they do not. (AC-c9af1079)
• After a successful password reset, a success message is shown to the user. (AC-55affd7e)
• After a successful password reset, any temporary reset/verification state is cleared or invalidated. (AC-404910fd)
• After a successful password reset, the user is redirected to the Login screen. (AC-ac0cf474)
• The user can log in successfully using the newly reset password. (AC-247a6692)
• Verification codes are generated, stored, validated, and expired securely on the backend. (AC-bd8c2aa8)
• Verification codes, reset tokens, and other sensitive authentication information are never exposed in logs or API responses. (AC-9a415028)
• An expired or already-used verification code cannot be reused to complete a password reset. (AC-f5c66278)
• Rate limiting/security controls are applied to verification-code request and resend operations. (AC-d6ff037d)
• Existing login, logout, session, and authentication flows continue to function correctly after this change. (AC-302f423d)

Test Cases¶

☐ The Login screen displays a "Forgot Password?" option/link alongside the existing login form.
☐ Clicking "Forgot Password?" on the Login screen navigates the user into the Forgot Password flow.
☐ The Forgot Password screen lets the user enter their registered email/username using the same input pattern as the e

…(truncated — 6148 chars total; the full description is exactly what will be created, this is a preview only)