OMS Web

Overview¶

Feature for the web side.

Requirement¶

"Forgot Password v4"

Attached file (read it directly for the real content): /opt/drcarrot-deploy/cross-repo-orchestration/contracts/.attachments/dev-hub-spec-QfZE8oi7fJRHngcY6-requirement.md

Attached file (read it directly for the real content): /opt/drcarrot-deploy/cross-repo-orchestration/contracts/.attachments/dev-hub-spec-LjSTukG6gdADuW5uA-OMS_Screens__standalone___4_.html

Acceptance Criteria¶

(none extracted — spec-extract has not run for this session)

Test Cases¶

(Test case checklist not available — test-gen has not run for this session; see spec-extract/test-gen in v2-graph/graph.yaml.)

Implementation Details¶

Diagnosis & Fix¶

Adds a 4-step forgot-password flow to the (auth) route group: (1) enter registered mobile number → OTP sent by SMS, (2) enter 6-digit OTP with 30-second resend timer, (3) set new password (no current-password field — design correction for locked-out user), (4) success redirect to /login. Multi-step state flows through signed httpOnly cookies (fp_otp_token, fp_reset_token) consistent with the existing HMAC-signing pattern in lib/auth.ts. No SMS package currently exists in the project — provider selection is a blocker that must be resolved before the data-layer phase.

Merge Request¶

• Repository: oms/oms-web
• Branch: feat/3273-forgot-password-flow-wit
• MR: https://gitlab.techbumbles.co.in/oms/oms-web/-/merge_requests/12

Commits¶

• 9a29abf Contract (oms-forgt-passwd-v4)
• 720b8cf 4. Dead Code (oms-forgt-passwd-v4)
• 2762105 1. Unit Tests (oms-forgt-passwd-v4)
• ba9a09b UI Implementation (oms-forgt-passwd-v4)
• 6db124e UI Implementation (oms-forgt-passwd-v4)
• 0630055 Design (oms-forgt-passwd-v4)
• 4de5925 Data Layer (oms-forgt-passwd-v4)

Verification¶

Quality Gates¶

• 1. Unit Tests: PASS — 80 passed / 0 failed, 90.47% coverage
  • ✅ ForgotPasswordForm — rendering (clean state) renders the Forgot Password heading: PASS
  • ✅ ForgotPasswordForm — rendering (clean state) renders the mobile number input with correct attributes: PASS
  • ✅ ForgotPasswordForm — rendering (clean state) renders the +91 prefix label: PASS
  • ✅ ForgotPasswordForm — rendering (clean state) renders the Send Verification Code submit button: PASS
  • ✅ ForgotPasswordForm — rendering (clean state) renders the Back to Sign In link pointing to /login: PASS
  • ✅ ForgotPasswordForm — rendering (clean state) renders the footer hint text: PASS
  • ✅ ForgotPasswordForm — field error state shows a mobile field error when fieldErrors.mobile is set: PASS
  • ✅ ForgotPasswordForm — field error state does not show a generic error message when fieldErrors is set (field error takes priority in the template): PASS
  • ✅ ForgotPasswordForm — generic error state shows a generic error message when ok=false and message is present with no fieldErrors: PASS
  • ✅ ForgotPasswordForm — generic error state does not show any error when state is clean (ok=true, no message): PASS
  • ✅ ForgotPasswordForm — success message state shows the success message in green when ok=true and message is present: PASS
  • ✅ ForgotPasswordForm — Server Action wiring binds useFormState to requestPasswordResetOtp with ok=true initial state: PASS
  • ✅ ForgotPasswordForm — Server Action wiring calling the bound action delegates to requestPasswordResetOtp: PASS
  • ✅ ForgotPasswordPage — rendering renders the ForgotPasswordForm component: PASS
  • ✅ ForgotPasswordPage — rendering never calls redirect — no guard on step 1: PASS
  • ✅ VerifyOtpPage — cookie guard redirects redirects to /forgot-password when the fp_otp_token cookie is absent: PASS
  • ✅ VerifyOtpPage — cookie guard redirects redirects to /forgot-password when fp_otp_token.value is an empty string: PASS
  • ✅ VerifyOtpPage — cookie guard redirects does not render VerifyOtpForm when the guard redirects: PASS
  • ✅ VerifyOtpPage — renders form when token is present renders VerifyOtpForm and does not redirect when fp_otp_token is set: PASS
  • ✅ VerifyOtpPage — renders form when token is present reads the fp_otp_token cookie by name: PASS
  • ✅ ResetPasswordPage — cookie guard redirects redirects to /forgot-password when the fp_reset_token cookie is absent: PASS
  • ✅ ResetPasswordPage — cookie guard redirects redirects to /forgot-password when fp_reset_token.value is an empty string: PASS
  • ✅ ResetPasswordPage — cookie guard redirects does not render ResetPasswordForm when the guard redirects: PASS
  • ✅ ResetPasswordPage — renders form when token is present renders ResetPasswordForm and does not redirect when fp_reset_token is set: PASS
  • ✅ ResetPasswordPage — renders form when token is present reads the fp_reset_token cookie by name: PASS
  • ✅ ResetPasswordForm (auth) — initial rendering renders the Reset Password heading: PASS
  • ✅ ResetPasswordForm (auth) — initial rendering renders New Password and Re-enter Password fields: PASS
  • ✅ ResetPasswordForm (auth) — initial rendering renders the Save New Password submit button: PASS
  • ✅ ResetPasswordForm (auth) — initial rendering renders the Cancel button: PASS
  • ✅ ResetPasswordForm (auth) — initial rendering does not render a 'Current Password' field (auth variant has no such field): PASS
  • ✅ ResetPasswordForm (auth) — initial rendering renders the PASSWORD POLICY card with all 5 rules: PASS
  • ✅ ResetPasswordForm (auth) — initial rendering renders the Strength meter label: PASS
  • ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is disabled with empty passwords: PASS
  • ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is disabled when policy is not met: PASS
  • ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is disabled when passwords don't match: PASS
  • ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is enabled when policy passes and passwords match: PASS
  • ✅ ResetPasswordForm (auth) — password mismatch shows a 'Passwords do not match' error when confirmPassword differs from newPassword: PASS
  • ✅ ResetPasswordForm (auth) — password mismatch does not show a mismatch error when passwords match: PASS
  • ✅ ResetPasswordForm (auth) — password mismatch does not show mismatch error on empty confirm field: PASS
  • ✅ ResetPasswordForm (auth) — strength meter does not show a strength label when the password field is empty: PASS
  • ✅ ResetPasswordForm (auth) — strength meter shows 'Weak' label when only 1 rule is met: PASS
  • ✅ ResetPasswordForm (auth) — strength meter shows 'Strong' label when all 5 rules are met: PASS
  • ✅ ResetPasswordForm (auth) — field errors from action state shows newPassword field error from action state: PASS
  • ✅ ResetPasswordForm (auth) — field errors from action state shows confirmPassword field error from action state: PASS
  • ✅ ResetPasswordForm (auth) — field errors from action state shows generic error message when ok=false, message present, no fieldErrors: PASS
  • ✅ ResetPasswordForm (auth) — field errors from action state does not show generic error when fieldErrors is also present: PASS
  • ✅ ResetPasswordForm (auth) — Cancel button calls router.push('/login') when Cancel is clicked: PASS
  • ✅ ResetPasswordForm (auth) — Server Action wiring binds useFormState to resetPasswordViaOtp with ok=true initial state: PASS
  • ✅ ResetPasswordForm (auth) — Server Action wiring calling the bound action delegates to resetPasswordViaOtp: PASS
  • ✅ VerifyOtpForm — initial rendering renders the Enter Verification Code heading: PASS
  • …(30 more — see 1. Unit Tests's evidence file for the full list)
• 1. Unit Tests attached: W10-unit-tests.json
• 2. TypeScript: FAIL — 0 error(s)
• 2. TypeScript attached: gate-1-typescript.txt
• 3. Lint: PASS — 0 error(s), 0 warning(s)
• 3. Lint attached: W12_gate_lint-oms-forgt-passwd-v4.txt
• 4. Dead Code: PASS
• 4. Dead Code attached: dead-code-3273.txt
• 5. Code & Style Quality Audit: PASS
• 5. Code & Style Quality Audit attached: W14_gate_quality-audit-3273.txt
• 5a. Bundle Analyze: PASS
• 5a. Bundle Analyze attached: bundle-analyze-W14a.txt
• 5b. Performance: WARN
• 5b. Performance attached: performance-3273.txt
• 6. Design Consistency Audit: PASS
• 6. Design Consistency Audit attached: design-consistency-audit-3273.txt
• 7. Responsive Audit: FAIL
• 7. Responsive Audit attached: W16_gate_responsive-audit-3273.txt
• Code Review: APPROVED
• UI Verify: N/A
• (UI Verify at docs/gate-evidence/ could not be attached — see log above)

UI Verification¶

N/A

• Screens verified: forgot-password, forgot-password/verify, forgot-password/reset
• (Verified UI evidence at docs/gate-evidence/ could not be attached — see log above)
  Business Logic Verification: FAILED
• Live verification evidence attached: live-verify-3273.txt

Orchestration slug: oms-forgt-passwd-v4 (side: web)