Feature #3273
Updated by Bot AI about 2 months ago
### Overview Feature for the web side. ### Requirement "Forgot Password v4" Attached file (read it directly for the real content): /opt/drcarrot-deploy/cross-repo-orchestration/contracts/.attachments/dev-hub-spec-QfZE8oi7fJRHngcY6-requirement.md Attached file (read it directly for the real content): /opt/drcarrot-deploy/cross-repo-orchestration/contracts/.attachments/dev-hub-spec-LjSTukG6gdADuW5uA-OMS_Screens__standalone___4_.html ### Acceptance Criteria (none extracted — spec-extract has not run for this session) ### Test Cases (Test case checklist not available — test-gen has not run for this session; see spec-extract/test-gen in v2-graph/graph.yaml.) ### Implementation Details #### Diagnosis & Fix Adds a 4-step forgot-password flow to (populated once implementation completes — see the (auth) route group: (1) enter registered mobile number → OTP sent by SMS, (2) enter 6-digit OTP with 30-second resend timer, (3) set new password (no current-password field — design correction run's completion note on this ticket for locked-out user), (4) success redirect to /login. Multi-step state flows through signed httpOnly cookies (fp_otp_token, fp_reset_token) consistent with the existing HMAC-signing pattern in lib/auth.ts. No SMS package currently exists in the project — provider selection is a blocker that must be resolved before the data-layer phase. real commit list and MR link) #### Merge Request * **Repository:** oms/oms-web * **Branch:** feat/3273-forgot-password-flow-wit * **MR:** https://gitlab.techbumbles.co.in/oms/oms-web/-/merge_requests/12 #### Commits * 9a29abf Contract (oms-forgt-passwd-v4) * 720b8cf 4. Dead Code (oms-forgt-passwd-v4) * 2762105 1. Unit Tests (oms-forgt-passwd-v4) * ba9a09b UI Implementation (oms-forgt-passwd-v4) * 6db124e UI Implementation (oms-forgt-passwd-v4) * 0630055 Design (oms-forgt-passwd-v4) * 4de5925 Data Layer (oms-forgt-passwd-v4) ### Verification #### Quality Gates * **1. Unit Tests:** PASS (populated once verification completes — 80 passed / 0 failed, 90.47% coverage * ✅ ForgotPasswordForm — rendering (clean state) renders see the Forgot Password heading: PASS * ✅ ForgotPasswordForm — rendering (clean state) renders the mobile number input with correct attributes: PASS * ✅ ForgotPasswordForm — rendering (clean state) renders the +91 prefix label: PASS * ✅ ForgotPasswordForm — rendering (clean state) renders the Send Verification Code submit button: PASS * ✅ ForgotPasswordForm — rendering (clean state) renders the Back to Sign In link pointing to /login: PASS * ✅ ForgotPasswordForm — rendering (clean state) renders the footer hint text: PASS * ✅ ForgotPasswordForm — field error state shows a mobile field error when fieldErrors.mobile is set: PASS * ✅ ForgotPasswordForm — field error state does not show a generic error message when fieldErrors is set (field error takes priority in the template): PASS * ✅ ForgotPasswordForm — generic error state shows a generic error message when ok=false and message is present with no fieldErrors: PASS * ✅ ForgotPasswordForm — generic error state does not show any error when state is clean (ok=true, no message): PASS * ✅ ForgotPasswordForm — success message state shows the success message in green when ok=true and message is present: PASS * ✅ ForgotPasswordForm — Server Action wiring binds useFormState to requestPasswordResetOtp with ok=true initial state: PASS * ✅ ForgotPasswordForm — Server Action wiring calling the bound action delegates to requestPasswordResetOtp: PASS * ✅ ForgotPasswordPage — rendering renders the ForgotPasswordForm component: PASS * ✅ ForgotPasswordPage — rendering never calls redirect — no guard run's completion note on step 1: PASS * ✅ VerifyOtpPage — cookie guard redirects redirects to /forgot-password when the fp_otp_token cookie is absent: PASS * ✅ VerifyOtpPage — cookie guard redirects redirects to /forgot-password when fp_otp_token.value is an empty string: PASS * ✅ VerifyOtpPage — cookie guard redirects does not render VerifyOtpForm when the guard redirects: PASS * ✅ VerifyOtpPage — renders form when token is present renders VerifyOtpForm and does not redirect when fp_otp_token is set: PASS * ✅ VerifyOtpPage — renders form when token is present reads the fp_otp_token cookie by name: PASS * ✅ ResetPasswordPage — cookie guard redirects redirects to /forgot-password when the fp_reset_token cookie is absent: PASS * ✅ ResetPasswordPage — cookie guard redirects redirects to /forgot-password when fp_reset_token.value is an empty string: PASS * ✅ ResetPasswordPage — cookie guard redirects does not render ResetPasswordForm when the guard redirects: PASS * ✅ ResetPasswordPage — renders form when token is present renders ResetPasswordForm and does not redirect when fp_reset_token is set: PASS * ✅ ResetPasswordPage — renders form when token is present reads the fp_reset_token cookie by name: PASS * ✅ ResetPasswordForm (auth) — initial rendering renders the Reset Password heading: PASS * ✅ ResetPasswordForm (auth) — initial rendering renders New Password and Re-enter Password fields: PASS * ✅ ResetPasswordForm (auth) — initial rendering renders the Save New Password submit button: PASS * ✅ ResetPasswordForm (auth) — initial rendering renders the Cancel button: PASS * ✅ ResetPasswordForm (auth) — initial rendering does not render a 'Current Password' field (auth variant has no such field): PASS * ✅ ResetPasswordForm (auth) — initial rendering renders the PASSWORD POLICY card with all 5 rules: PASS * ✅ ResetPasswordForm (auth) — initial rendering renders the Strength meter label: PASS * ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is disabled with empty passwords: PASS * ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is disabled when policy is not met: PASS * ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is disabled when passwords don't match: PASS * ✅ ResetPasswordForm (auth) — submit button enable/disable Save New Password button is enabled when policy passes and passwords match: PASS * ✅ ResetPasswordForm (auth) — password mismatch shows a 'Passwords do not match' error when confirmPassword differs from newPassword: PASS * ✅ ResetPasswordForm (auth) — password mismatch does not show a mismatch error when passwords match: PASS * ✅ ResetPasswordForm (auth) — password mismatch does not show mismatch error on empty confirm field: PASS * ✅ ResetPasswordForm (auth) — strength meter does not show a strength label when the password field is empty: PASS * ✅ ResetPasswordForm (auth) — strength meter shows 'Weak' label when only 1 rule is met: PASS * ✅ ResetPasswordForm (auth) — strength meter shows 'Strong' label when all 5 rules are met: PASS * ✅ ResetPasswordForm (auth) — field errors from action state shows newPassword field error from action state: PASS * ✅ ResetPasswordForm (auth) — field errors from action state shows confirmPassword field error from action state: PASS * ✅ ResetPasswordForm (auth) — field errors from action state shows generic error message when ok=false, message present, no fieldErrors: PASS * ✅ ResetPasswordForm (auth) — field errors from action state does not show generic error when fieldErrors is also present: PASS * ✅ ResetPasswordForm (auth) — Cancel button calls router.push('/login') when Cancel is clicked: PASS * ✅ ResetPasswordForm (auth) — Server Action wiring binds useFormState to resetPasswordViaOtp with ok=true initial state: PASS * ✅ ResetPasswordForm (auth) — Server Action wiring calling the bound action delegates to resetPasswordViaOtp: PASS * ✅ VerifyOtpForm — initial rendering renders the Enter Verification Code heading: PASS * …(30 more — see 1. Unit Tests's evidence file this ticket for the full list) * 1. Unit Tests attached: W10-unit-tests.json * **2. TypeScript:** FAIL — 0 error(s) * 2. TypeScript attached: gate-1-typescript.txt * **3. Lint:** PASS — 0 error(s), 0 warning(s) * 3. Lint attached: W12_gate_lint-oms-forgt-passwd-v4.txt * **4. Dead Code:** PASS * 4. Dead Code attached: dead-code-3273.txt * **5. Code & Style Quality Audit:** PASS * 5. Code & Style Quality Audit attached: W14_gate_quality-audit-3273.txt * **5a. Bundle Analyze:** PASS * 5a. Bundle Analyze attached: bundle-analyze-W14a.txt * **5b. Performance:** WARN * 5b. Performance attached: performance-3273.txt * **6. Design Consistency Audit:** PASS * 6. Design Consistency Audit attached: design-consistency-audit-3273.txt * **7. Responsive Audit:** FAIL * 7. Responsive Audit attached: W16_gate_responsive-audit-3273.txt * **Code Review:** APPROVED * **UI Verify:** N/A * (UI Verify at docs/gate-evidence/ could not be attached — see log above) #### UI Verification N/A * **Screens verified:** forgot-password, forgot-password/verify, forgot-password/reset * (Verified UI evidence at docs/gate-evidence/ could not be attached — see log above) Business Logic Verification: FAILED * Live verification evidence attached: live-verify-3273.txt UI/live-verification evidence) --- Orchestration slug: oms-forgt-passwd-v4 (side: web)