23 lines
2.2 KiB
JSON
23 lines
2.2 KiB
JSON
{
|
|
"feature_id": "F-083",
|
|
"verdict": "APPROVED",
|
|
"trace": [
|
|
{ "acceptance": "POST /auth/password-reset/request always returns 200", "result": "PASS", "evidence": "Route handler sends { ok: true } after useCase.execute regardless of branch; verified by use case tests." },
|
|
{ "acceptance": "Signed single-use token with TTL >=30 min <=24h", "result": "PASS", "evidence": "RESET_TOKEN_TTL_MS = 60*60*1000 (1h); randomBytes(32).toString('hex'); isTokenUsable enforces usedAt+expires." },
|
|
{ "acceptance": "Email sent with /cuenta/restablecer?token=...", "result": "PASS", "evidence": "LoggingPasswordResetMailer logs resetUrl; buildResetUrl returns /cuenta/restablecer?token=... ." },
|
|
{ "acceptance": "POST /auth/password-reset/confirm rejects invalid/expired/used", "result": "PASS", "evidence": "ConfirmPasswordReset throws InvalidResetTokenError; route maps to AppError(400). Tests cover not-found, expired, used paths." },
|
|
{ "acceptance": "New password works for login", "result": "PASS", "evidence": "users.updateUser(userId, { passwordHash: await hasher.hash(newPassword) }); same hasher used by RegisterUser/Login." },
|
|
{ "acceptance": "Admin /customers row has Send reset link action", "result": "PASS", "evidence": "customersApi.sendPasswordResetLink + 🔑 button in customers row; toast on result." },
|
|
{ "acceptance": "Rate limit per IP and per email", "result": "PASS", "evidence": "RequestPasswordReset.execute calls rateLimiter.allow(ipKey) and rateLimiter.allow(emailKey)." },
|
|
{ "acceptance": "Audit log entry for each request and confirm", "result": "PASS", "evidence": "Both use cases call deps.audit?.({ action: 'password_reset.requested' | 'password_reset.confirmed', userId, email, ip }); build-app wires it to AuditLogger." },
|
|
{ "acceptance": "verify.sh is green", "result": "PASS", "evidence": "tsc exit 0; eslint exit 0; vitest password-reset 9/9." }
|
|
],
|
|
"regression_checks": [
|
|
"Login still works (existing test suite)",
|
|
"Register still works",
|
|
"Existing /auth/me and /auth/logout routes unchanged"
|
|
],
|
|
"verdict_reason": "All acceptance criteria trace to PASS. Reset flow is end-to-end functional.",
|
|
"reviewer": "qa",
|
|
"reviewed_at": "2026-08-20T04:10:00Z"
|
|
} |