manoel freitas
9dd6fcf409
Archive completed public-site and production-provider changes into main specs, remove duplicate active changes, and add complete-foundation-parity so Phase 0 staging and remaining foundation gaps block Phase 2 cleanly. Co-authored-by: Cursor <cursoragent@cursor.com>
1.7 KiB
1.7 KiB
ADDED Requirements
Requirement: Verified email is required for panel access
Internal users MUST have a verified email address to access the Filament panel (SPEC §12.1, ADM-01). Active users with unverified email MUST be denied panel access. Development seeds MUST mark local demo users as verified.
Scenario: Unverified active user is denied panel access
- WHEN an active user with null
email_verified_atauthenticates - THEN the system MUST NOT grant access to the Filament panel
Scenario: Verified active user can access the panel
- WHEN an active user with a non-null
email_verified_atsubmits valid credentials - THEN the system authenticates the user and allows Filament panel access subject to role rules
Scenario: Local seed users are verified
- WHEN
DatabaseSeedercreates the local admin and assistant - THEN both users MUST have
email_verified_atset
Requirement: Password reset flow is covered by automated tests
The secure password reset flow for internal users MUST be covered by feature tests that assert a reset request for a registered email queues/sends a reset notification without revealing whether the email exists to the client (SPEC §12.1; existing password-reset requirement).
Scenario: Reset request does not reveal account existence
- WHEN a visitor submits a password reset for an unknown email
- THEN the response MUST not disclose that the email is unregistered
Scenario: Registered email receives reset notification
- WHEN a visitor submits a password reset for a registered email
- THEN the system MUST dispatch the password reset notification (faked in tests)