This commit is contained in:
sexygoat
@@ -0,0 +1,46 @@
|
||||
## Context
|
||||
|
||||
The project moved mandatory phone-binding enforcement to homepage entry, and then added a one-time homepage bypass after bind success to avoid an immediate redirect loop. A later draft proposed automatically re-running `POST /api/c/v1/auth/wechat-login` after bind success. The required direction is now simpler than both of those approaches: after mandatory bind success, route the user back to the login page, explain that they need to log in again, preserve the identifier they already entered, and let them manually restart login.
|
||||
|
||||
The login page already has behavior that can trigger login automatically from some restored inputs or URL parameters. The new flow therefore needs to preserve the identifier for convenience without accidentally auto-submitting login on the user's behalf.
|
||||
|
||||
## Goals / Non-Goals
|
||||
|
||||
- Goals:
|
||||
- Return mandatory bind-success users to the login page
|
||||
- Show a clear re-login prompt after bind success
|
||||
- Preserve the previously entered identifier in the login input
|
||||
- Require the user to manually tap login again
|
||||
- Non-Goals:
|
||||
- Do not add a new backend endpoint
|
||||
- Do not auto-run `POST /api/c/v1/auth/wechat-login` after bind success
|
||||
- Do not change the ordinary bind flow that starts from homepage actions
|
||||
|
||||
## Decisions
|
||||
|
||||
- Decision: Mandatory bind completion SHALL route to `pages/login/login` instead of continuing directly to `pages/index/index`.
|
||||
- Decision: The system SHALL show a one-time prompt that binding succeeded and the user must log in again.
|
||||
- Decision: The previously entered identifier SHALL be preserved through the bind-success redirect and restored into the login input.
|
||||
- Decision: Restoring the identifier SHALL NOT auto-submit login or auto-trigger the OAuth flow; the user must explicitly tap login.
|
||||
|
||||
## Alternatives Considered
|
||||
|
||||
- Keep the one-time homepage bypass: rejected because the post-bind continuation no longer needs to jump directly into the homepage.
|
||||
- Automatically re-run `POST /api/c/v1/auth/wechat-login`: rejected because the requested flow is to require an explicit user-driven re-login.
|
||||
- Pass the identifier through a login-page path that auto-starts login: rejected because the user explicitly wants the identifier preserved without automatic login.
|
||||
|
||||
## Risks / Trade-offs
|
||||
|
||||
- The client must distinguish between restoring an identifier for display and restoring one for automatic login initiation.
|
||||
- The re-login prompt must be one-time or clearly scoped so it does not keep reappearing on unrelated later visits to the login page.
|
||||
|
||||
## Migration Plan
|
||||
|
||||
1. Remove the automatic post-bind wechat-login continuation plan from the active draft.
|
||||
2. Route mandatory bind success back to `pages/login/login`.
|
||||
3. Preserve the identifier so the login input remains prefilled.
|
||||
4. Show the re-login prompt and require a manual login tap.
|
||||
|
||||
## Open Questions
|
||||
|
||||
- Which client-side storage path is the best fit for preserving the identifier while avoiding accidental auto-login behavior on the login page?
|
||||
@@ -0,0 +1,30 @@
|
||||
# Change: Return to login for manual re-login after mandatory phone bind
|
||||
|
||||
## Why
|
||||
|
||||
The current mandatory bind-success continuation either relies on a homepage bypass workaround or on an automatic follow-up login flow. Both approaches make the post-bind path more fragile than necessary. The desired behavior is simpler: after successful mandatory phone binding, return the user to the login page, tell them they need to log in again, preserve the identifier they already entered, and let the user manually tap login.
|
||||
|
||||
## What Changes
|
||||
|
||||
- Return the user to `pages/login/login` after successful phone binding when the bind page was entered from the mandatory login gate
|
||||
- Show a one-time prompt on the login page that phone binding succeeded and re-login is required
|
||||
- Preserve the identifier the user already entered so the login input stays prefilled after returning
|
||||
- Require the user to manually tap login again instead of auto-starting the login flow
|
||||
- Keep the existing non-mandatory bind completion behavior unchanged
|
||||
- Remove dependence on an automatic post-bind wechat-login recheck for this flow
|
||||
- Preserve the current login and bind-phone API contracts without adding backend endpoints
|
||||
|
||||
## Capabilities
|
||||
|
||||
### New Capabilities
|
||||
- `post-bind-manual-relogin`: Define the mandatory post-bind return-to-login and identifier-preservation flow
|
||||
|
||||
### Modified Capabilities
|
||||
- `index-phone-bind-gate`: Allow mandatory bind completion from the login gate to return to login instead of homepage
|
||||
|
||||
## Impact
|
||||
|
||||
- Affected code: `pages/bind/bind.vue`, `pages/login/login.vue`, `pages/index/index.vue`
|
||||
- Affected flow: mandatory phone binding, post-bind routing, login input restoration, manual re-login
|
||||
- No backend API changes
|
||||
- No login or bind-phone response schema changes
|
||||
@@ -0,0 +1,15 @@
|
||||
## MODIFIED Requirements
|
||||
|
||||
### Requirement: Bind completion SHALL remain compatible with homepage entry
|
||||
The system SHALL keep ordinary bind-phone completion compatible with homepage entry while allowing mandatory bind-phone completion from the login gate to return to the login page for a manual re-login.
|
||||
|
||||
#### Scenario: User completes ordinary binding and returns to index
|
||||
- **WHEN** the user completes phone binding successfully after entering the bind page from a later homepage action
|
||||
- **THEN** the system SHALL return the user to `pages/index/index`
|
||||
- **AND** entering `index` afterward SHALL no longer redirect if the account is now bound
|
||||
|
||||
#### Scenario: User completes mandatory binding and returns to login
|
||||
- **WHEN** the user completes phone binding successfully after entering the bind page from the mandatory login gate
|
||||
- **THEN** the system SHALL return the user to `pages/login/login`
|
||||
- **AND** the system SHALL preserve the previously entered identifier for the login input
|
||||
- **AND** the user SHALL manually trigger the next login attempt before the homepage-entry gate is evaluated again
|
||||
@@ -0,0 +1,37 @@
|
||||
## ADDED Requirements
|
||||
|
||||
### Requirement: Mandatory bind completion SHALL return the user to login for manual re-login
|
||||
The system SHALL return the user to `pages/login/login` after successful phone binding when the bind page was entered from the mandatory login gate, and SHALL require an explicit user-driven re-login before continuing.
|
||||
|
||||
#### Scenario: Mandatory bind succeeds and requires manual re-login
|
||||
- **WHEN** the user enters `pages/bind/bind` from the mandatory bind-phone gate
|
||||
- **AND** the user completes phone binding successfully
|
||||
- **THEN** the system SHALL route the user to `pages/login/login` instead of routing directly to `pages/index/index`
|
||||
- **AND** the system SHALL show a prompt that binding succeeded and re-login is required
|
||||
- **AND** the system SHALL wait for the user to explicitly trigger login again
|
||||
|
||||
### Requirement: Login input SHALL preserve the prior identifier without auto-submitting
|
||||
The system SHALL preserve the identifier that the user previously entered before the mandatory bind flow and SHALL restore it into the login input without automatically starting login.
|
||||
|
||||
#### Scenario: Login page restores identifier after mandatory bind success
|
||||
- **WHEN** the user is returned to `pages/login/login` after successful mandatory phone binding
|
||||
- **THEN** the login input SHALL remain populated with the identifier that was entered before the bind flow
|
||||
- **AND** the system SHALL NOT auto-submit login or auto-trigger the OAuth flow only because the identifier was restored
|
||||
- **AND** the user SHALL manually tap the login action to continue
|
||||
|
||||
### Requirement: Mandatory post-bind return SHALL avoid automatic recheck dependencies
|
||||
The system SHALL avoid depending on an automatic post-bind wechat-login recheck for the mandatory bind-success continuation flow.
|
||||
|
||||
#### Scenario: Mandatory bind success does not auto-call wechat-login
|
||||
- **WHEN** the user completes phone binding successfully from the mandatory login gate
|
||||
- **THEN** the system SHALL NOT automatically call `POST /api/c/v1/auth/wechat-login` as the immediate continuation step
|
||||
- **AND** the post-bind continuation SHALL depend on the user re-entering the login flow manually
|
||||
|
||||
### Requirement: Non-mandatory bind completion SHALL keep existing behavior
|
||||
The system SHALL keep the existing non-mandatory bind completion behavior when the bind page was entered from a later homepage action rather than from the mandatory login gate.
|
||||
|
||||
#### Scenario: Ordinary bind completion remains unchanged
|
||||
- **WHEN** the user enters `pages/bind/bind` from a later homepage action rather than the mandatory login gate
|
||||
- **AND** the user completes phone binding successfully
|
||||
- **THEN** the system SHALL keep the current non-mandatory bind completion behavior
|
||||
- **AND** the system SHALL NOT force the user back to `pages/login/login` for that ordinary bind flow
|
||||
@@ -0,0 +1,25 @@
|
||||
## 1. Post-Bind Manual Re-Login
|
||||
|
||||
- [x] 1.1 Route mandatory bind success to `pages/login/login` instead of continuing directly to `pages/index/index`
|
||||
- [x] 1.2 Show a one-time prompt that the user needs to log in again after successful binding
|
||||
- [x] 1.3 Preserve the previously entered identifier so the login input stays prefilled after returning
|
||||
- [x] 1.4 Ensure the restored identifier does not auto-trigger login and the user must manually tap login
|
||||
|
||||
## 2. Flow Compatibility
|
||||
|
||||
- [x] 2.1 Keep the existing non-mandatory bind completion behavior unchanged
|
||||
- [x] 2.2 Remove dependence on automatic post-bind wechat-login continuation
|
||||
- [x] 2.3 Keep the normal homepage bind gate behavior for later homepage entries
|
||||
- [x] 2.4 Remove dependence on a one-time homepage bypass for mandatory bind success
|
||||
|
||||
## 3. API Contract Preservation
|
||||
|
||||
- [x] 3.1 Keep using the existing login and bind-phone API contracts
|
||||
- [x] 3.2 Avoid adding a backend endpoint or changing current response schemas
|
||||
|
||||
## 4. Regression Verification
|
||||
|
||||
- [x] 4.1 Verify mandatory bind success returns to the login page with the identifier still visible
|
||||
- [x] 4.2 Verify the login page shows the re-login prompt after bind success
|
||||
- [x] 4.3 Verify login does not auto-start until the user clicks login
|
||||
- [x] 4.4 Verify ordinary bind entry from homepage actions still follows the current completion path
|
||||
Reference in New Issue
Block a user