34 lines
1.9 KiB
Markdown
34 lines
1.9 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Self-Service Password Change Entry
|
|
|
|
The authenticated admin interface SHALL provide a password-change entry in the avatar menu between “个人中心” and “锁定屏幕”. The entry SHALL be available to every authenticated user without a frontend route, button, or menu permission check.
|
|
|
|
#### Scenario: User opens password-change form from avatar menu
|
|
|
|
- **GIVEN** the user is authenticated in the admin interface
|
|
- **WHEN** the user opens the avatar menu
|
|
- **THEN** the menu shows “个人中心”, “修改密码”, and “锁定屏幕” in that order
|
|
- **AND** selecting “修改密码” opens the password-change form
|
|
- **AND** the entry is not hidden or disabled based on a permission code
|
|
|
|
### Requirement: Change Current User Password
|
|
|
|
The password-change form SHALL collect the current password and new password, and SHALL submit them through `PUT /api/auth/password` using the current Bearer token. The request body MUST contain exactly the API fields `old_password` and `new_password`; any confirmation value used for client-side validation MUST NOT be sent. Password values MUST NOT be written to application logs.
|
|
|
|
#### Scenario: Password change succeeds
|
|
|
|
- **GIVEN** the user has entered a current password and matching new-password values
|
|
- **WHEN** the user submits the form and the API returns success
|
|
- **THEN** the frontend sends `old_password` and `new_password` to `PUT /api/auth/password`
|
|
- **AND** the frontend displays success feedback and clears the password form values
|
|
- **AND** the frontend clears the local authentication state and redirects the user to the login page
|
|
- **AND** the user must authenticate again with the new password
|
|
|
|
#### Scenario: Password change is rejected
|
|
|
|
- **GIVEN** the user submits the password-change form
|
|
- **WHEN** the API rejects the request
|
|
- **THEN** the frontend displays error feedback and does not report success
|
|
- **AND** the frontend does not log any password value
|