one-pipe-system/openspec/changes/add-self-service-password-change/specs/admin-authentication/spec.md

ADDED Requirements

Requirement: Self-Service Password Change Entry

The authenticated admin interface SHALL provide a password-change entry in the avatar menu between “个人中心” and “锁定屏幕”. The entry SHALL be available to every authenticated user without a frontend route, button, or menu permission check.

Scenario: User opens password-change form from avatar menu

• GIVEN the user is authenticated in the admin interface
• WHEN the user opens the avatar menu
• THEN the menu shows “个人中心”, “修改密码”, and “锁定屏幕” in that order
• AND selecting “修改密码” opens the password-change form
• AND the entry is not hidden or disabled based on a permission code

Requirement: Change Current User Password

The password-change form SHALL collect the current password and new password, and SHALL submit them through PUT /api/auth/password using the current Bearer token. The request body MUST contain exactly the API fields old_password and new_password; any confirmation value used for client-side validation MUST NOT be sent. Password values MUST NOT be written to application logs.

Scenario: Password change succeeds

• GIVEN the user has entered a current password and matching new-password values
• WHEN the user submits the form and the API returns success
• THEN the frontend sends old_password and new_password to PUT /api/auth/password
• AND the frontend displays success feedback and clears the password form values
• AND the frontend clears the local authentication state and redirects the user to the login page
• AND the user must authenticate again with the new password

Scenario: Password change is rejected

• GIVEN the user submits the password-change form
• WHEN the API rejects the request
• THEN the frontend displays error feedback and does not report success
• AND the frontend does not log any password value