From 5f0d717b60338e6a325aa4ba7ab55fb9f148abf0 Mon Sep 17 00:00:00 2001 From: Ben Stull Date: Wed, 10 Jun 2026 10:15:23 -0700 Subject: [PATCH] update ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md --- ...TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md | 29 ++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md b/ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md index 7ccb80b..f6be04f 100644 --- a/ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md +++ b/ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md @@ -12,7 +12,34 @@ ## Launch prompt -_(launch prompt not captured at claim time)_ +`/goal Implement SLICE-2 (identity) of SD-0001 v0.3.0 — accounts domain (email + +one-time-code request-code/verify per INV-2/INV-3, signed-cookie sessions, +/api/auth/me + logout), platform/mailer port with LogMailer, Landing + Sign-in +screens, entry routing with storefront hard-wired null — per SD-0001 §7.2 (SLICE-2)` + +## Plan + +> Anchor: design `wiggleverse-ecomm-content/specs/SD-0001-mvp-sign-up-and-single-storefront.md` +> (v0.3.0, status `graduated` — R2a eligible; plan-eligibility gate passes). + +**SLICE-2 — Identity** (SD-0001 §7.2). Builds on the SLICE-1 walking skeleton +(merged to `origin/main` @ 9373177). Branch: `slice-2-identity` off `main`. + +Ships: +- `accounts` domain — request-code / verify / sessions / `/me` / logout + (§6.4–6.5), enforcing INV-2 (email canonical key) and INV-3 (OTC handled like + a secret: hashed, 10-min expiry, single-use, ≤5 attempts, 60s resend cooldown). +- `platform/mailer` port (`send(to, subject, body)`) with `LogMailer` adapter. +- `platform/session` — signed HTTP-only cookie sessions (server secret from + config, INV-8; no session table, §6.2). +- REST BFF auth endpoints in `main.py`: `POST /api/auth/request-code`, + `POST /api/auth/verify`, `GET /api/auth/me`, `POST /api/auth/logout`. +- Frontend: Landing + Sign-in (two-step) screens, entry-routing rule with + `storefront` hard-wired `null` (storefronts land in SLICE-3). + +DoD: BUC-1/BUC-2 acceptance end-to-end on localhost; scenario tests for +14.01.0001–0004, 0009–0011, PUC-2a/b/c, PUC-9; INV-2/INV-3 invariant tests; +no-enumeration uniform-204 asserted. `scripts/check.sh` green; merge + version bump. ## Deferred decisions