113 lines
6.8 KiB
Gherkin
113 lines
6.8 KiB
Gherkin
Feature: Register screen
|
|
|
|
As the first person to set up a fresh RenewCMS install
|
|
I want a /register screen that creates the single owner account via POST /v1/auth/register,
|
|
validates the same rules the API enforces before submitting, and tells me plainly when
|
|
someone already owns this site or the server failed
|
|
So that I can create my account once, land on the verification-pending page, and never see a
|
|
confusing or silent failure
|
|
|
|
Background:
|
|
Given /register is a public route (meta.auth "public") rendered as RegisterPage inside
|
|
AuthShell, per docs/design/routes.md
|
|
And RegisterPage only calls POST /v1/auth/register; it never calls GET /v1/auth/registration
|
|
And the form has a Username field (placeholder "e.g. marta", a live "N / 20" character
|
|
counter, help text "Letters and numbers, 3 to 20 characters. You'll use it to log in."), an
|
|
Email field (placeholder "you@example.com", help text "We'll send a verification link
|
|
here."), and a Password field (a password input with a show/hide toggle and a live
|
|
checklist item "At least 8 characters" that is unmet/error until the rule is satisfied, then
|
|
turns met/green)
|
|
And client-side validation runs on blur of each field and again on submit, before any request
|
|
is sent, using the same rules as the API: Username must be 3 to 20 characters (the API has
|
|
no character-class constraint beyond length, so the client checks length only, matching the
|
|
help text's length claim but not attempting to enforce "letters and numbers" client-side),
|
|
Email must be a well-formed email address, and Password must be at least 8 characters
|
|
And a failing Username shows "Use 3 to 20 characters."; a failing Email shows "Enter a full
|
|
email address, like name@example.com."; a failing Password leaves the checklist item in its
|
|
unmet/error state
|
|
And a valid submit calls POST /v1/auth/register with { username, email, password }
|
|
And on a 200 response, the jwt cookie is set by the server and the app navigates to
|
|
/register/pending without re-resolving the session first
|
|
And a 403 response means someone already verified an owner account (user.ErrRegistrationClosed
|
|
on the backend) and the whole form is replaced by a ResultPanel
|
|
And a 500 response, or a request that never reaches the server, is surfaced as a server/network
|
|
error; the fields keep whatever the user typed and the form re-enables
|
|
And a 400 response is not expected once client-side validation passes, since the client checks
|
|
the same rules as the API; it is out of scope for this slice
|
|
|
|
Scenario: Default — a fresh, empty form
|
|
When the user navigates to /register
|
|
Then the heading is "Create the owner account"
|
|
And the description is "This creates the single admin account for this site. Once it's
|
|
verified, registration closes."
|
|
And the Username field shows placeholder "e.g. marta" with no value and counter "0 / 20"
|
|
And the Email field shows placeholder "you@example.com" with no value
|
|
And the Password field shows no value, with a show/hide toggle and the checklist item
|
|
"At least 8 characters" in its unmet state
|
|
And the submit button reads "Create account"
|
|
And the footer reads "Already set up?" with a "Log in" link to /login
|
|
|
|
Scenario: Validation errors — checked on blur and on submit
|
|
Given the user is on /register
|
|
When the user types "ma" into Username and blurs the field
|
|
Then the Username counter reads "2 / 20" in its error state and the error "Use 3 to 20
|
|
characters." is shown
|
|
When the user types "marta@renew" into Email and blurs the field
|
|
Then the Email field shows the error "Enter a full email address, like name@example.com."
|
|
When the user types "lime" into Password and blurs the field
|
|
Then the checklist item "At least 8 characters" stays in its error state
|
|
When the user submits with these same values
|
|
Then POST /v1/auth/register is never called
|
|
And all three errors from above are still shown
|
|
|
|
Scenario: Filled, valid — every rule is met
|
|
Given the user is on /register
|
|
When the user types "marta" into Username, "marta@renew.example" into Email, and
|
|
"limewash2026" into Password, and reveals the password with the show/hide toggle
|
|
Then the Username counter reads "5 / 20" with no error, and the help text "Letters and
|
|
numbers, 3 to 20 characters. You'll use it to log in." is shown
|
|
And the Email field shows no error, with the help text "We'll send a verification link here."
|
|
And the Password field shows "limewash2026" as plain text and the checklist item "At least 8
|
|
characters" turns to its met/green state
|
|
And the submit button reads "Create account" and is enabled
|
|
|
|
Scenario: Submitting — fields and button are disabled while the request is in flight
|
|
Given the user is on /register with Username "marta", Email "marta@renew.example", and
|
|
Password "limewash2026"
|
|
When the user submits and POST /v1/auth/register has not yet resolved
|
|
Then the Username, Email and Password fields are disabled
|
|
And the submit button reads "Creating account…" and shows a loading state
|
|
|
|
Scenario: Registration closed — the form is replaced by a ResultPanel
|
|
Given the user is on /register with Username "marta", Email "marta@renew.example", and
|
|
Password "limewash2026"
|
|
When the user submits and POST /v1/auth/register resolves 403
|
|
Then the form, its fields and the footer are no longer shown
|
|
And a ResultPanel with tone "info" and icon "user-x" is shown instead, with title "This site
|
|
already has an owner" and text "Log in instead."
|
|
And its single action is a primary button "Go to log in"
|
|
When the user activates "Go to log in"
|
|
Then the app navigates to /login
|
|
|
|
Scenario Outline: Server or network error — the form is kept and re-enabled
|
|
Given the user is on /register with Username "marta", Email "marta@renew.example", and
|
|
Password "limewash2026"
|
|
When the user submits and POST /v1/auth/register <failure>
|
|
Then an error alert reads "Couldn't create the account" with description "Something went
|
|
wrong on the server. Try again in a moment."
|
|
And the Username field still shows "marta", the Email field still shows "marta@renew.example",
|
|
and the Password field still shows "limewash2026"
|
|
And the Username, Email and Password fields are re-enabled
|
|
And the submit button reads "Create account" again, no longer loading
|
|
|
|
Examples:
|
|
| failure |
|
|
| fails with a 500 response |
|
|
| never reaches the server |
|
|
|
|
Scenario: A successful registration goes straight to the pending page
|
|
Given the user is on /register with Username "marta", Email "marta@renew.example", and
|
|
Password "limewash2026"
|
|
When the user submits and POST /v1/auth/register resolves 200 with a jwt cookie
|
|
Then the app navigates to /register/pending
|