Login sahifasi (audience=web) + token saqlash + must_change_password

team-lead-ep-09 yangiladi

Yangilandi: estimate_hours

finalize-ep-09 yangiladi

Yangilandi: pr_url

finalize-ep-09 yangiladi

Yangilandi: branch, commit_sha

qa-ep-09-t07-s01 qabul mezonini belgiladi

✓ Mock (:4010) ga qarshi barcha yo'llar ishlaydi

qa-ep-09-t07-s01 izoh qoldirdi

QA 2-aylanish — AC803 qayta tekshirildi va TASDIQLANDI. base.ts: API_BASE_URL = `${VITE_API_BASE_URL}/v1` markazlashtirilgan; client.ts (apiClient) va base.ts (authHttp) ikkalasi ham shu bitta konstantadan o’qiydi (grep bilan tasdiqlandi — VITE_API_BASE_URL faqat base.ts da ishlatiladi). Live curl: POST http://127.0.0.1:4010/api/v1/auth/login -> 200 (mock ishlayapti, kontrakt yo’li to’g’ri). Solishtirish uchun eski noto’g’ri yo’l /api/auth/login -> 404 (kodda bu yo’l endi ishlatilmaydi, grep tasdiqladi — auth.api.ts /auth/login deb yozadi, /v1 ni authHttp.baseURL markazdan qo’shadi). .env.example izohi aniq: /v1 qiymatga qo’shilmaydi, base.ts qo’shadi. Regressiya: npm test -> 56/56 test, 10 fayl (jumladan avvalgi QA yozgan LoginView.spec.ts, ChangePasswordView.spec.ts) — yashil. npm run build (vue-tsc -b --noEmit && vite build) — yashil, xatosiz. AC799-802 avvalgi aylanishda tekshirilgan, bu safar regressiya yo’q. Barcha 5 mezon tasdiqlandi -> done.

qa-ep-09-t07-s01 statusni o'zgartirdi Review → Bajarildi

coder-ep-09-t07-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-09-t07-s01 fayllarni qayd etdi

2 ta fayl qayd etildi

coder-ep-09-t07-s01 qabul mezonini belgiladi

✓ Mock (:4010) ga qarshi barcha yo'llar ishlaydi

qa-ep-09-t07-s01 fayllarni qayd etdi

2 ta fayl qayd etildi

qa-ep-09-t07-s01 statusni o'zgartirdi Review → Ishlanyapti

qa-ep-09-t07-s01 qabul mezonini belgiladi

✗ Mock (:4010) ga qarshi barcha yo'llar ishlaydi

qa-ep-09-t07-s01 qabul mezonini belgiladi

✓ Parol almashtirilgach oddiy oqim ochiladi

qa-ep-09-t07-s01 qabul mezonini belgiladi

✓ `423` da qulf sababi ko'rsatilmaydi

qa-ep-09-t07-s01 qabul mezonini belgiladi

✓ `401` va hamkor rad etilishi UI'da FARQLANMAYDI (bir xil matn)

qa-ep-09-t07-s01 qabul mezonini belgiladi

✓ Login muvaffaqiyatli bo'lsa dashboard'ga, `must_change_password` bo'lsa parol ekraniga yo'naltiriladi

coder-ep-09-t07-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-09-t07-s01 izoh qoldirdi

Amalga oshirildi: LoginView.vue (username/parol -> POST /auth/login, audience=web) + yangi ChangePasswordView.vue + route /parolni-almashtirish + router guard'ga mustChangePassword gate. Muhim qarorlar: 1) Token saqlash (kontraktga mos): access+refresh ikkalasi ham localStorage'da (mavjud EP-01-T02-S02 yondashuvi saqlab qolindi). httpOnly cookie qo'llanmadi -- LoginResponse tokenlarni JSON tanada qaytaradi (Set-Cookie yo'q, auth.yaml), ya'ni klient JS orqali haqiqiy httpOnly cookie hech qachon o'rnata olmaydi; demak yagona kontraktga mos variant client-side storage. Access'ni faqat xotirada tutish qo'shimcha XSS himoyasi bermaydi (skript store holatini o'qiy olsa localStorage'ni ham o'qiydi), shuning uchun ikkala token ham bir xil joyda; xavf ikki qatlam bilan yumshatiladi: access 15 daq TTL + refresh rotation/reuse-detection (R26). 2) mustChangePassword (LoginResponse.must_change_password) auth store'da localStorage'ga ham yoziladi -- sahifa qayta yuklansa router guard baribir change-password'dan boshqa yerga qo'ymasin deb (backend baribir 403 PASSWORD_CHANGE_REQUIRED qaytaradi, bu shunchaki UI aksi). 3) POST /auth/change-password muvaffaqiyati (204) kontraktga ko'ra BARCHA sessiyani (joriysi ham) yopadi (R27) -- shuning uchun changePassword() action muvaffaqiyatdan keyin darhol clearSession() qiladi va foydalanuvchi /login?password_changed=1 ga qaytariladi (AC802 "oddiy oqim" = qayta oddiy login, App ichida qolinmaydi). 4) 401 INVALID_CREDENTIALS uchun server matni to'g'ridan-to'g'ri ko'rsatiladi (backend allaqachon R48 niqobini ta'minlaydi -- hamkor/mijoz va noto'g'ri parol AYNAN bir xil kod+matn beradi, frontendda ikkinchi shoxlanish yo'q). 423 ACCOUNT_LOCKED uchun UI'da sobit matn ("Ko'p urinish. 15 daqiqadan keyin qayta urinib ko'ring.") ishlatiladi -- qulf sababi (IP/akkaunt) ko'rsatilmaydi. 5) Barcha yo'llar (login 200/401/423, change-password 204/401/400) Prism mock (:4010, auth.yaml asosida) ga qarshi curl bilan tasdiqlangan, so'ng unit testlarda AYNAN shu javob shakllari bilan qoplandi (installMockAdapter). Real brauzer/E2E ishlatilmadi -- TS-tip xavfsizligi (LoginResponse/ChangePasswordRequest kontraktdan) + curl+unit test qoplovi bilan tekshirildi. npm run lint / npm run build (vue-tsc) / npm test -- hammasi toza (49/49 test o'tdi).

coder-ep-09-t07-s01 qabul mezonini belgiladi

✓ Mock (:4010) ga qarshi barcha yo'llar ishlaydi

coder-ep-09-t07-s01 qabul mezonini belgiladi

✓ Parol almashtirilgach oddiy oqim ochiladi

coder-ep-09-t07-s01 qabul mezonini belgiladi

✓ `423` da qulf sababi ko'rsatilmaydi

coder-ep-09-t07-s01 qabul mezonini belgiladi

✓ `401` va hamkor rad etilishi UI'da FARQLANMAYDI (bir xil matn)

coder-ep-09-t07-s01 qabul mezonini belgiladi

✓ Login muvaffaqiyatli bo'lsa dashboard'ga, `must_change_password` bo'lsa parol ekraniga yo'naltiriladi

coder-ep-09-t07-s01 fayllarni qayd etdi

10 ta fayl qayd etildi

coder-ep-09-t07-s01 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-09-t07-s01 ishga oldi

pm-agent yaratdi

Login sahifasi (audience=web) + token saqlash + must_change_password