add stories
This commit is contained in:
@@ -0,0 +1,24 @@
|
||||
# Multi-Device Login Sessions
|
||||
|
||||
**ID:** EU-001
|
||||
**Priority:** High
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to stay logged in on multiple devices simultaneously so that I can access my account from my phone, tablet, and computer without being logged out elsewhere.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can have active sessions on multiple devices at the same time
|
||||
- [ ] Each device gets its own refresh token
|
||||
- [ ] Logging out on one device does not affect sessions on other devices
|
||||
- [ ] User can see all active sessions in account settings
|
||||
- [ ] User can revoke individual sessions remotely
|
||||
|
||||
## Technical Notes
|
||||
- Currently only one refresh token per login session is supported
|
||||
- Need to refactor `LoginSession` to support multiple refresh tokens
|
||||
- Consider storing device metadata (browser, OS, last active time) with each token
|
||||
- JWT blocklist needs to handle individual token revocation
|
||||
|
||||
## Related TODOs
|
||||
- `ts/reception/classes.jwt.ts:39` - `// TODO: handle multiple refresh tokens`
|
||||
@@ -0,0 +1,26 @@
|
||||
# Complete Password Reset Flow
|
||||
|
||||
**ID:** EU-002
|
||||
**Priority:** Critical
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to reset my password when I forget it so that I can regain access to my account securely.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can request a password reset via email
|
||||
- [ ] Reset email contains a secure, time-limited token link
|
||||
- [ ] Clicking the link opens a form to set a new password
|
||||
- [ ] Password must meet security requirements (length, complexity)
|
||||
- [ ] Old password is invalidated after successful reset
|
||||
- [ ] User receives confirmation email after password change
|
||||
- [ ] All existing sessions are invalidated after password reset
|
||||
|
||||
## Technical Notes
|
||||
- `resetPassword` handler exists but `setNewPassword` is a stub (returns `{ status: 'ok' }` without implementation)
|
||||
- Need to implement actual password update logic
|
||||
- Should use `ReceptionMailer` for email sending
|
||||
- Consider rate limiting reset requests to prevent abuse
|
||||
|
||||
## Related TODOs
|
||||
- `ts/reception/classes.loginsessionmanager.ts:229-238` - `setNewPassword` handler is incomplete
|
||||
@@ -0,0 +1,25 @@
|
||||
# View and Manage Logged-in Devices
|
||||
|
||||
**ID:** EU-003
|
||||
**Priority:** Medium
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to view all devices where I'm logged in and remotely log out of specific devices so that I can maintain control over my account security.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can view a list of all active sessions/devices
|
||||
- [ ] Each device entry shows: device type, browser, location (approximate), last activity
|
||||
- [ ] User can name/label devices for easy identification
|
||||
- [ ] User can log out of any individual device remotely
|
||||
- [ ] User can log out of all devices except the current one
|
||||
- [ ] User receives notification when a new device logs in
|
||||
|
||||
## Technical Notes
|
||||
- Device ID tracking infrastructure exists but is blocked by JWT handling issues
|
||||
- Need to complete `attachDeviceId` handler (currently returns `ok: false`)
|
||||
- Store device fingerprint, user agent, IP-based geolocation
|
||||
- Integrate with multi-refresh-token system (EU-001)
|
||||
|
||||
## Related TODOs
|
||||
- `ts/reception/classes.loginsessionmanager.ts:256` - `// TODO: Blocked by proper JWT handling`
|
||||
@@ -0,0 +1,27 @@
|
||||
# Enable Two-Factor Authentication
|
||||
|
||||
**ID:** EU-004
|
||||
**Priority:** High
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to enable two-factor authentication on my account so that my account is protected even if my password is compromised.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can enable 2FA from account settings
|
||||
- [ ] Support for TOTP apps (Google Authenticator, Authy, etc.)
|
||||
- [ ] Backup codes are generated and shown once during setup
|
||||
- [ ] User must verify 2FA code during setup to confirm it works
|
||||
- [ ] Login flow prompts for 2FA code when enabled
|
||||
- [ ] User can disable 2FA (requires current 2FA code)
|
||||
- [ ] Account recovery option if 2FA device is lost
|
||||
|
||||
## Technical Notes
|
||||
- Mobile verification infrastructure exists (SMS OTP in registration)
|
||||
- Can leverage existing `smarttwilio` integration for SMS-based 2FA
|
||||
- TOTP implementation needs `otplib` or similar library
|
||||
- Store encrypted TOTP secret in User model
|
||||
- Consider supporting multiple 2FA methods (TOTP, SMS, security keys)
|
||||
|
||||
## Related TODOs
|
||||
- New feature - no existing TODO
|
||||
@@ -0,0 +1,28 @@
|
||||
# Login with Social Providers
|
||||
|
||||
**ID:** EU-005
|
||||
**Priority:** Medium
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to log in using my existing Google, GitHub, or Microsoft account so that I don't have to remember another password.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can sign in with Google
|
||||
- [ ] User can sign in with GitHub
|
||||
- [ ] User can sign in with Microsoft
|
||||
- [ ] First-time social login creates a new account automatically
|
||||
- [ ] Social login can be linked to existing account
|
||||
- [ ] User can unlink social providers from settings
|
||||
- [ ] Profile data (name, email, avatar) is imported from provider
|
||||
- [ ] User can still set a password for email/password login
|
||||
|
||||
## Technical Notes
|
||||
- Package.json keywords mention OAuth - infrastructure may be partially planned
|
||||
- Implement OAuth 2.0 / OpenID Connect flows
|
||||
- Store provider tokens securely for API access if needed
|
||||
- Handle email conflicts (social email matches existing account)
|
||||
- Consider using passport.js or similar for provider abstraction
|
||||
|
||||
## Related TODOs
|
||||
- New feature - OAuth mentioned in package.json keywords but not implemented
|
||||
@@ -0,0 +1,28 @@
|
||||
# Delete My Account
|
||||
|
||||
**ID:** EU-006
|
||||
**Priority:** Medium
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to permanently delete my account and all associated data so that I can exercise my right to be forgotten (GDPR compliance).
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can request account deletion from settings
|
||||
- [ ] Deletion requires password confirmation or 2FA
|
||||
- [ ] User sees summary of what will be deleted
|
||||
- [ ] Grace period (e.g., 30 days) before permanent deletion
|
||||
- [ ] User receives email confirmation of deletion request
|
||||
- [ ] User can cancel deletion during grace period
|
||||
- [ ] All personal data is removed after grace period
|
||||
- [ ] User is removed from all organizations they belong to
|
||||
|
||||
## Technical Notes
|
||||
- `suspendUser` and `deleteSuspendedUser` endpoints exist in admin context
|
||||
- Need user-facing self-service deletion flow
|
||||
- Consider soft delete with scheduled hard delete
|
||||
- Must handle organization ownership transfer if user owns orgs
|
||||
- Audit log should retain anonymized record for compliance
|
||||
|
||||
## Related TODOs
|
||||
- New feature - builds on existing suspension infrastructure
|
||||
@@ -0,0 +1,26 @@
|
||||
# View Login History
|
||||
|
||||
**ID:** EU-007
|
||||
**Priority:** Low
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to view my login history so that I can detect any unauthorized access to my account.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can view list of recent logins (last 30 days)
|
||||
- [ ] Each entry shows: date/time, IP address, location, device/browser
|
||||
- [ ] Failed login attempts are also shown
|
||||
- [ ] Suspicious logins are highlighted (new location, unusual time)
|
||||
- [ ] User can export login history
|
||||
- [ ] User receives alert for logins from new locations/devices
|
||||
|
||||
## Technical Notes
|
||||
- Login events need to be logged with metadata
|
||||
- Create new LoginHistory collection in MongoDB
|
||||
- IP geolocation service needed (consider MaxMind or ipinfo.io)
|
||||
- Privacy considerations: IP retention policy, GDPR compliance
|
||||
- Could integrate with EU-003 (device management) for unified view
|
||||
|
||||
## Related TODOs
|
||||
- New feature - no existing infrastructure
|
||||
@@ -0,0 +1,28 @@
|
||||
# Upload Profile Avatar
|
||||
|
||||
**ID:** EU-008
|
||||
**Priority:** Low
|
||||
**Status:** Planned
|
||||
|
||||
## User Story
|
||||
As an end user, I want to upload a profile picture so that my identity is visually recognizable across applications that use this identity provider.
|
||||
|
||||
## Acceptance Criteria
|
||||
- [ ] User can upload an image from their device
|
||||
- [ ] Supported formats: JPEG, PNG, GIF
|
||||
- [ ] Maximum file size: 5MB
|
||||
- [ ] Image is automatically resized/cropped to standard dimensions
|
||||
- [ ] User can crop/adjust image before saving
|
||||
- [ ] Avatar is served via CDN for fast loading
|
||||
- [ ] Default avatar (initials or Gravatar) when no upload
|
||||
- [ ] Avatar is available to connected applications via API
|
||||
|
||||
## Technical Notes
|
||||
- User model needs avatar URL field
|
||||
- Consider using cloud storage (S3, Cloudflare R2) for images
|
||||
- Implement image processing for resize/crop (sharp library)
|
||||
- Gravatar integration as fallback using email hash
|
||||
- Expose avatar in JWT claims or user info endpoint
|
||||
|
||||
## Related TODOs
|
||||
- New feature - no existing infrastructure
|
||||
Reference in New Issue
Block a user