add stories

This commit is contained in:
2025-11-30 15:01:28 +00:00
parent c8b8013200
commit 014fb3080a
35 changed files with 6282 additions and 3590 deletions
@@ -0,0 +1,24 @@
# Multi-Device Login Sessions
**ID:** EU-001
**Priority:** High
**Status:** Planned
## User Story
As an end user, I want to stay logged in on multiple devices simultaneously so that I can access my account from my phone, tablet, and computer without being logged out elsewhere.
## Acceptance Criteria
- [ ] User can have active sessions on multiple devices at the same time
- [ ] Each device gets its own refresh token
- [ ] Logging out on one device does not affect sessions on other devices
- [ ] User can see all active sessions in account settings
- [ ] User can revoke individual sessions remotely
## Technical Notes
- Currently only one refresh token per login session is supported
- Need to refactor `LoginSession` to support multiple refresh tokens
- Consider storing device metadata (browser, OS, last active time) with each token
- JWT blocklist needs to handle individual token revocation
## Related TODOs
- `ts/reception/classes.jwt.ts:39` - `// TODO: handle multiple refresh tokens`
+26
View File
@@ -0,0 +1,26 @@
# Complete Password Reset Flow
**ID:** EU-002
**Priority:** Critical
**Status:** Planned
## User Story
As an end user, I want to reset my password when I forget it so that I can regain access to my account securely.
## Acceptance Criteria
- [ ] User can request a password reset via email
- [ ] Reset email contains a secure, time-limited token link
- [ ] Clicking the link opens a form to set a new password
- [ ] Password must meet security requirements (length, complexity)
- [ ] Old password is invalidated after successful reset
- [ ] User receives confirmation email after password change
- [ ] All existing sessions are invalidated after password reset
## Technical Notes
- `resetPassword` handler exists but `setNewPassword` is a stub (returns `{ status: 'ok' }` without implementation)
- Need to implement actual password update logic
- Should use `ReceptionMailer` for email sending
- Consider rate limiting reset requests to prevent abuse
## Related TODOs
- `ts/reception/classes.loginsessionmanager.ts:229-238` - `setNewPassword` handler is incomplete
@@ -0,0 +1,25 @@
# View and Manage Logged-in Devices
**ID:** EU-003
**Priority:** Medium
**Status:** Planned
## User Story
As an end user, I want to view all devices where I'm logged in and remotely log out of specific devices so that I can maintain control over my account security.
## Acceptance Criteria
- [ ] User can view a list of all active sessions/devices
- [ ] Each device entry shows: device type, browser, location (approximate), last activity
- [ ] User can name/label devices for easy identification
- [ ] User can log out of any individual device remotely
- [ ] User can log out of all devices except the current one
- [ ] User receives notification when a new device logs in
## Technical Notes
- Device ID tracking infrastructure exists but is blocked by JWT handling issues
- Need to complete `attachDeviceId` handler (currently returns `ok: false`)
- Store device fingerprint, user agent, IP-based geolocation
- Integrate with multi-refresh-token system (EU-001)
## Related TODOs
- `ts/reception/classes.loginsessionmanager.ts:256` - `// TODO: Blocked by proper JWT handling`
@@ -0,0 +1,27 @@
# Enable Two-Factor Authentication
**ID:** EU-004
**Priority:** High
**Status:** Planned
## User Story
As an end user, I want to enable two-factor authentication on my account so that my account is protected even if my password is compromised.
## Acceptance Criteria
- [ ] User can enable 2FA from account settings
- [ ] Support for TOTP apps (Google Authenticator, Authy, etc.)
- [ ] Backup codes are generated and shown once during setup
- [ ] User must verify 2FA code during setup to confirm it works
- [ ] Login flow prompts for 2FA code when enabled
- [ ] User can disable 2FA (requires current 2FA code)
- [ ] Account recovery option if 2FA device is lost
## Technical Notes
- Mobile verification infrastructure exists (SMS OTP in registration)
- Can leverage existing `smarttwilio` integration for SMS-based 2FA
- TOTP implementation needs `otplib` or similar library
- Store encrypted TOTP secret in User model
- Consider supporting multiple 2FA methods (TOTP, SMS, security keys)
## Related TODOs
- New feature - no existing TODO
+28
View File
@@ -0,0 +1,28 @@
# Login with Social Providers
**ID:** EU-005
**Priority:** Medium
**Status:** Planned
## User Story
As an end user, I want to log in using my existing Google, GitHub, or Microsoft account so that I don't have to remember another password.
## Acceptance Criteria
- [ ] User can sign in with Google
- [ ] User can sign in with GitHub
- [ ] User can sign in with Microsoft
- [ ] First-time social login creates a new account automatically
- [ ] Social login can be linked to existing account
- [ ] User can unlink social providers from settings
- [ ] Profile data (name, email, avatar) is imported from provider
- [ ] User can still set a password for email/password login
## Technical Notes
- Package.json keywords mention OAuth - infrastructure may be partially planned
- Implement OAuth 2.0 / OpenID Connect flows
- Store provider tokens securely for API access if needed
- Handle email conflicts (social email matches existing account)
- Consider using passport.js or similar for provider abstraction
## Related TODOs
- New feature - OAuth mentioned in package.json keywords but not implemented
@@ -0,0 +1,28 @@
# Delete My Account
**ID:** EU-006
**Priority:** Medium
**Status:** Planned
## User Story
As an end user, I want to permanently delete my account and all associated data so that I can exercise my right to be forgotten (GDPR compliance).
## Acceptance Criteria
- [ ] User can request account deletion from settings
- [ ] Deletion requires password confirmation or 2FA
- [ ] User sees summary of what will be deleted
- [ ] Grace period (e.g., 30 days) before permanent deletion
- [ ] User receives email confirmation of deletion request
- [ ] User can cancel deletion during grace period
- [ ] All personal data is removed after grace period
- [ ] User is removed from all organizations they belong to
## Technical Notes
- `suspendUser` and `deleteSuspendedUser` endpoints exist in admin context
- Need user-facing self-service deletion flow
- Consider soft delete with scheduled hard delete
- Must handle organization ownership transfer if user owns orgs
- Audit log should retain anonymized record for compliance
## Related TODOs
- New feature - builds on existing suspension infrastructure
@@ -0,0 +1,26 @@
# View Login History
**ID:** EU-007
**Priority:** Low
**Status:** Planned
## User Story
As an end user, I want to view my login history so that I can detect any unauthorized access to my account.
## Acceptance Criteria
- [ ] User can view list of recent logins (last 30 days)
- [ ] Each entry shows: date/time, IP address, location, device/browser
- [ ] Failed login attempts are also shown
- [ ] Suspicious logins are highlighted (new location, unusual time)
- [ ] User can export login history
- [ ] User receives alert for logins from new locations/devices
## Technical Notes
- Login events need to be logged with metadata
- Create new LoginHistory collection in MongoDB
- IP geolocation service needed (consider MaxMind or ipinfo.io)
- Privacy considerations: IP retention policy, GDPR compliance
- Could integrate with EU-003 (device management) for unified view
## Related TODOs
- New feature - no existing infrastructure
+28
View File
@@ -0,0 +1,28 @@
# Upload Profile Avatar
**ID:** EU-008
**Priority:** Low
**Status:** Planned
## User Story
As an end user, I want to upload a profile picture so that my identity is visually recognizable across applications that use this identity provider.
## Acceptance Criteria
- [ ] User can upload an image from their device
- [ ] Supported formats: JPEG, PNG, GIF
- [ ] Maximum file size: 5MB
- [ ] Image is automatically resized/cropped to standard dimensions
- [ ] User can crop/adjust image before saving
- [ ] Avatar is served via CDN for fast loading
- [ ] Default avatar (initials or Gravatar) when no upload
- [ ] Avatar is available to connected applications via API
## Technical Notes
- User model needs avatar URL field
- Consider using cloud storage (S3, Cloudflare R2) for images
- Implement image processing for resize/crop (sharp library)
- Gravatar integration as fallback using email hash
- Expose avatar in JWT claims or user info endpoint
## Related TODOs
- New feature - no existing infrastructure