MOB-06 — Authentication flows (both apps)

SummaryCopy Anchor Link

Guest mode (browse without prices), reseller welcome, sign-up with OTP, customer type and account claim, pending-validation screen, sign-in, forgot password; delegate sign-in and reset; session restore and status gating.

DescriptionCopy Anchor Link

Every reseller and delegate journey starts here, and the 17 Oct decisions change it: the reseller app can be browsed as a guest with prices hidden (AUTH-10, RA-41), and sign-up declares the customer type (SUPER_GROS, DEMI_GROS, DETAIL) that later selects the price (AUTH-11). Scope: reseller welcome (sign in, sign up, browse as guest), the guest price lock and sign-up prompts, sign-up with phone + optional invitation code, OTP, store details with customer type and password, the account-claim path for prospects created in the field (AUTH-05), pending/rejected screens, sign-in, forgot password; delegate sign-in (suspended message) and reset; session restore and status gating in both apps. It uses auth.*, me.get, reference.wilayas|communes|lists and invitations.resolve, and needs SRV-05 behaviour on staging or Prism examples from Anis plus Akram's DES-06 and DES-11 frames. MRA-01…MRA-10 rely on the session/guest state set here, MRA-09 prefills the invitation code, and MOB-08 registers the device after sign-in.

SubtasksCopy Anchor Link

DeliverablesCopy Anchor Link

• apps/reseller/lib/src/features/auth/ (welcome, guest, sign-up, otp, store details, pending, sign-in, forgot password)
• apps/delegate/lib/src/features/auth/ (sign-in, forgot password)
• packages/hoco_core/lib/src/session/session_controller.dart
• integration_test/auth_flow_test.dart in both apps
• Firebase App Distribution build 0.1.0 (staging) of both apps for Akram and Anis

Acceptance criteriaCopy Anchor Link

• A guest browses home, catalog, product pages and promotions; no price is ever displayed and nothing can be added to the cart (AUTH-10)
• Sign-up cannot be submitted without a customer type; the created reseller has that customerType and sees its prices right after sign-up while checkout returns ACCOUNT_PENDING_VALIDATION until validation (AUTH-03, AUTH-11)
• A phone already attached to a field prospect goes through CLAIM and does not create a second reseller; an EXISTING_ACCOUNT phone is redirected to sign-in / reset (AUTH-05, CRM-03)
• OTP resend is disabled for 60 s and each OTP error code shows its own message (AUTH-07)
• A suspended delegate or reseller gets an explicit « compte suspendu » message and no session; a reseller in the delegate app gets APP_NOT_ALLOWED (AUTH-02, AUTH-08)
• After a kill and relaunch the session is restored without re-entering credentials; an expired session lands on sign-in

Requirements coveredCopy Anchor Link

ScreensCopy Anchor Link

API surfaceCopy Anchor Link

Test measuresCopy Anchor Link

• integration_test of guest → sign-up (NEW) → pending → browse with prices against Prism examples
• Widget tests of each OTP and sign-in error state and of the CLAIM / EXISTING_ACCOUNT branches
• Unit tests of SessionController transitions (guest → signedIn, status change from me.get)

RisksCopy Anchor Link

• The 'prices before validation' decision may flip — read it from a flag (appConfig public settings) so the change needs no release
• SMS delivery delays in Algeria make users resend too early — show the countdown and the masked phone clearly, and keep the code valid for its full 5 minutes

KPICopy Anchor Link

• Delivered by Wed 28 Oct 2026 within 1.75 person-day(s).
• Every acceptance criterion above demonstrated before hand-off; linked requirements' acceptance criteria pass.
• Zero open critical defects, permission gaps or data-integrity regressions at sign-off.

---

Generated from content/plan/tasks.json by scripts/generate-team-tasks.mjs. Dates are computed by the scheduler (Sunday–Thursday weeks, holidays excluded) — change the plan, not this page.