ui phase 3

2026-07-18 01:56:17 +03:30
parent 222856d600
commit 53b4e1b0a4
33 changed files with 1000 additions and 81 deletions
@@ -601,3 +601,22 @@ delivers fixes in its own change. **Frontend never edits backend code to "fix" a
  `demo_partner_*` phone user linked as its admin) so the actor is reachable end-to-end like the others.
 - **Status:** open (partner login-routing deferred; `/partner` reachable by direct nav + the partnerCenter mock)
 - **Status:** open
+
+## REQ-039 — WebOTP-conformant OTP SMS template — filed by ui-phase-3 — 2026-07-17
+- **Need:** the OTP SMS body must end with the origin-bound last line `@<domain> #<code>` (the
+  [WebOTP](https://web.dev/articles/web-otp) / origin-bound one-time-code convention), e.g.:
+  ```
+  کد ورود بالین‌یار: 123456
+  @balinyaar.com #123456
+  ```
+  This is a server/SMS-template change on the Kavenegar adapter (refinement-phase-8) — zero API-shape impact,
+  just the text body the SMS gateway sends.
+- **Why:** the client now feature-detects `'OTPCredential' in window` and calls
+  `navigator.credentials.get({ otp: { transport: ['sms'] } })` (`components/auth/useWebOtp.ts`, wired into
+  `OtpStep`) plus `autoComplete="one-time-code"` on every OTP box (`OtpInput.tsx`) — but Chrome's WebOTP API
+  and the iOS/Android keyboard "from SMS" suggestion only auto-read a code when the SMS ends with this exact
+  origin-bound line. Without it, the client work still ships (autoComplete alone helps on iOS/some Android
+  keyboards) but silently degrades to manual entry everywhere.
+- **Proposed shape:** append `\n@<domain> #<code>` as the SMS's last line, where `<domain>` is the site's own
+  host (no scheme, no trailing slash) and `<code>` is the exact code the user must enter.
+- **Status:** open — client-side WebOTP wiring ships regardless and degrades gracefully until this lands.