User Stories and Acceptance Criteria

Login

As an unauthorized user, I want to be able to login to the website via a form, so that I can access my private information.

Questions

• Will the user enter a username or an email address to login?
  • User will login via email and password
• What routes should we use for login?
  • User will login via /login route
• Where should the user be redirected after login?
  • User will be redirected to the / homepage
• What happens if the user doesn't exist yet?
  • Display the message Invalid Login please try again.
• What happens if the user enters the wrong password?
  • Display the message Invalid Login please try again.
• Should logging in use session-based or use token-based authentication?
  • We will use session auth

Acceptance Criteria

1. Given that I'm a logged-out user and
   • When I'm on the /login route
   • Then there will be a login form with an email and password field and a "Login" button to submit the form.
2. When I try to fill out the form with an invalid email and password combination and press Enter or press the "Login" button
   • Then at the top of the form, I will see a red message Invalid Login :( please try again.
3. When I try to fill out the form with an email that doesn't exist in the system and press Enter or press the "Login" button
   • Then at the top of the form, I will see a red message Invalid Login :( please try again.
4. When I try to fill out the form with a valid email and password and press press Enter or press the "Login" button
   • Then I will be redirected to the homepage at the / route.
5. Given that I am a logged-in user
   • When I refresh the homepage at the / route
   • Then I will still be logged in
6. Given that I am a logged-out user
   • When I try to navigate to the homepage at the / route
   • Then I will be redirected to the /login route

Signup

As an unauthorized user, I want to be able to sign up for the website via a signup form, so that I can access Bluebird.

Questions

• Will the user enter a username and an email address to signup?
• Will we confirm their password during signup?
• What routes should we use for signup?
• Where should the user be redirected after signup?
• Will we allow OAuth authentication via a third party?
• What happens if the user with the username or email already exists?
• What happens if the user enters the wrong password confirmation?

Acceptance Criteria

1. Given that I'm a user who has not signed up yet and
   • When I'm on the /signup route
   • Then there will be a signup form with an email, username, and password field and a "Sign Up" button to submit the form.
2. When I try to fill out the form with an email or username that already exists with a valid password and press Enter or press the "Sign Up" button
   • Then at the top of the form, I will see a red message User with that email or username already exists.
3. When I try to fill out the form with a password shorter than 6 characters and press Enter or press the "Sign Up" button
   • Then at the top of the form, I will see a red message Password must be at least 6 characters long.
4. When I try to fill out the form with a valid email, username, and password and press Enter or press the "Sign Up" button
   • Then I will be redirected to the homepage at the / route.
5. Given that I am a user that just signed up
   • When I refresh the homepage at the / route
   • Then I will still be logged in

Demo User