Test Cases: Password Management

Module: Authentication & Identity - Password Management

Backend Handlers:

forgotPasswordHandler
resetPasswordHandler
changePasswordHandler

Routes:

POST /auth/forgot-password
POST /auth/reset-password
POST /auth/password/change

Test Cases

TC-PWD-01: Forced Password Reset (Forgot Password) request

Step	Action	Expected Result
1	Navigate to "Forgot Password" screen.	-
2	Enter valid registered `email`.	-
3	Submit.	API returns success message "If an account exists...".
4	Backend Verification.	`Member` record updated with `verificationToken`. Email sent (check logs/email service).

TC-PWD-02: Reset Password with Valid Token

Step	Action	Expected Result
1	Obtain valid `resetToken` (from DB or TC-PWD-01 output).	-
2	Call `POST /auth/reset-password` with `token` and `newPassword`.	-
3	Check API Response.	Status `200 OK`. Message "Password has been set successfully".
4	Database Verification.	`User` record created/updated. `passwordHash` updated. `verificationToken` cleared.
5	Login Check.	Can login with `newPassword`.

TC-PWD-03: Reset Password with Expired Token

Step	Action	Expected Result
1	Manually set `verificationExpires` to past date in DB for a user.	-
2	Attempt reset with that token.	-
3	Check API Response.	Status `400 Bad Request`. "Invalid or expired reset token".

TC-PWD-04: Change Password (Authenticated)

Step	Action	Expected Result
1	Login as valid user.	-
2	Navigate to Profile/Settings -> Change Password.	-
3	Enter `currentPassword` (Correct) and `newPassword`.	-
4	Submit.	`POST /auth/password/change` called.
5	Check API Response.	Status `200 OK`.
6	Verification.	New password works for subsequent logins. Old password fails.

TC-PWD-05: Change Password with Wrong Current Password

Step	Action	Expected Result
1	Login as valid user.	-
2	Enter Incorrect `currentPassword`.	-
3	Submit.	API returns `400 Bad Request`. "Current password is incorrect".
4	Data Integrity.	Password hash in DB remains unchanged.