Public: anyone can read this; the crew can change it.
The OpenAPI document describes changing one's password and verifying one's email #5366
Check · Review · Land · Live done — Landed and live in production.
The `ROUTES` rows for `POST /api/v1/user/password` and `POST /api/v1/user/email/verify` were already in `src/contract/openapi.ts` (added in #5056), so this pull only covers the test side.
shipped production is serving it deploy 674862e
The ROUTES rows for POST /api/v1/user/password and POST /api/v1/user/email/verify were already in src/contract/openapi.ts (added in #5056), so this pull only covers the test side.
- Coverage test: both routes are removed from
NOT_YET_DESCRIBEDintest/openapi-coverage.test.ts. The coverage test now checks them, and it fails if either row is dropped. - New case in
test/openapi-oa-acct.test.ts: it reads both rows from the generated document and checks:
- the password body has exactly current and next;
- the password refusals include bad_credentials, throttled, weak_password and password_too_long;
- the verify refusals include too_soon, capped, no_mail and failed;
- the verify row has a 202 answer.
- Handlers and rows: no handler or
ROUTESrow changed. I compared the two existing rows against the handlers and they match.
I left alone the 19 other NOT_YET_DESCRIBED entries that the coverage test reports as removable, since they are outside this issue.
To try it, run bun test test/openapi. It passes: 45 tests, 0 failures.
Test-only change; the rows were already in openapi.ts. Both routes are removed from NOT_YET_DESCRIBED, and the new case would fail if either row were dropped or lost its body or refusals. test/openapi passes locally (44 tests, 0 failures). The preview serves both paths in its OpenAPI document. No handler, auth or UI surface changed. Two things I would do next: (1) clear the other removable NOT_YET_DESCRIBED entries in a follow-up, in batches; (2) assert the 429/503 statuses in the refusal text, not just the codes.
The
ROUTESrows forPOST /api/v1/user/passwordandPOST /api/v1/user/email/verifywere already insrc/contract/openapi.ts(added in #5056), so this pull only covers the test side.NOT_YET_DESCRIBEDintest/openapi-coverage.test.ts. The coverage test now checks them, and it fails if either row is dropped.test/openapi-oa-acct.test.ts: it reads both rows from the generated document and checks:- the password body has exactly
currentandnext; - the password refusals includebad_credentials,throttled,weak_passwordandpassword_too_long; - the verify refusals includetoo_soon,capped,no_mailandfailed; - the verify row has a 202 answer.ROUTESrow changed. I compared the two existing rows against the handlers and they match.I left alone the 19 other
NOT_YET_DESCRIBEDentries that the coverage test reports as removable, since they are outside this issue.To try it, run
bun test test/openapi. It passes: 45 tests, 0 failures.Closes #5310