Customer sign-in with a one-time code (2FA)

@sign-in @security
Feature: Customer sign-in with a one-time code
  As a customer user
  I want to sign in with a password and a one-time code sent by email
  So that a leaked or reused password alone does not let someone in

  External customers sign in with a password and a one-time code by email, and can recover access on their own.

  Background:
    Given a customer belongs to one organisation
    And the customer has been invited to that organisation

  Rule: Sign-in needs a password and a one-time code

    Scenario: A customer signs in with both factors
      Given a customer enters their email and correct password
      When they enter the current one-time code from their inbox
      Then they are signed in to their organisation

    Scenario: A wrong one-time code is refused
      Given a customer enters their email and correct password
      When they enter an incorrect one-time code
      Then they are not signed in

    Scenario: Too many wrong codes lock sign-in
      Given a customer has entered a correct password
      When they submit the wrong one-time code more than the allowed number of times
      Then sign-in is locked for fifteen minutes

    Scenario: A used code cannot be replayed
      Given a customer has already signed in with a one-time code
      When the same code is submitted again
      Then it is refused

    Scenario: A resend within the cooldown is refused
      Given a customer is at the one-time-code step
      When they ask to resend the code within the cooldown
      Then the resend is refused until the cooldown passes

    Scenario: A fresh code replaces the old one
      Given a customer asks to resend the code after the cooldown
      When a new code is issued
      Then the earlier code no longer works

  Rule: A customer can recover access without help

    Scenario: Forgotten password reset does not reveal whether an email exists
      Given a person asks to reset a password for any email address
      When they submit the request
      Then the response is the same whether or not the email is registered

    Scenario: A reset link is single-use and expiring
      Given a customer has a password-reset link
      When they complete the reset
      Then they can set a new password and sign in
      And the link cannot be used again
      And their existing sessions are revoked

  Rule: A session can be ended on the server

    Scenario: A session is ended centrally
      Given a customer is signed in
      When the server revokes the session, for example on a password reset
      Then the customer's next action requires signing in again
    @edge-cases

    Scenario Outline: One-time-code outcomes
      Given a customer has entered a correct password
      When they submit a "<code>" one-time code
      Then the result is "<result>"
      Examples:
        | code | result |
        | current | signed in |
        | expired | refused |
        | already used | refused |
        | incorrect | refused |