Skip to main content

FR-01.11 — Reset Password

Trigger: A user submits a valid password-reset mechanism with a new password.

System shall:

  • Validate the reset mechanism.
  • Validate the new password against the platform's password rules.
  • Replace the existing password with the new password.
  • Invalidate the reset mechanism after successful use.
  • Invalidate/revoke existing sessions.

Acceptance Criteria:

  • PASS: A valid reset mechanism and valid new password successfully change the password.
  • PASS: The reset mechanism cannot be reused.
  • PASS: The old password no longer authenticates the user.
  • PASS: The new password can authenticate the user.
  • FAIL: An expired or already-used reset mechanism changes the password.