MAKITTHandoff
Handoff Boards
ongoingmarket-aware-signup-consent-policy

Market-aware Signup Consent Policy — E2E

title: Market-aware Signup Consent Policy E2E status: ongoing created: 2026-05-12 updated: 2026-05-12

Market-aware Signup Consent Policy — E2E

본 spec의 AI ↔ Human 핸드오프 보드. 작업자는 phase별 진행, 차단, 검증 요청을 여기에 누적한다.

  • auth.signupPolicy KR 응답: terms/privacy required + optional marketing policy shape.

  • auth.signupPolicy US 응답: market slug/link가 KR과 분리됨.

  • auth.signupPolicy SG 응답: seller custom signup policy가 있으면 consents[]에 포함됨.

  • auth.signupPolicy JP 응답: default required policies 정상 합성.

  • Email signup: all required consent true → success.

  • Email signup: terms missing → CONSENT_REQUIRED.

  • Email signup: privacy missing → CONSENT_REQUIRED.

  • Email signup: alien scope included → INVALID_CONSENT_SCOPE.

  • Email signup: optional marketing false/missing → consent record 없음.

  • Email signup: optional marketing true → consent record 있음.

  • OAuth complete-signup: required consent 누락 → CONSENT_REQUIRED.

  • OAuth complete-signup: alien scope included → INVALID_CONSENT_SCOPE.

  • Legacy request: termsOfService/privacyPolicy/marketingEmail/marketingAlimTalk만 보내도 Phase 1-4 동안 정상 동작.

  • auth.signupPolicy resource accepts marketCode.

  • Resource query key includes marketCode.

  • SignupPolicySchema validates consents[].

  • auth.signup schemaFactory requires dynamic required consent fields.

  • auth.completeOAuthSignup schemaFactory requires dynamic required consent fields.

  • Action execute maps signupPolicy.consents[] field values to server consents[] payload.

  • FormRenderer no longer auto-inserts signup consent checkboxes.

  • Standard HCS uses no-param auth.signupPolicy; shop-api resolves market from request i18n context.

  • Common policy-aware signup fragment exists locally as signup-form-policy-aware.

  • Common policy-aware OAuth complete-signup fragment exists locally as oauth-signup-complete-policy-aware.

  • Old signup-form-default remains available as deprecated rollback path.

  • Henriette 57a... prepared HCS binds SignupForm to signup-form-policy-aware.

  • Henriette 57a... prepared HCS binds OauthSignupComplete to oauth-signup-complete-policy-aware.

  • Henriette 57a... prepared HCS removes local henriette-oauth-signup-complete override.

  • Henriette compiled HCS has zero marketingConsent.

  • Henriette signup fields use phoneNumber, not legacy phone, when phone is visible.

  • Henriette signup renders required/optional consent labels from policy resource.

  • Henriette signup submit button cannot double-submit while submitting.

  • Snapshot: /signup desktop.

  • Snapshot: /signup mobile.

  • Snapshot: /complete-signup desktop.

  • Snapshot: /complete-signup mobile.

  • Signup policy modal has market selector.

  • Default/global policy and regional override are visually distinct.

  • Phone policy can be configured per market.

  • Signup consent preview shows required/optional policies.

  • Required market policies are locked from auth settings.

  • Policy Management custom policy with placements=["signup"] appears in signup policy preview.

  • mandatoryConsent=true custom policy appears as required.

  • Missing unpublished required policy page shows warning or blocks save according to implementation decision.

Use current dev auth rules from docs/E2E_PLAYBOOK.md.

Admin token:

TOKEN=$(curl -sS -X POST http://localhost:8080/api/v1/admin/developer/token/email \
  -H 'Content-Type: application/json' \
  -d '{"email":"chance@makitt.io"}' | jq -r '.accessToken')

Signup policy check:

SHOP_ID=71261f65-ee4e-4238-9b4f-d56cee9be523
curl -sS "http://localhost:10000/shop/$SHOP_ID/auth/signup-policy?marketCode=KR" \
  -H 'Authorization: Bearer dev-bypass' | jq

Compiled HCS residue check:

rg -n '"marketingConsent"|"field"\\s*:\\s*"phone"' /path/to/compiled-shop.json
  • HCS live changes must use compiler /save only.
  • Do not remove legacy fields during Phase 1-4.
  • marketingConsent is an existing Henriette HCS bug and must be closed in Phase 3.
  • Race condition, per-email lockout, force re-consent, and shop etag invalidation are separate cycles.

비어 있음

당신이 처리할 항목

docs / spec / ongoing / market-aware-signup-consent-policy / e2e.md