DSBTAI 時代的實用開發神功

Scenario: 第五次登入失敗
Given 使用者已連續登入失敗 4 次
And 帳號目前沒有被鎖定
When 使用者再次輸入錯誤密碼
Then 登入失敗
And failedAttempts 應變成 5
And 帳號應被鎖定 15 分鐘
And 不應建立 Session

Scenario: Fifth failed login
Given the user has failed login 4 times
And the account is not locked
When the user enters a wrong password again
Then login fails
And failedAttempts becomes 5
And the account is locked for 15 minutes
And no Session is created

it("locks account after fifth failed login", async () => {
  const now = new Date("2026-08-19T10:00:00Z")
  const user = createUser({ failedAttempts: 4 })

  await expect(
    login(user, "wrong-password", now)
  ).rejects.toThrow()

  expect(user.failedAttempts).toBe(5)
  expect(user.lockedUntil).toEqual(addMinutes(now, 15))
  expect(sessionCreated()).toBe(false)
})

// AI implements only after the contract is clear.
recordLoginFailure(now: Date) {
  this.failedAttempts += 1

  if (this.failedAttempts >= 5) {
    this.lockedUntil = addMinutes(now, 15)
  }
}

// 不要自行修改 Spec。若實作與 Spec 衝突，回報衝突，而不是改題目。