SL
SkillsLao Backoffice
Prototype

Verification Code

Enter the 6-digit code sent to your mobile number

Channel SMS
Sent to +856 20 1234 5678
Expires in 5:00 REF: REF-XXXXX
Change Method

Screen Flow (per flow.puml):

✓ Finish & Return to caller (verification code correct) ✕ Cancel sub-flow (change method)
📝 Spec notes — SUC-IDP-02 / SCR-IDP.02 (fields, actions, requirements)
Identity
  • SUC: SUC-IDP-02 — Authenticate via SMS verification code
  • Screen: SCR-IDP.02 — Verification Code
  • Invoked by (Backoffice Portal): UC-IDP.10 (Update Instructor Profile), UC-IDP.11 (Update Staff Profile) — contact re-verification on mobile/phone number change; UC-IDP.22 (Forgot Password) does not use this SUC in Backoffice — SMS is not a staff/instructor login channel per FEAT-IDP.01
ReturnUrl context
  • Current: /update-instructor-profile/
  • Fallback: / when returnUrl is empty
  • Finish → returnUrl; Cancel → cancelUrl (if provided) or returnUrl + &sub_cancelled=1
  • cancelUrl: /update-instructor-profile/
Brief description

6-digit SMS verification code sub-flow. System sends the code before opening this page; user enters it; system verifies. Handles wrong code (inline error + retry), expired code (inline message + auto-resend), resend throttling, and 5-failure inline lockout (AF 3C / SS-IDP.01) — all without page redirect.

Regions
  • Verification Code Delivery Info — Channel (read-only), Sent to (read-only, always unmasked)
  • Verification Code Entry — Verification Code (required, 6-digit numeric), Expires in (live countdown), REF (read-only)
  • Footer Actions — Verify, Resend Verification Code, Change Method
Fields
  • delivery_channel "Channel" — text · read-only · source: session.otp_channel · always
  • contact "Sent to" — text · read-only · source: session.contact_full (full unmasked — AR-7) · always
  • otp_code "Verification Code" — text · required · always · validation: length:6, digits_only
  • countdown_remaining "Expires in" — text · read-only · computed · always
  • ref_key "REF" — text · read-only · source: session.otp_ref_key · always
Actions
  • verify "Verify" — enabled when otp_code.length == 6 && !locked · triggers SUC-IDP-02-M-2
  • resend "Resend verification code" — enabled when not locked · triggers SUC-IDP-02-A-3A-2
  • change_method "Change Method" — always · back navigation to calling UC's method-selection screen
Additional requirements
  1. 5-minute countdown (SS-IDP.02); at 0:00 → inline expiry message + prompt Resend. [SS-IDP.02]
  2. Inline error below otp_code on invalid code: "Invalid verification code — please try again." [—]
  3. Auto-focus otp_code on page load; Verify enabled only when 6 digits filled. [NFR-09]
  4. AF 3C inline lockout: 5 wrong attempts → disable input + Resend, show lock panel with 15-min countdown; auto-reopen when lock expires. [SS-IDP.01]
  5. Resend during lock window → "You cannot request a new verification code at this time — please wait 15 minutes." [SS-IDP.01]
  6. "Change Method" navigates back to the method-selection screen of the calling UC; target not hardcoded. [—]
  7. contact always displayed full and unmasked — SMS: full number (e.g. +856 20 1234 5678). session.contact_full must carry the unmasked value. [—]