[BUG-PA-001][FR-03][POST /api/forgot-password] Recovery endpoint generates four-digit OTPs instead of six digits

[AkiraTomori]

Summary

The password-recovery endpoint repeatedly generates four-digit OTP values even though FR-03, SEC-07, and API specification §1.3 require a six-digit decimal-string reset token.

• Severity: High
• Environment: Local Docker eshop-sut-backend-1
• HW06 Pool: Pool A / FR-03
• Failed coverage: 27 assertions across 26 cases

Preconditions

• The backend is listening on localhost port 3000.
• A disposable registered account exists.
• The collection-level pre-request script supplies X-Student-Id.

Steps to reproduce

1. Send POST /api/forgot-password with a disposable registered email.
2. Inspect the successful response without publishing the token value.
3. Validate resetToken against /^[0-9]{6}$/.

Expected result

HTTP 200 returns the documented response shape with a random six-digit decimal-string resetToken.

Actual result

Repeated responses returned four-digit decimal-string tokens. The values are redacted from the report and screenshot.

Impact

The endpoint violates FR-03 and SEC-07 and materially reduces the OTP search space.

Evidence

• 23127379_Homework/HW6/Pool-A_FR03_Password_Reset/postman/newman/Pool-A_FR03_report.json
• 23127379_Homework/HW6/Pool-A_FR03_Password_Reset/postman/newman/Pool-A_FR03_report.html
• 23127379_Homework/HW6/Pool-A_FR03_Password_Reset/evidence/Pool-A_FR03_newman-cli.txt
• Screenshot generated from the redacted Newman failure view with MSSV 23127379 and supplied to the reporter.

Requirement sources: README FR-03, SEC-07; API specification §1.3
Suggested labels: bug, security, FR-03, api

[AkiraTomori]

HW06 screenshot evidence — MSSV 23127379

Repository source: BUG-PA-001_23127379.png

The screenshot summarizes the redacted Newman/fixture evidence recorded in the HW06 Pool artifacts; it does not expose OTPs, passwords, tokens, or personal email addresses.