EARS Requirements Patterns

1. Ubiquitous:        The [system] shall [behavior].
2. Event-driven:      When [trigger], the [system] shall [behavior].
3. State-driven:      While [state], the [system] shall [behavior].
4. Unwanted behavior: If [condition], the [system] shall [behavior].
5. Optional feature:  Where [feature], the [system] shall [behavior].

// REQ-001 (Ubiquitous)
The system shall hash all passwords using bcrypt
with a minimum cost factor of 12.

// REQ-002 (Event-driven)
When a user submits valid credentials, the system
shall create a session token with a 24-hour expiry.

// REQ-003 (Unwanted behavior)
If a user enters incorrect credentials 5 times
within 15 minutes, the system shall lock the account
for 30 minutes.

// REQ-004 (State-driven)
While an account is locked, the system shall reject
all login attempts and show the remaining lock time.

// REQ-005 (Optional)
Where MFA is enabled, the system shall require a
valid TOTP code after password validation.