LG-13014: Implement password compromised

[mdiarra3]

🎫 Ticket

Link to the relevant ticket:
LG-13014

🛠 Summary of changes

This will Allow users to be notified that their password has been compromised and prompted to change their password.

📜 Testing Plan

Provide a checklist of steps to confirm the changes.
Steps to test

1. Set compromised_password_randomizer_value and compromised_password_randomizer_threshold to 1 and check_user_password_compromised_enabled to true in the environment you are testing on.
2. Create An account with Bad password (Will need to go into rails console and update it to be a bad password after creating account)
3. Sign out of account and sign in with Bad password
4. Be expected to be taken to a page lettign user know to change password
5. If you sign out and attempt to do it again you will be directed to after_sign_in_path for user instead of password compromised page.

👀 Screenshots

[aduth]

I was able to trigger the forced password change when signing in to http://localhost:3000 directly, but it did not show when signing in from the sample application. Can you check to make sure that works, since we should assume most users will be signing in to access a partner application?

[aduth]

I was able to trigger the forced password change when signing in to http://localhost:3000 directly, but it did not show when signing in from the sample application. Can you check to make sure that works, since we should assume most users will be signing in to access a partner application?

Follow-up: I paired with @mdiarra3 and this was an issue with how I was testing, and it does actually work as expected.

The issue was due to how I was trying to reset the password_compromised_checked_at value on my user account through the Rails console, and in how it wasn't always resetting correctly due to how Rails caches and avoids database queries.

In case others have similar issues in testing, fixing it was a matter of changing from:

user.update(password_compromised_checked_at: nil)

To:

user.reload.update(password_compromised_checked_at: nil)
# Or maybe?
# User.find_with_email('email@example.com').update(password_compromised_checked_at: nil)

[aduth]

I'm liking the new approach reusing the edit password controller 👍

[aduth]

A few minor remarks and a question, but LGTM overall 👍

[aduth]

Since we render the description for all views, do we need this condition anymore, or should we just always apply the aria-describedby ?