diff --git a/app/views/event_disavowal/new.html.erb b/app/views/event_disavowal/new.html.erb
index b8093c0c69c..da332e90875 100644
--- a/app/views/event_disavowal/new.html.erb
+++ b/app/views/event_disavowal/new.html.erb
@@ -13,7 +13,7 @@
input_html: { value: @disavowal_token, name: :disavowal_token } %>
<%= f.input :password, label: t('forms.passwords.edit.labels.password'), required: true,
input_html: { aria: { invalid: false }, class: 'password-toggle' } %>
- <%= render 'devise/shared/password_strength' %>
+ <%= render 'devise/shared/password_strength', forbidden_passwords: @forbidden_passwords %>
<%= f.button :submit, t('forms.passwords.edit.buttons.submit'), class: 'mb3' %>
<% end %>
diff --git a/app/views/sign_up/passwords/new.html.erb b/app/views/sign_up/passwords/new.html.erb
index 7dc69bdc39f..cfab89bbe84 100644
--- a/app/views/sign_up/passwords/new.html.erb
+++ b/app/views/sign_up/passwords/new.html.erb
@@ -14,7 +14,7 @@
<%= f.input :password, required: true,
input_html: { aria: { invalid: false, describedby: 'password-description' },
class: 'password-toggle' } %>
- <%= render 'devise/shared/password_strength' %>
+ <%= render 'devise/shared/password_strength', forbidden_passwords: @forbidden_passwords %>
<%= hidden_field_tag :confirmation_token, @confirmation_token, id: 'confirmation_token' %>
<%= f.input :request_id, as: :hidden, input_html: { value: params[:request_id] || request_id } %>
diff --git a/app/views/users/passwords/edit.html.erb b/app/views/users/passwords/edit.html.erb
index 098def4e1ae..860a4884748 100644
--- a/app/views/users/passwords/edit.html.erb
+++ b/app/views/users/passwords/edit.html.erb
@@ -13,7 +13,7 @@
<%= f.error_notification %>
<%= f.input :password, label: t('forms.passwords.edit.labels.password'), required: true,
input_html: { aria: { invalid: false, describedby: 'password-description' }, class: 'password-toggle' } %>
- <%= render 'devise/shared/password_strength' %>
+ <%= render 'devise/shared/password_strength', forbidden_passwords: @forbidden_passwords %>
<%= f.button :submit, t('forms.buttons.submit.update'), class: 'mt2 mb3' %>
<% end %>
diff --git a/spec/controllers/event_disavowal_controller_spec.rb b/spec/controllers/event_disavowal_controller_spec.rb
index 822a885b5bb..1c4ef2bd8e7 100644
--- a/spec/controllers/event_disavowal_controller_spec.rb
+++ b/spec/controllers/event_disavowal_controller_spec.rb
@@ -23,6 +23,17 @@
get :new, params: { disavowal_token: disavowal_token }
end
+
+ it 'assigns forbidden passwords' do
+ expect(@analytics).to receive(:track_event).with(
+ Analytics::EVENT_DISAVOWAL,
+ build_analytics_hash,
+ )
+
+ get :new, params: { disavowal_token: disavowal_token }
+
+ expect(assigns(:forbidden_passwords)).to all(be_a(String))
+ end
end
context 'with an invalid disavowal_token' do
@@ -39,6 +50,22 @@
get :new, params: { disavowal_token: disavowal_token }
end
+
+ it 'does not assign forbidden passwords' do
+ event.update!(disavowed_at: Time.zone.now)
+
+ expect(@analytics).to receive(:track_event).with(
+ Analytics::EVENT_DISAVOWAL_TOKEN_INVALID,
+ build_analytics_hash(
+ success: false,
+ errors: { event: [t('event_disavowals.errors.event_already_disavowed')] },
+ ),
+ )
+
+ get :new, params: { disavowal_token: disavowal_token }
+
+ expect(assigns(:forbidden_passwords)).to be_nil
+ end
end
end
@@ -74,6 +101,25 @@
post :create, params: params
end
+
+ it 'assigns forbidden passwords' do
+ expect(@analytics).to receive(:track_event).with(
+ Analytics::EVENT_DISAVOWAL_PASSWORD_RESET,
+ build_analytics_hash(
+ success: false,
+ errors: { password: ['is too short (minimum is 12 characters)'] },
+ ),
+ )
+
+ params = {
+ disavowal_token: disavowal_token,
+ event_disavowal_password_reset_from_disavowal_form: { password: 'too short' },
+ }
+
+ post :create, params: params
+
+ expect(assigns(:forbidden_passwords)).to all(be_a(String))
+ end
end
context 'with an invalid disavowal_token' do
diff --git a/spec/controllers/users/reset_passwords_controller_spec.rb b/spec/controllers/users/reset_passwords_controller_spec.rb
index 2d106b51452..a0e0cf7b2ca 100644
--- a/spec/controllers/users/reset_passwords_controller_spec.rb
+++ b/spec/controllers/users/reset_passwords_controller_spec.rb
@@ -139,6 +139,7 @@
put :update, params: { reset_password_form: form_params }
+ expect(assigns(:forbidden_passwords)).to all(be_a(String))
expect(response).to render_template(:edit)
end
end
diff --git a/spec/javascripts/packs/pw-strength-spec.js b/spec/javascripts/packs/pw-strength-spec.js
new file mode 100644
index 00000000000..db7f7960698
--- /dev/null
+++ b/spec/javascripts/packs/pw-strength-spec.js
@@ -0,0 +1,43 @@
+describe('pw-strength', () => {
+ let getForbiddenPasswords;
+ before(async () => {
+ window.LoginGov = { I18n: { t() {} } };
+ ({ getForbiddenPasswords } = await import('../../../app/javascript/packs/pw-strength'));
+ });
+
+ after(() => {
+ delete window.LoginGov;
+ });
+
+ describe('getForbiddenPasswords', () => {
+ it('returns empty array if given argument is null', () => {
+ const element = null;
+ const result = getForbiddenPasswords(element);
+
+ expect(result).to.deep.equal([]);
+ });
+
+ it('returns empty array if element has absent dataset value', () => {
+ const element = document.createElement('span');
+ const result = getForbiddenPasswords(element);
+
+ expect(result).to.deep.equal([]);
+ });
+
+ it('returns empty array if element has invalid dataset value', () => {
+ const element = document.createElement('span');
+ element.setAttribute('data-forbidden', 'nil');
+ const result = getForbiddenPasswords(element);
+
+ expect(result).to.deep.equal([]);
+ });
+
+ it('parsed array of forbidden passwords', () => {
+ const element = document.createElement('span');
+ element.setAttribute('data-forbidden', '["foo","bar","baz"]');
+ const result = getForbiddenPasswords(element);
+
+ expect(result).to.be.deep.equal(['foo', 'bar', 'baz']);
+ });
+ });
+});
diff --git a/spec/views/devise/shared/_password_strength.html.erb_spec.rb b/spec/views/devise/shared/_password_strength.html.erb_spec.rb
new file mode 100644
index 00000000000..0116d269dff
--- /dev/null
+++ b/spec/views/devise/shared/_password_strength.html.erb_spec.rb
@@ -0,0 +1,35 @@
+require 'rails_helper'
+
+describe 'devise/shared/_password_strength.html.erb' do
+ describe 'forbidden attributes' do
+ context 'when local is unassigned' do
+ before do
+ render
+ end
+
+ it 'omits data-forbidden attribute from strength text tag' do
+ expect(rendered).to have_selector('#pw-strength-txt:not([data-forbidden])')
+ end
+ end
+
+ context 'when local is nil' do
+ before do
+ render 'devise/shared/password_strength', forbidden_passwords: nil
+ end
+
+ it 'omits data-forbidden attribute from strength text tag' do
+ expect(rendered).to have_selector('#pw-strength-txt:not([data-forbidden])')
+ end
+ end
+
+ context 'when local is assigned' do
+ before do
+ render 'devise/shared/password_strength', forbidden_passwords: ['a', 'b', 'c']
+ end
+
+ it 'adds JSON-encoded data-forbidden to strength text tag' do
+ expect(rendered).to have_selector('#pw-strength-txt[data-forbidden="[\"a\",\"b\",\"c\"]"]')
+ end
+ end
+ end
+end