Merge pull request #5688 from overleaf/jpa-invalid-password-message

[web] password reset: validate user password ahead of invalidating token

GitOrigin-RevId: ba3e6549f53675a2216e2fc24293276c1968d416

services/web/test/acceptance/src/PasswordResetTests.js

@@ -175,7 +175,7 @@ describe('PasswordReset', function () {
         expect(auditLog).to.deep.equal([])
       })
 
-      it('without a valid password should return 400 and log the change', async function () {
+      it('without a valid password should return 400 and not log the change', async function () {
         // send reset request
         response = await userHelper.request.post('/user/password/set', {
           form: {
@@ -187,6 +187,50 @@ describe('PasswordReset', function () {
         expect(response.statusCode).to.equal(400)
         userHelper = await UserHelper.getUser({ email })
 
+        const auditLog = userHelper.getAuditLogWithoutNoise()
+        expect(auditLog).to.deep.equal([])
+      })
+
+      it('should flag email in password', async function () {
+        const localPart = email.split('@').shift()
+        // send bad password
+        response = await userHelper.request.post('/user/password/set', {
+          form: {
+            passwordResetToken: token,
+            password: localPart,
+            email,
+          },
+          json: true,
+          simple: false,
+        })
+        expect(response.statusCode).to.equal(400)
+        expect(response.body).to.deep.equal({
+          message: { text: 'password contains part of email address' },
+        })
+      })
+
+      it('should be able to retry after providing an invalid password', async function () {
+        // send bad password
+        response = await userHelper.request.post('/user/password/set', {
+          form: {
+            passwordResetToken: token,
+            password: 'short',
+          },
+          simple: false,
+        })
+        expect(response.statusCode).to.equal(400)
+
+        // send good password
+        response = await userHelper.request.post('/user/password/set', {
+          form: {
+            passwordResetToken: token,
+            password: 'SomeThingVeryStrong!11',
+          },
+          simple: false,
+        })
+        expect(response.statusCode).to.equal(200)
+        userHelper = await UserHelper.getUser({ email })
+
         const auditLog = userHelper.getAuditLogWithoutNoise()
         expect(auditLog.length).to.equal(1)
       })