Strengthen password policy

.helm/ctrl/templates/cron.yaml

@@ -25,11 +25,11 @@ spec:
               - name: EXAMPLE_ORG_ADMIN_EMAIL
                 value: admin@example.com
               - name: EXAMPLE_ORG_ADMIN_PASSWORD
-                value: Testpassword1
+                value: Supersecret123
               - name: EXAMPLE_PARTICIPANT_EMAIL
                 value: user@example.com
               - name: EXAMPLE_PARTICIPANT_PASSWORD
-                value: Testpassword2
+                value: Supersecret123
               - name: POSTGRES_PASSWORD
                 valueFrom:
                   secretKeyRef:

README.md

@@ -26,12 +26,12 @@ CTRL, developed by [Garvan Institute of Medical Research](https://www.garvan.org
 **User Portal**
 URL: [http://ctrldemo.dsp.garvan.org.au/](http://ctrldemo.dsp.garvan.org.au/)
 Login: `user@example.com`
-Password: `Testpassword2`
+Password: `Supersecret123`
 
 **Admin Portal**
 URL: [http://admin.ctrldemo.dsp.garvan.org.au/](http://admin.ctrldemo.dsp.garvan.org.au/)
 Login: `admin@example.com`
-Password: `Testpassword1`
+Password: `Supersecret123`
 
 ## Features
 

application/admin-client/cypress/e2e/auditLogs.cy.js

@@ -1,4 +1,4 @@
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 before(() => {
   cy.task('reset')
@@ -9,19 +9,19 @@ before(() => {
 
 describe('Audit Logs', () => {
   it('Organisation Admin can view Audit Log', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/audit-logs')
     cy.contains('Audit Logs').should('exist')
   })
 
   it('Study Amin can view Audit Log', () => {
-    cy.login(UserType.STUDY_ADMIN)
+    cy.login(TestUsers.STUDY_ADMIN.email)
     cy.visit('/audit-logs')
     cy.contains('Audit Logs').should('exist')
   })
 
   it('should toggle the View Payload cell and display JSON', () => {
-    cy.login(UserType.STUDY_ADMIN)
+    cy.login(TestUsers.STUDY_ADMIN.email)
     cy.visit('/audit-logs')
 
     // Toggle button to view payload
@@ -33,7 +33,9 @@ describe('Audit Logs', () => {
     // Assert JSON appears
     // Note: this works because the most recent action is the Study Admin
     //       logging in at the start of the test :)
-    cy.get('.MuiCollapse-root').should('be.visible').and('contain.text', UserType.STUDY_ADMIN)
+    cy.get('.MuiCollapse-root')
+      .should('be.visible')
+      .and('contain.text', TestUsers.STUDY_ADMIN.email)
 
     // Toggle button to hide payload
     cy.get('[data-cy="toggle-payload-view"]').first().should('contain.text', 'Hide Payload').click()
@@ -44,7 +46,7 @@ describe('Audit Logs', () => {
   })
 
   it('should obscure password fields in JSON payload', () => {
-    cy.login(UserType.STUDY_ADMIN)
+    cy.login(TestUsers.STUDY_ADMIN.email)
     cy.visit('/audit-logs')
 
     // Toggle button to view payload
@@ -55,7 +57,7 @@ describe('Audit Logs', () => {
   })
 
   it('should obscure redcapToken fields in JSON payload', () => {
-    cy.login(UserType.STUDY_ADMIN)
+    cy.login(TestUsers.STUDY_ADMIN.email)
     cy.visit('/studies')
     cy.get('[data-cy="advanced-toggle"]').eq(0).click()
     cy.get('[data-cy="redcapToken"] input').eq(0).type('abc123')

application/admin-client/cypress/e2e/auth.cy.js

@@ -1,6 +1,6 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
@@ -15,16 +15,16 @@ describe('auth', () => {
 
   it('can login as admin to the admin portal', () => {
     cy.visit('/')
-    cy.get('input[name="email"]').type(UserType.ORG_ADMIN)
-    cy.get('input[name="password"]').type('Testpassword1')
+    cy.get('input[name="email"]').type(TestUsers.ORG_ADMIN.email)
+    cy.get('input[name="password"]').type(TestUsers.ORG_ADMIN.password)
     cy.get('button[type="submit"]').click()
     cy.url().should('include', '/surveys') // Redirects to /surveys after login
   })
 
   it('cannot login as a participant to the admin portal', () => {
     cy.visit('/')
-    cy.get('input[name="email"]').type(UserType.PARTICIPANT_COMPLETED)
-    cy.get('input[name="password"]').type('Testpassword1')
+    cy.get('input[name="email"]').type(TestUsers.PARTICIPANT_COMPLETED.email)
+    cy.get('input[name="password"]').type(TestUsers.PARTICIPANT_COMPLETED.password)
     cy.get('button[type="submit"]').click()
 
     // Expect to stay on the login page & error message popup

application/admin-client/cypress/e2e/basic.cy.js

@@ -1,6 +1,6 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
@@ -12,15 +12,15 @@ describe('basic', () => {
     cy.contains('Sign in to your account').should('exist')
   })
   it('can navigate to tabs', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/users')
     cy.contains('Surveys').click()
     cy.url().should('contain', '/surveys')
     cy.contains('Participants').click()
     cy.url().should('contain', '/participants')
   })
   it('Sidebar hide and show', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/users')
     cy.get('button[tabindex="0"]').first().click()
     cy.contains('CTRL Admin').should('not.be.visible')
@@ -29,7 +29,7 @@ describe('basic', () => {
   })
 
   it('Is redirected to login when attempting to use expired token', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/users')
     cy.contains('OrganisationAdmin').should('exist')
     cy.login_expired()

application/admin-client/cypress/e2e/elsa.cy.js

@@ -1,14 +1,14 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
 })
 
 describe('Elsa Integration', () => {
   it('Can disable and enable Elsa Integration', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/integrations')
     cy.get('[data-cy="elsa-checkbox"] input').should('be.checked').click()
     cy.get('[data-cy="confirm"]').click()

application/admin-client/cypress/e2e/families.cy.js

@@ -1,10 +1,10 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
-  cy.login(UserType.ORG_ADMIN)
+  cy.login(TestUsers.ORG_ADMIN.email)
 })
 
 describe('Family Editing', () => {

application/admin-client/cypress/e2e/invites.cy.js

@@ -1,10 +1,10 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
-  cy.login(UserType.ORG_ADMIN)
+  cy.login(TestUsers.ORG_ADMIN.email)
 })
 
 describe('', () => {

application/admin-client/cypress/e2e/multiStudy.cy.js

@@ -1,10 +1,10 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers, TestStudies } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
-  cy.login(UserType.ORG_ADMIN)
+  cy.login(TestUsers.ORG_ADMIN.email)
 })
 
 describe('Multi-study features', () => {
@@ -21,17 +21,17 @@ describe('Multi-study features', () => {
     cy.get('[data-cy="study-create"]').click()
     cy.visit('/surveys')
     //List of surveys
-    changeStudy('Test Study')
+    changeStudy(TestStudies.TEST_STUDY.name)
     cy.get('[role="rowgroup"]').children().should('have.length', 2)
-    changeStudy('Study 2')
+    changeStudy(TestStudies.TEST_STUDY_2.name)
     cy.get('[role="rowgroup"]').children().should('have.length', 1)
     //Survey version data is updated correctly (`TEST` has no content)
     changeStudy('TEST')
     cy.get('[data-cy="edit-draft-button"]').click()
     cy.get('[data-cy="step-list"]').children().should('have.length', 0)
     cy.get('[data-cy="study-dropdown"]').should('be.disabled')
     cy.contains('Surveys').click()
-    changeStudy('Test Study')
+    changeStudy(TestStudies.TEST_STUDY.name)
     cy.get('[data-cy="edit-draft-button"]').click()
     cy.get('[data-cy="step-list"]').children().should('have.length', 2)
     //List of participants and invitations
@@ -40,7 +40,7 @@ describe('Multi-study features', () => {
     cy.get('[data-cy="pending-list"]').should('contain.text', 'Pending')
     cy.get('[data-cy="pending-list"]').should('contain.text', 'Revoked')
     cy.get('[data-cy="pending-list"]').should('contain.text', 'Expired')
-    changeStudy('Study 2')
+    changeStudy(TestStudies.TEST_STUDY_2.name)
     cy.get('[data-cy="participants-list"]').should('not.contain.text', 'Second')
     cy.get('[data-cy="pending-list"]').should('not.contain.text', 'Revoked')
     cy.get('[data-cy="pending-list"]').should('not.contain.text', 'Expired')
@@ -49,8 +49,8 @@ describe('Multi-study features', () => {
   it('Maintains active study between browsing sessions', () => {
     cy.visit('/surveys')
     cy.get('[data-cy="study-dropdown"]').should('have.text', 'Test Study')
-    changeStudy('Study 2')
+    changeStudy(TestStudies.TEST_STUDY_2.name)
     cy.visit('/surveys')
-    cy.get('[data-cy="study-dropdown"]').should('have.text', 'Study 2')
+    cy.get('[data-cy="study-dropdown"]').should('have.text', TestStudies.TEST_STUDY_2.name)
   })
 })

application/admin-client/cypress/e2e/participants.cy.js

@@ -1,33 +1,33 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
 })
 
 describe('Participants', () => {
   it('List participants', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/participants')
     cy.contains('Test').should('exist')
     cy.contains('Dependent').should('exist')
     cy.contains('V1').should('exist')
   })
   it('View participant details', () => {
-    cy.login(UserType.ORG_ADMIN)
-    cy.visit('/participants/98')
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
     cy.contains('Unanswered User').should('exist')
     cy.contains('123 smith st').should('exist')
     cy.contains('V1').should('exist')
-    cy.visit('/participants/99')
+    cy.visit(`/participants/${TestUsers.PARTICIPANT_COMPLETED.id}`)
     cy.contains('Family').should('exist')
     cy.contains('Dependent').should('exist')
   })
 
   it('Edit participant details', () => {
-    cy.login(UserType.ORG_ADMIN)
-    cy.visit('/participants/edit/98')
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
     cy.contains('Edit Participant').should('exist')
     cy.get('input[name="profile.addressLine"]').clear().type('1 Smith St')
     cy.get('input[name="profile.nextOfKin.firstName"]').clear().type('Betty')
@@ -41,14 +41,14 @@ describe('Participants', () => {
     cy.contains('Invalid email').should('exist')
     cy.get('input[name="profile.nextOfKin.email"]').clear().type('valid@email.com')
     cy.contains('Save').click()
-    cy.url().should('contain', 'participants/98')
+    cy.url().should('contain', `participants/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
     cy.contains('Betty').should('exist')
     cy.contains('extID').should('exist')
     cy.contains('1 Smith St').should('exist')
   })
 
   it('View answers', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/participants')
     cy.get('[data-rowindex="0"]').contains('V1').trigger('mouseover', { force: true })
     cy.contains('Incomplete').should('be.visible')
@@ -59,7 +59,7 @@ describe('Participants', () => {
   })
 
   it('Shows completed and partially completed surveys', () => {
-    cy.login(UserType.ORG_ADMIN)
+    cy.login(TestUsers.ORG_ADMIN.email)
     cy.visit('/participants')
     cy.get('[data-rowindex="0"]').contains('V1').trigger('mouseover', { force: true })
     cy.contains('Incomplete').should('be.visible')

application/admin-client/cypress/e2e/passwordReset.cy.js

@@ -1,6 +1,6 @@
 /// <reference types="cypress" />
 
-const { UserType } = require('../../../common/cypress/support/commands')
+const { TestUsers } = require('../../../common/testing/constants')
 
 beforeEach(() => {
   cy.task('reset')
@@ -15,11 +15,11 @@ describe('Password Reset', () => {
 
   it('requests password reset with registered email', () => {
     cy.visit('/forgot-password')
-    cy.get('input[name="email"]').type(UserType.ORG_ADMIN)
+    cy.get('input[name="email"]').type(TestUsers.ORG_ADMIN.email)
     cy.intercept(
       'POST',
       '/users/password/generate-reset-link',
-      `[{ email: ${UserType.ORG_ADMIN}}]`,
+      `[{ email: ${TestUsers.ORG_ADMIN.email}}]`,
     ).as('requestReset')
     cy.get('button[type="submit"]').click()
     cy.wait('@requestReset')
@@ -33,6 +33,14 @@ describe('Password Reset', () => {
     cy.contains('Invalid password. Password must be at least').should('exist')
   })
 
+  it('opens password reset page and enters invalid password - easily guessable', () => {
+    cy.visit('/update-password?token=valid-reset-token')
+    cy.get('input[id="password"]').type('Testpassword1')
+    cy.get('input[id="confirmPassword"]').type('Testpassword1{enter}')
+    cy.contains('Invalid password').should('exist')
+    cy.contains('must not contain easily guessable').should('exist')
+  })
+
   it('opens password reset page and enters non-matching passwords', () => {
     cy.visit('/update-password?token=valid-reset-token')
     cy.get('input[id="password"]').type('pass')
@@ -42,30 +50,30 @@ describe('Password Reset', () => {
 
   it('requests password reset with invalid token', () => {
     cy.visit('/update-password?token=invalid-reset-token')
-    cy.get('input[id="password"]').type('Password1')
-    cy.get('input[id="confirmPassword"]').type('Password1{enter}')
+    cy.get('input[id="password"]').type(TestUsers.ORG_ADMIN.password)
+    cy.get('input[id="confirmPassword"]').type(`${TestUsers.ORG_ADMIN.password}{enter}`)
     cy.contains('Error resetting').should('exist')
   })
 
   it('requests password reset with already-used token', () => {
     cy.visit('/update-password?token=valid-reset-token')
-    cy.get('input[id="password"]').type('Password1')
-    cy.get('input[id="confirmPassword"]').type('Password1{enter}')
+    cy.get('input[id="password"]').type(TestUsers.ORG_ADMIN.password)
+    cy.get('input[id="confirmPassword"]').type(`${TestUsers.ORG_ADMIN.password}{enter}`)
     cy.contains('Success').should('exist')
 
     cy.visit('/update-password?token=valid-reset-token')
-    cy.get('input[id="password"]').type('Password1')
-    cy.get('input[id="confirmPassword"]').type('Password1{enter}')
+    cy.get('input[id="password"]').type(TestUsers.ORG_ADMIN.password)
+    cy.get('input[id="confirmPassword"]').type(`${TestUsers.ORG_ADMIN.password}{enter}`)
     cy.contains('Error').should('exist')
   })
 
   it('resets password and logs in with new password', () => {
     cy.visit('/update-password?token=valid-reset-token')
-    cy.get('input[id="password"]').type('Password1')
-    cy.get('input[id="confirmPassword"]').type('Password1{enter}')
+    cy.get('input[id="password"]').type(TestUsers.ORG_ADMIN.password)
+    cy.get('input[id="confirmPassword"]').type(`${TestUsers.ORG_ADMIN.password}{enter}`)
     cy.contains('Success').should('exist')
-    cy.get('input[name="email"]').type('test-reset-password@example.com')
-    cy.get('input[name="password"]').type('Password1')
+    cy.get('input[name="email"]').type(TestUsers.PASSWORD_RESET_USER.email)
+    cy.get('input[name="password"]').type(TestUsers.PASSWORD_RESET_USER.password)
     cy.get('button[type="submit"]').click()
     cy.contains('admin priv').should('exist')
   })