feat: consolidate 2FA settings into User Settings page

.agents/skills/churchcrm/cypress-testing.md

@@ -268,8 +268,8 @@ describe('API - User Creation', () => {
 # 1. Clear logs before reproducing
 rm -f src/logs/$(date +%Y-%m-%d)-*.log
 
-# 2. Run the failing test
-npx cypress run --spec "cypress/e2e/api/path/to/test.spec.js"
+# 2. Run the failing test (always include --config-file)
+npx cypress run --config-file cypress/configs/docker.config.ts --spec "cypress/e2e/api/path/to/test.spec.js"
 
 # 3. Check PHP logs for error
 cat src/logs/$(date +%Y-%m-%d)-php.log | tail -50
@@ -289,58 +289,70 @@ cat src/logs/$(date +%Y-%m-%d)-app.log
 
 ## Configuration
 
-### Cypress Config Files
+### Cypress Config Files <!-- learned: 2026-03-07 -->
 
-**Development:** `cypress.config.ts`
-```typescript
-export default defineConfig({
-    e2e: {
-        baseUrl: 'http://localhost:8000',
-        env: {
-            'admin.username': 'admin',
-            'admin.password': 'changeme',
-        }
-    }
-});
-```
+Config files live in `cypress/configs/` (NOT `docker/`):
 
-**CI/Docker:** `docker/cypress.config.ts`
-```typescript
-export default defineConfig({
-    e2e: {
-        baseUrl: 'http://web:8080',  // Docker service name
-        specPattern: 'cypress/e2e/**/*.spec.ts',
-    }
-});
-```
+- `cypress/configs/docker.config.ts` — standard CI/dev config (uses Docker container at `http://localhost`)
+- `cypress/configs/new-system.config.ts` — setup wizard / fresh install tests
+- `cypress/configs/base.config.ts` + `_shared.ts` — shared base configuration
+
+**CRITICAL: `npx cypress run` without `--config-file` will fail** — Cypress won't find baseUrl or test credentials. Always pass the config file.
 
-### Running Tests Locally
+**CRITICAL: Always install Cypress via `npm install`** <!-- learned: 2026-03-07 -->
+- Never use `npx cypress install` — it can produce a corrupt binary with wrong permissions.
+- If Cypress binary is broken or missing, fix with: `npx cypress cache clear && npm install`
+- The config points at a Docker container. Start the stack (`npm run docker:test`) before running tests.
+
+### Running Tests (ALWAYS use --config-file) <!-- learned: 2026-03-07 -->
 
 ```bash
-# Interactive browser testing
+# Full suite headless (standard)
+npm run test
+
+# Interactive browser runner
+npm run test:open
+
+# API tests only
+npm run test:api
+
+# UI tests only
 npm run test:ui
 
-# Headless testing (CI mode)
-npm run test
+# Single spec file — ALWAYS pass --config-file
+npx cypress run --config-file cypress/configs/docker.config.ts --spec "cypress/e2e/ui/user/standard.user.password.spec.js"
 
-# Run specific test file
-npx cypress run --spec "cypress/e2e/ui/users/create-user.cy.ts"
+# Or use npm script with -- to forward the --spec flag
+npm run test:ui -- --spec "cypress/e2e/ui/user/standard.user.password.spec.js"
 
-# Run with debug logging
-DEBUG=cypress:* npm run test
+# Setup wizard tests
+npm run test:new-system
 ```
 
-### Running Tests in Docker
+### Running Tests in Docker (Required Workflow)
+
+Tests cannot run locally without Docker — the app server lives in a container.
 
 ```bash
-# Start test containers
-npm run docker:test:start
+# 0. Ensure Node 24 is active (project requires >=24 <25)
+node --version  # must be v24.x
+
+# 1. Start test containers
+npm run docker:test
 
-# Run all tests
-npx cypress run
+# 2. Run tests
+npm run test                          # full suite
+npm run test:ui                       # UI tests only
+npm run test:api                      # API tests only
 
-# View logs after failures
+# 3. Single spec
+npx cypress run --config-file cypress/configs/docker.config.ts --spec "cypress/e2e/ui/user/standard.user.password.spec.js"
+
+# 4. View logs after failures
 npm run docker:test:logs
+
+# 5. Teardown
+npm run docker:test:down
 ```
 
 ## Test File Best Practices

locale/terms/messages.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-06 15:05+0000\n"
+"POT-Creation-Date: 2026-03-07 09:55-0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -1817,10 +1817,6 @@ msgstr ""
 msgid "Credit Card"
 msgstr ""
 
-#. Context: query_qry
-msgid "Credit Card People"
-msgstr ""
-
 msgid "Critical Configuration Error"
 msgstr ""
 
@@ -2866,6 +2862,7 @@ msgstr ""
 msgid "Ethiopia"
 msgstr ""
 
+#. Context: queryparameters_qrp
 msgid "Event"
 msgstr ""
 
@@ -3236,10 +3233,6 @@ msgstr ""
 msgid "Family Navigation"
 msgstr ""
 
-#. Context: query_qry
-msgid "Family Pledge by Fiscal Year"
-msgstr ""
-
 msgid "Family Pledges"
 msgstr ""
 
@@ -3429,16 +3422,16 @@ msgstr ""
 msgid "Find Duplicate Emails"
 msgstr ""
 
-#. Context: query_qry
-msgid "Find Registered students"
-msgstr ""
-
 msgid "Find family->"
 msgstr ""
 
 msgid "Find in MailChimp: Audience > Settings > Audience name and defaults > Audience ID"
 msgstr ""
 
+#. Context: query_qry
+msgid "Find people who didn't attend an event"
+msgstr ""
+
 #. Context: query_qry
 msgid "Find people who pledged one year but not another"
 msgstr ""
@@ -3505,14 +3498,9 @@ msgstr ""
 msgid "FirstName MiddleName LastName"
 msgstr ""
 
-#. Context: queryparameters_qrp
 msgid "Fiscal Year"
 msgstr ""
 
-#. Context: queryparameters_qrp
-msgid "Fiscal Year."
-msgstr ""
-
 msgid "Focus"
 msgstr ""
 
@@ -3849,10 +3837,6 @@ msgstr ""
 msgid "Group not found"
 msgstr ""
 
-#. Context: queryparameters_qrp
-msgid "Group of registered students"
-msgstr ""
-
 msgid "Group removed from cart"
 msgstr ""
 
@@ -4508,6 +4492,9 @@ msgstr ""
 msgid "Latvia (Latvija)"
 msgstr ""
 
+msgid "Leave blank to keep existing"
+msgstr ""
+
 msgid "Leave blank to keep existing password"
 msgstr ""
 
@@ -5036,15 +5023,16 @@ msgstr ""
 msgid "Missing PHP ZipArchive"
 msgstr ""
 
-msgid "Missing Secret Keys"
-msgstr ""
-
 msgid "Missing calendar access token"
 msgstr ""
 
 msgid "Missing families? Update coordinates to include them on the map."
 msgstr ""
 
+#. Context: query_qry
+msgid "Missing people"
+msgstr ""
+
 #. Context: query_qry
 msgid "Missing pledges"
 msgstr ""
@@ -5179,9 +5167,6 @@ msgstr ""
 msgid "Must be a valid port number (e.g., 3306)"
 msgstr ""
 
-msgid "Must be set to 'true'"
-msgstr ""
-
 msgid "Must specify non-zero check number"
 msgstr ""
 
@@ -5948,10 +5933,6 @@ msgstr ""
 msgid "People not in"
 msgstr ""
 
-#. Context: query_qry
-msgid "People who are configured to pay by credit card."
-msgstr ""
-
 #. Context: query_qry
 msgid "People with birthdays in a particular month"
 msgstr ""
@@ -6299,10 +6280,6 @@ msgstr ""
 msgid "Pledge or Payment"
 msgstr ""
 
-#. Context: query_qry
-msgid "Pledge summary by family name for each fund for the selected fiscal year"
-msgstr ""
-
 #. Context: queryparameters_qrp
 msgid "Pledged this year"
 msgstr ""
@@ -6577,10 +6554,6 @@ msgstr ""
 msgid "Register another family!"
 msgstr ""
 
-#. Context: query_qry
-msgid "Registered students"
-msgstr ""
-
 msgid "Registration Complete"
 msgstr ""
 
@@ -7035,9 +7008,6 @@ msgstr ""
 msgid "Second volunteer opportunity choice"
 msgstr ""
 
-msgid "Secret keys missing from Config.php"
-msgstr ""
-
 msgid "Secure"
 msgstr ""
 
@@ -7144,6 +7114,10 @@ msgstr ""
 msgid "Select start and end date/time"
 msgstr ""
 
+#. Context: queryparameters_qrp
+msgid "Select the desired event"
+msgstr ""
+
 #. Context: queryparameters_qrp
 msgid "Select the desired family role."
 msgstr ""
@@ -7689,9 +7663,6 @@ msgstr ""
 msgid "System Users"
 msgstr ""
 
-msgid "System configuration "
-msgstr ""
-
 msgid "System upgrade completed successfully!"
 msgstr ""
 
@@ -8192,9 +8163,6 @@ msgstr ""
 msgid "Two characters from FirstName"
 msgstr ""
 
-msgid "Two factor authentication requires ChurchCRM administrators to configure a few parameters"
-msgstr ""
-
 msgid "Two-Factor Authentication"
 msgstr ""
 
@@ -8254,9 +8222,6 @@ msgstr ""
 msgid "Ukrainian"
 msgstr ""
 
-msgid "Unable To Begin Two Factor Authentication Enrollment"
-msgstr ""
-
 msgid "Unable to display map: church address has not been geocoded yet."
 msgstr ""
 
@@ -8332,9 +8297,6 @@ msgstr ""
 msgid "Unsuccessful API Key authentication attempt"
 msgstr ""
 
-msgid "Unsupported Two Factor Authentication Configuration"
-msgstr ""
-
 msgid "Upcoming Birthdays"
 msgstr ""
 
@@ -8502,10 +8464,6 @@ msgstr ""
 msgid "User permission to create directories"
 msgstr ""
 
-#. Context: userconfig_ucfg
-msgid "User permission to export CSV files"
-msgstr ""
-
 #. Context: userconfig_ucfg
 msgid "User permission to send email via mailto: links"
 msgstr ""
@@ -9244,9 +9202,6 @@ msgstr ""
 msgid "mismatches detected"
 msgstr ""
 
-msgid "must be configured with an encryption key"
-msgstr ""
-
 msgid "needs to be picked up from"
 msgstr ""