Refactor password usage in tests and views

rsmithlal · rsmithlal · commit 32908d35a233 · 2025-11-03T21:23:15.000-03:30
- Updated password references in various test files to use a more secure password 'SecureTest123!@#' instead of 'password12345'.
- Removed redundant default parameters in translation calls in offer list item views.
- Added missing translation key for 'password' in locale files.
- Ensured consistent password usage across all user creation and login scenarios in specs.
diff --git a/app/views/better_together/joatu/offers/_offer_list_item.html.erb b/app/views/better_together/joatu/offers/_offer_list_item.html.erb
@@ -14,7 +14,7 @@
         <% response_link = joatu_offer.response_links_as_response.find { |rl| rl.source&.creator == current_person } rescue nil %>
         <% if response_link.present? %>
           <% source_type_key = response_link.source_type.demodulize.underscore rescue 'item' %>
-          <span class="badge bg-info text-dark ms-2" style="font-size: small;"><%= t('better_together.joatu.response_to_your', type: t("better_together.joatu.type.#{source_type_key}", default: response_link.source_type.demodulize), default: "Response to your %{type}", type: t("better_together.joatu.type.#{source_type_key}", default: response_link.source_type.demodulize)) %></span>
+          <span class="badge bg-info text-dark ms-2" style="font-size: small;"><%= t('better_together.joatu.response_to_your', type: t("better_together.joatu.type.#{source_type_key}", default: response_link.source_type.demodulize)) %></span>
         <% end %>
       <% end %>
     </span>
diff --git a/app/views/better_together/joatu/requests/_request_list_item.html.erb b/app/views/better_together/joatu/requests/_request_list_item.html.erb
@@ -14,7 +14,7 @@
         <% response_link = request_model.response_links_as_response.find { |rl| rl.source&.creator == current_person } rescue nil %>
         <% if response_link.present? %>
           <% source_type_key = response_link.source_type.demodulize.underscore rescue 'item' %>
-          <span class="badge bg-info text-dark ms-2" style="font-size: small;"><%= t('better_together.joatu.response_to_your', type: t("better_together.joatu.type.#{source_type_key}", default: response_link.source_type.demodulize), default: "Response to your %{type}", type: t("better_together.joatu.type.#{source_type_key}", default: response_link.source_type.demodulize)) %></span>
+          <span class="badge bg-info text-dark ms-2" style="font-size: small;"><%= t('better_together.joatu.response_to_your', type: t("better_together.joatu.type.#{source_type_key}", default: response_link.source_type.demodulize)) %></span>
         <% end %>
       <% end %>
     </span>
diff --git a/config/locales/en.yml b/config/locales/en.yml
@@ -409,6 +409,7 @@ en:
         last_sign_in_ip: Last sign in IP
         lock_version: Lock version
         locked_at: Locked at
+        password: Password
         person: :activerecord.models.person
         person_identification: :activerecord.models.person_identification
         remember_created_at: Remember created at
diff --git a/spec/controllers/better_together/person_blocks_controller_spec.rb b/spec/controllers/better_together/person_blocks_controller_spec.rb
@@ -9,7 +9,7 @@
 
   routes { BetterTogether::Engine.routes }
   let(:locale) { I18n.default_locale }
-  let(:user) { find_or_create_test_user('user@example.test', 'password12345', :user) }
+  let(:user) { find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user) }
   let(:person) { user.person }
   let(:blocked_person) { create(:better_together_person) }
   let(:another_person) { create(:better_together_person) }
diff --git a/spec/controllers/better_together/platform_invitations_controller_spec.rb b/spec/controllers/better_together/platform_invitations_controller_spec.rb
@@ -9,7 +9,7 @@
 
   routes { BetterTogether::Engine.routes }
   let(:locale) { I18n.default_locale }
-  let(:user) { find_or_create_test_user('platform_manager@example.test', 'password12345', :platform_manager) }
+  let(:user) { find_or_create_test_user('platform_manager@example.test', 'SecureTest123!@#', :platform_manager) }
   let(:person) { user.person }
   let(:platform) { create(:better_together_platform, name: 'Test Platform') }
   let(:platform_slug) { platform.slug }
diff --git a/spec/controllers/better_together/users/registrations_controller_hook_spec.rb b/spec/controllers/better_together/users/registrations_controller_hook_spec.rb
@@ -2,7 +2,7 @@
 
 require 'rails_helper'
 
-RSpec.describe BetterTogether::Users::RegistrationsController, :skip_host_setup do
+RSpec.describe BetterTogether::Users::RegistrationsController, :skip_host_setup, :user_registration do
   include BetterTogether::CapybaraFeatureHelpers
 
   routes { BetterTogether::Engine.routes }
diff --git a/spec/features/agreements/registration_consent_spec.rb b/spec/features/agreements/registration_consent_spec.rb
@@ -2,7 +2,7 @@
 
 require 'rails_helper'
 
-RSpec.describe 'User registration agreements', :as_platform_manager do
+RSpec.describe 'User registration agreements', :as_platform_manager, :user_registration do
   let!(:privacy_agreement) { BetterTogether::Agreement.find_by!(identifier: 'privacy_policy') }
   # rubocop:enable RSpec/LetSetup
   # rubocop:todo RSpec/LetSetup
@@ -13,8 +13,8 @@
     visit new_user_registration_path(locale: I18n.default_locale)
 
     fill_in 'user[email]', with: 'test@example.test'
-    fill_in 'user[password]', with: 'password12345'
-    fill_in 'user[password_confirmation]', with: 'password12345'
+    fill_in 'user[password]', with: 'SecureTest123!@#'
+    fill_in 'user[password_confirmation]', with: 'SecureTest123!@#'
     fill_in 'user[person_attributes][name]', with: 'Test User'
     fill_in 'user[person_attributes][identifier]', with: 'testuser'
     fill_in 'user[person_attributes][description]', with: 'Tester'
@@ -30,8 +30,8 @@
     visit new_user_registration_path(locale: I18n.default_locale)
 
     fill_in 'user[email]', with: 'test@example.test'
-    fill_in 'user[password]', with: 'password12345'
-    fill_in 'user[password_confirmation]', with: 'password12345'
+    fill_in 'user[password]', with: 'SecureTest123!@#'
+    fill_in 'user[password_confirmation]', with: 'SecureTest123!@#'
     fill_in 'user[person_attributes][name]', with: 'Test User'
     fill_in 'user[person_attributes][identifier]', with: 'testuser'
     fill_in 'user[person_attributes][description]', with: 'Tester'
diff --git a/spec/features/checklist_create_appends_spec.rb b/spec/features/checklist_create_appends_spec.rb
@@ -5,7 +5,7 @@
 RSpec.describe 'Checklist item creation appends to bottom', :js do
   include ActionView::RecordIdentifier
 
-  let(:manager) { find_or_create_test_user('manager@example.test', 'password12345', :platform_manager) }
+  let(:manager) { find_or_create_test_user('manager@example.test', 'SecureTest123!@#', :platform_manager) }
 
   before do
     ensure_essential_data!
diff --git a/spec/features/checklist_person_completion_spec.rb b/spec/features/checklist_person_completion_spec.rb
@@ -9,7 +9,7 @@
   let!(:person) { create(:better_together_person, user: user) }
 
   before do
-    find_or_create_test_user('user@example.test', 'password12345', :user)
+    find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user)
     capybara_login_as_user
   end
 
diff --git a/spec/features/checklist_reorder_system_spec.rb b/spec/features/checklist_reorder_system_spec.rb
@@ -6,7 +6,7 @@
   include ActionView::RecordIdentifier
 
   # Use the standard test manager credentials (password must meet length requirements)
-  let(:manager) { find_or_create_test_user('manager@example.test', 'password12345', :platform_manager) }
+  let(:manager) { find_or_create_test_user('manager@example.test', 'SecureTest123!@#', :platform_manager) }
 
   before do
     # Ensure essential data exists and log in
diff --git a/spec/features/devise/registration_spec.rb b/spec/features/devise/registration_spec.rb
@@ -3,7 +3,7 @@
 require 'rails_helper'
 
 # rubocop:disable Metrics/BlockLength
-RSpec.feature 'User Registration' do
+RSpec.feature 'User Registration', :user_registration do
   # Ensure you have a valid user created; using FactoryBot here
   let!(:host_setup_wizard) do
     BetterTogether::Wizard.find_or_create_by(identifier: 'host_setup')
diff --git a/spec/features/invitations/platform_invitation_accept_spec.rb b/spec/features/invitations/platform_invitation_accept_spec.rb
@@ -2,7 +2,7 @@
 
 require 'rails_helper'
 
-RSpec.describe 'accepting a platform invitation' do
+RSpec.describe 'accepting a platform invitation', :user_registration do
   let!(:invitation) do
     create(:better_together_platform_invitation,
            invitable: configure_host_platform)
diff --git a/spec/features/notifications/mark_as_read_spec.rb b/spec/features/notifications/mark_as_read_spec.rb
@@ -3,7 +3,7 @@
 require 'rails_helper'
 
 RSpec.describe 'message notifications', :as_user do
-  let(:user) { find_or_create_test_user('user@example.test', 'password12345', :user) }
+  let(:user) { find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user) }
   let(:person) { user.person }
   let(:conversation) { create(:conversation, creator: person) }
   # let!(:conversation_participant) do
diff --git a/spec/mailers/better_together/event_mailer_spec.rb b/spec/mailers/better_together/event_mailer_spec.rb
@@ -41,7 +41,9 @@ module BetterTogether # rubocop:todo Metrics/ModuleLength
 
       context 'when event has location' do
         it 'includes location information' do
-          expect(mail.body.encoded).to include(event.location_display_name)
+          # HTML-encoded version of location name due to ERB escaping
+          expected_location = ERB::Util.html_escape(event.location_display_name)
+          expect(mail.body.encoded).to include(expected_location)
         end
       end
 
diff --git a/spec/policies/better_together/conversation_policy_spec.rb b/spec/policies/better_together/conversation_policy_spec.rb
@@ -7,7 +7,7 @@
 
   let!(:host_platform) { configure_host_platform }
 
-  let!(:manager_user) { create(:user, :confirmed, :platform_manager, password: 'password12345') }
+  let!(:manager_user) { create(:user, :confirmed, :platform_manager, password: 'SecureTest123!@#') }
   let!(:manager_person) { manager_user.person }
 
   let!(:opted_in_person) do
@@ -26,7 +26,7 @@
     end
 
     context 'when agent is a regular member' do
-      let!(:regular_user) { create(:user, :confirmed, password: 'password12345') }
+      let!(:regular_user) { create(:user, :confirmed, password: 'SecureTest123!@#') }
 
       it 'includes platform managers and opted-in members, but not non-opted members' do
         # rubocop:enable RSpec/MultipleExpectations
@@ -39,7 +39,7 @@
   end
 
   describe '#create? with participants kwarg' do
-    let(:regular_user) { create(:user, :confirmed, password: 'password12345') }
+    let(:regular_user) { create(:user, :confirmed, password: 'SecureTest123!@#') }
     let(:policy) { described_class.new(regular_user, BetterTogether::Conversation.new) }
 
     it 'allows create when user present and participants are permitted' do
diff --git a/spec/requests/better_together/checklist_items_reorder_spec.rb b/spec/requests/better_together/checklist_items_reorder_spec.rb
@@ -3,11 +3,14 @@
 require 'rails_helper'
 
 RSpec.describe 'ChecklistItems Reorder' do
+  include AutomaticTestConfiguration
+
   let(:locale) { I18n.default_locale }
-  let(:platform_manager) { find_or_create_test_user('manager@example.test', 'password12345', :platform_manager) }
+  let(:platform_manager) { find_or_create_test_user('manager@example.test', 'SecureTest123!@#', :platform_manager) }
 
   before do
-    login(platform_manager.email, 'password12345')
+    configure_host_platform
+    login(platform_manager.email, 'SecureTest123!@#')
   end
 
   # rubocop:todo RSpec/MultipleExpectations
diff --git a/spec/requests/better_together/checklists_spec.rb b/spec/requests/better_together/checklists_spec.rb
@@ -59,11 +59,11 @@
     # rubocop:todo RSpec/MultipleExpectations
     it 'allows creator to update their checklist' do # rubocop:todo RSpec/MultipleExpectations
       # rubocop:enable RSpec/MultipleExpectations
-      user = create(:better_together_user, :confirmed, password: 'password12345')
+      user = create(:better_together_user, :confirmed, password: 'SecureTest123!@#')
       checklist = create(:better_together_checklist, creator: user.person)
 
       # sign in as that user
-      login(user.email, 'password12345')
+      login(user.email, 'SecureTest123!@#')
 
       patch better_together.checklist_path(checklist, locale: I18n.default_locale),
             params: { checklist: { title_en: 'Creator Update' } }
diff --git a/spec/requests/better_together/conversation_message_protection_spec.rb b/spec/requests/better_together/conversation_message_protection_spec.rb
@@ -11,11 +11,12 @@
     configure_host_platform
 
     # Setup: create a manager user (owner of the conversation) and another user
-    manager_user = create(:user, :confirmed, :platform_manager, email: 'owner@example.test', password: 'password12345')
-    other_user = create(:user, :confirmed, email: 'attacker@example.test', password: 'password12345')
+    manager_user = create(:user, :confirmed, :platform_manager, email: 'owner@example.test',
+                                                                password: 'SecureTest123!@#')
+    other_user = create(:user, :confirmed, email: 'attacker@example.test', password: 'SecureTest123!@#')
 
     # Create a conversation as the manager with a nested message
-    login(manager_user.email, 'password12345')
+    login(manager_user.email, 'SecureTest123!@#')
 
     post better_together.conversations_path(locale: I18n.default_locale), params: {
       conversation: {
@@ -34,7 +35,7 @@
 
     # Now sign in as other_user and attempt to change manager's message via PATCH
     logout
-    login(other_user.email, 'password12345')
+    login(other_user.email, 'SecureTest123!@#')
 
     patch better_together.conversation_path(conversation, locale: I18n.default_locale), params: {
       conversation: {
diff --git a/spec/requests/better_together/conversations_create_with_message_spec.rb b/spec/requests/better_together/conversations_create_with_message_spec.rb
@@ -10,9 +10,9 @@
     # Ensure the test user exists and is confirmed
     unless BetterTogether::User.find_by(email: 'user@example.test')
       create(:user, :confirmed, email: 'user@example.test',
-                                password: 'password12345')
+                                password: 'SecureTest123!@#')
     end
-    login('user@example.test', 'password12345')
+    login('user@example.test', 'SecureTest123!@#')
   end
 
   # rubocop:todo RSpec/MultipleExpectations
diff --git a/spec/requests/better_together/conversations_request_spec.rb b/spec/requests/better_together/conversations_request_spec.rb
@@ -6,7 +6,7 @@
   include RequestSpecHelper
 
   let!(:manager_user) do
-    create(:user, :confirmed, :platform_manager, email: 'manager1@example.test', password: 'password12345')
+    create(:user, :confirmed, :platform_manager, email: 'manager1@example.test', password: 'SecureTest123!@#')
   end
   let!(:opted_in_person) do
     create(:better_together_person, preferences: { receive_messages_from_members: true }, name: 'Opted In User')
diff --git a/spec/requests/better_together/event_invitation_token_processing_spec.rb b/spec/requests/better_together/event_invitation_token_processing_spec.rb
@@ -11,7 +11,7 @@
       existing
     end
   end
-  let!(:manager_user) { find_or_create_test_user('manager@example.test', 'password12345', :platform_manager) }
+  let!(:manager_user) { find_or_create_test_user('manager@example.test', 'SecureTest123!@#', :platform_manager) }
 
   let!(:event) do
     BetterTogether::Event.create!(
diff --git a/spec/requests/better_together/event_invitations_spec.rb b/spec/requests/better_together/event_invitations_spec.rb
@@ -122,11 +122,11 @@
 
       # Ensure user exists and logged in as regular user
       user = BetterTogether::User.find_by(email: 'user@example.test') ||
-             create(:better_together_user, :confirmed, email: 'user@example.test', password: 'password12345')
+             create(:better_together_user, :confirmed, email: 'user@example.test', password: 'SecureTest123!@#')
 
       # Clear any existing session and login as the specific user
       logout if respond_to?(:logout)
-      login(user.email, 'password12345')
+      login(user.email, 'SecureTest123!@#')
 
       post better_together.accept_invitation_path(invitation.token, locale: locale)
 
@@ -148,11 +148,11 @@
                           valid_from: Time.current)
 
       user = BetterTogether::User.find_by(email: 'user@example.test') ||
-             create(:better_together_user, :confirmed, email: 'user@example.test', password: 'password12345')
+             create(:better_together_user, :confirmed, email: 'user@example.test', password: 'SecureTest123!@#')
 
       # Clear any existing session and login as the specific user
       logout if respond_to?(:logout)
-      login(user.email, 'password12345')
+      login(user.email, 'SecureTest123!@#')
 
       post better_together.decline_invitation_path(invitation.token, locale: locale)
 
diff --git a/spec/requests/better_together/events_controller_spec.rb b/spec/requests/better_together/events_controller_spec.rb
@@ -87,7 +87,7 @@
 
   describe 'RSVP actions' do
     let(:user_email) { 'manager@example.test' }
-    let(:password) { 'password12345' }
+    let(:password) { 'SecureTest123!@#' }
     let(:event) do
       BetterTogether::Event.create!(name: 'RSVP Test', starts_at: 1.day.from_now, identifier: SecureRandom.uuid)
     end
diff --git a/spec/requests/better_together/joatu/agreements_spec.rb b/spec/requests/better_together/joatu/agreements_spec.rb
@@ -4,7 +4,7 @@
 
 # rubocop:disable Metrics/BlockLength
 RSpec.describe 'BetterTogether::Joatu::Agreements', :as_user do
-  let(:user) { find_or_create_test_user('user@example.test', 'password12345', :user) }
+  let(:user) { find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user) }
   let(:person) { user.person }
   let(:offer) { create(:joatu_offer) }
   let(:request_record) { create(:joatu_request, creator: person) }
diff --git a/spec/requests/better_together/joatu/offers_aggregated_matches_spec.rb b/spec/requests/better_together/joatu/offers_aggregated_matches_spec.rb
@@ -9,7 +9,7 @@
     # Current authenticated user creating an offer
     current_user = BetterTogether::User.find_by(email: 'user@example.test') ||
                    FactoryBot.create(:better_together_user, :confirmed,
-                                     email: 'user@example.test', password: 'password12345')
+                                     email: 'user@example.test', password: 'SecureTest123!@#')
     my_person = current_user.person
 
     # Ensure both records share a category so they match
diff --git a/spec/requests/better_together/joatu/offers_spec.rb b/spec/requests/better_together/joatu/offers_spec.rb
@@ -4,7 +4,7 @@
 
 # rubocop:disable Metrics/BlockLength
 RSpec.describe 'BetterTogether::Joatu::Offers', :as_user do
-  let(:user) { find_or_create_test_user('user@example.test', 'password12345', :user) }
+  let(:user) { find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user) }
   let(:person) { user.person }
   let(:category) { create(:better_together_joatu_category) }
   let(:valid_attributes) do
diff --git a/spec/requests/better_together/joatu/requests_aggregated_matches_spec.rb b/spec/requests/better_together/joatu/requests_aggregated_matches_spec.rb
@@ -9,7 +9,7 @@
     # Current authenticated user creating a request
     current_user = BetterTogether::User.find_by(email: 'user@example.test') ||
                    FactoryBot.create(:better_together_user, :confirmed,
-                                     email: 'user@example.test', password: 'password12345')
+                                     email: 'user@example.test', password: 'SecureTest123!@#')
     my_person = current_user.person
 
     # Ensure both records share a category so they match
diff --git a/spec/requests/better_together/joatu/requests_spec.rb b/spec/requests/better_together/joatu/requests_spec.rb
@@ -7,7 +7,7 @@
   include AutomaticTestConfiguration
 
   let(:locale) { I18n.default_locale }
-  let(:person) { find_or_create_test_user('user@example.test', 'password12345', :user).person }
+  let(:person) { find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user).person }
   let(:category) { create(:better_together_joatu_category) }
   let(:valid_attributes) do
     { name: 'New Request', description: 'Request description', creator_id: person.id,
diff --git a/spec/requests/better_together/joatu/response_links_controller_spec.rb b/spec/requests/better_together/joatu/response_links_controller_spec.rb
@@ -3,7 +3,7 @@
 require 'rails_helper'
 
 RSpec.describe BetterTogether::Joatu::ResponseLinksController, :as_user do
-  let(:user) { create(:user, :confirmed, password: 'password12345') }
+  let(:user) { create(:user, :confirmed, password: 'SecureTest123!@#') }
   let(:person) { user.person }
   let(:offer) { create(:better_together_joatu_offer, creator: person) }
   let(:request_resource) { create(:better_together_joatu_request) }
diff --git a/spec/requests/better_together/notifications_controller_spec.rb b/spec/requests/better_together/notifications_controller_spec.rb
@@ -5,7 +5,7 @@
 module BetterTogether # rubocop:todo Metrics/ModuleLength
   RSpec.describe NotificationsController, :as_user do
     let!(:notification) { create(:noticed_notification, recipient: person) }
-    let!(:user) { find_or_create_test_user('user@example.test', 'password12345', :user) }
+    let!(:user) { find_or_create_test_user('user@example.test', 'SecureTest123!@#', :user) }
     let(:person) { user.person }
 
     describe 'GET #index' do
diff --git a/spec/requests/better_together/person_checklist_items_spec.rb b/spec/requests/better_together/person_checklist_items_spec.rb
@@ -13,8 +13,8 @@
   before do
     configure_host_platform
     # Use project's HTTP login helper to satisfy route constraints
-    test_user = find_or_create_test_user(user.email, 'password12345', :user)
-    login(test_user.email, 'password12345')
+    test_user = find_or_create_test_user(user.email, 'SecureTest123!@#', :user)
+    login(test_user.email, 'SecureTest123!@#')
   end
 
   # rubocop:todo RSpec/MultipleExpectations
diff --git a/spec/requests/better_together/platform_privacy_with_event_invitations_spec.rb b/spec/requests/better_together/platform_privacy_with_event_invitations_spec.rb
diff --git a/spec/support/automatic_test_configuration.rb b/spec/support/automatic_test_configuration.rb
diff --git a/spec/support/better_together/capybara_feature_helpers.rb b/spec/support/better_together/capybara_feature_helpers.rb
diff --git a/spec/support/better_together/devise_session_helpers.rb b/spec/support/better_together/devise_session_helpers.rb
diff --git a/spec/support/request_spec_helper.rb b/spec/support/request_spec_helper.rb
diff --git a/spec/support/test_seed_helpers.rb b/spec/support/test_seed_helpers.rb

-Original file line number
+Diff line change
   let!(:person) { create(:better_together_person, user: user) }
   before do
 -    find_or_create_test_user('[email protected]', 'password12345', :user)
 +    find_or_create_test_user('[email protected]', 'SecureTest123!@#', :user)
     capybara_login_as_user
   end