491: Restrict passwords

FU.API/FU.API.Tests/AccountServiceTests.cs

@@ -48,7 +48,7 @@ public void Dispose()
     public async void CreateUser_WithValidCredentials_ReturnsUser()
     {
         // Arange
-        Credentials credentials = new() { Username = "Test", Password = "Test" };
+        Credentials credentials = new() { Username = "Test", Password = "Test12345" };
 
         // Act
         ApplicationUser user = await _accountsService.Register(credentials);
@@ -62,7 +62,7 @@ public async void CreateUser_WithValidCredentials_ReturnsUser()
     public async void ChangeUsername_WithValidUsername_ChangesUsername()
     {
         // Arange
-        Credentials credentials = new() { Username = "Username1", Password = "Test" };
+        Credentials credentials = new() { Username = "Username1", Password = "Test12345" };
         string newUsername = "Username2";
         ApplicationUser user = await _accountsService.Register(credentials);
 

FU.API/FU.API.Tests/PostServiceTests.cs

@@ -137,7 +137,7 @@ public async void GetPostUsers_WithMultipleUsers_ReturnsCorrectUserCount()
         // Arrange
         // Note: CreateTestPostAsync creates one user as part of creating a post
         Post post = await TestsHelper.CreateTestPostAsync(_dbContext);
-        var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials() { Username = "user2", Password = "pass2", Email = "[email protected]" });
+        var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials() { Username = "user2", Password = "Test12345", Email = "[email protected]" });
         await _postService.JoinPost(post.Id, user2);
 
         // Act
@@ -166,7 +166,7 @@ public async void JoinPost_WhenAlreadyMember_ThrowsConflictException()
     {
         // Arrange
         Post post = await TestsHelper.CreateTestPostAsync(_dbContext);
-        var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials() { Username = "user2", Password = "pass2", Email = "[email protected]" });
+        var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials() { Username = "user2", Password = "Test12345", Email = "[email protected]" });
         await _postService.JoinPost(post.Id, user2);
 
         // Act & Assert
@@ -180,7 +180,7 @@ public async void LeavePost_WhenMember_LeavesPost()
     {
         // Arrange
         Post post = await TestsHelper.CreateTestPostAsync(_dbContext);
-        var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials() { Username = "user2", Password = "pass2", Email = "[email protected]" });
+        var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials() { Username = "user2", Password = "Test12345", Email = "[email protected]" });
         await _postService.JoinPost(post.Id, user2);
 
         // Act

FU.API/FU.API.Tests/SearchServiceSearchUsersTests.cs

@@ -56,19 +56,19 @@ public async Task Search_WithKeyword_SearchesTitleAndBio()
         {
             Username = "User1",
             Email = "[email protected]",
-            Password = "Pass1"
+            Password = "Test12345"
         });
         var user2 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials()
         {
             Username = "User2",
             Email = "[email protected]",
-            Password = "Pass2"
+            Password = "Test12345"
         });
         var user3 = await TestsHelper.CreateUserAsync(_dbContext, new Credentials()
         {
             Username = "User3",
             Email = "[email protected]",
-            Password = "Pass3"
+            Password = "Test12345"
         });
         await _userService.UpdateUserProfile(new UserProfile() { Bio = "Bio3", Id = user3.UserId });
 

FU.API/FU.API.Tests/TestsHelper.cs

@@ -17,7 +17,7 @@ public static async Task<Game> CreateTestGameAsync(AppDbContext dbContext)
 
     public static async Task<ApplicationUser> CreateUserAsync(AppDbContext context)
     {
-        Credentials credentials = new() { Username = "Test", Password = "Test", Email = "[email protected]" };
+        Credentials credentials = new() { Username = "Test", Password = "Test12345", Email = "[email protected]" };
         return await CreateUserAsync(context, credentials);
     }
 

FU.API/FU.API/Services/AccountsService.cs

@@ -71,6 +71,13 @@ public async Task<ApplicationUser> Register(Credentials credentials)
             throw new ConflictException("User with email already exists");
         }
 
+        // Make sure the password is valid
+        // Must be 5 characters or longer, and contain at least one special character or number
+        if (credentials.Password.Length < 8 || !credentials.Password.Any(c => char.IsDigit(c) || char.IsPunctuation(c)))
+        {
+            throw new BadRequestException("Password must be at least 8 characters long and contain at least one special character or number");
+        }
+
         _dbContext.Users.Add(new ApplicationUser()
         {
             Username = credentials.Username,

FU.SPA/src/components/pages/SignUp.jsx

@@ -30,15 +30,12 @@ export default function SignUp() {
   const [username, setUsername] = useState('');
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
-  const [confirmPassword, setConfirmPassword] = useState('');
   const [confirmedReadTerms, setConfirmedReadTerms] = useState(false);
   const [showPassword, setShowPassword] = useState(false);
-  const [showConfirmPassword, setShowConfirmPassword] = useState(false);
 
   // Showing passwords when user wants
   const handleClickShowPassword = () => {
     setShowPassword(!showPassword);
-    setShowConfirmPassword(!showConfirmPassword);
   };
 
   // Update state for username
@@ -59,18 +56,11 @@ export default function SignUp() {
     setPasswordError('');
   };
 
-  // Update state for confirmed password
-  const handleConfirmPasswordChange = (event) => {
-    setConfirmPassword(event.target.value);
-    setPasswordError('');
-  };
-
   // Check if all fields are filled
   const isEnabled =
     username.length > 0 &&
     email.length > 0 &&
-    password.length > 0 &&
-    confirmPassword.length > 0 &&
+    password.length >= 8 &&
     confirmedReadTerms;
 
   // Function called when button is pressed
@@ -84,12 +74,6 @@ export default function SignUp() {
       password: data.get('password'),
     };
 
-    // Checking if passwords are identical
-    if (creds.password !== data.get('confirmPassword')) {
-      setPasswordError('Passwords do not match');
-      return;
-    }
-
     // This try/catch block will attempt to sign the user up, check for any
     // errors in signup, and redirect to signin/last page if there are no errors
     try {
@@ -128,6 +112,9 @@ export default function SignUp() {
       } else if (errorResponse?.status === 409) {
         // Duplicate email
         setEmailError(errorResponse.detail);
+      } else if (errorResponse?.status === 400) {
+        // bad password
+        setPasswordError(errorResponse.detail);
       } else if (errorResponse?.errors?.Email) {
         setEmailError(errorResponse.errors.Email[0]);
       } else {
@@ -189,7 +176,10 @@ export default function SignUp() {
             <Grid item xs={12}>
               <TextField
                 error={!!passwordError}
-                helperText={passwordError}
+                helperText={
+                  passwordError ||
+                  'Password must be 8 characters long and contain either 1 special character or number'
+                }
                 onChange={handlePasswordChange}
                 required
                 fullWidth
@@ -213,20 +203,6 @@ export default function SignUp() {
                 }}
               />
             </Grid>
-            <Grid item xs={12}>
-              <TextField
-                error={!!passwordError}
-                helperText={passwordError}
-                onChange={handleConfirmPasswordChange}
-                required
-                fullWidth
-                name="confirmPassword"
-                label="Confirm Password"
-                type={showConfirmPassword ? 'text' : 'password'}
-                id="confirmPassword"
-                autoComplete="new-password"
-              />
-            </Grid>
           </Grid>
           <Grid item sx={{ mt: 1 }}>
             <ConfirmedCheckbox