Skip to content

feat: password requirements admin (M2-10506) - #2207

Merged
adeiji merged 45 commits into
developfrom
feature/password-requirements-admin
Apr 27, 2026
Merged

feat: password requirements admin (M2-10506)#2207
adeiji merged 45 commits into
developfrom
feature/password-requirements-admin

Conversation

@sricharan-varanasi

@sricharan-varanasi sricharan-varanasi commented Apr 7, 2026

Copy link
Copy Markdown
Contributor
  • Tests for the changes have been added
  • Related documentation has been added / updated
  • OSS packages added to Curious open source credit page
  • Delivered the fix or feature branches into develop or release branches via Squash and Merge (to keep clean history)

📝 Description

🔗 Jira Ticket M2-10506

Changes include:

  • added shared Unicode-aware password validation with NFC normalization
  • enforced the updated password policy in Sign Up and Recover Password
  • added a password requirements tooltip with live checklist feedback
  • set Login min-length to 6 (legacy minimum) so existing users are not blocked by the new 10-character policy

🪤 Peer Testing

  1. Open the Sign Up form and enter abcdefghij.
    Expected outcome: after a short delay, the password field shows a validation error; the tooltip shows minimum length and no spaces as met, but the character-type requirement is not met.

  2. Replace it with Abcdef123!.
    Expected outcome: the validation error clears and the tooltip shows the password meets the minimum length and at least 3 character types.

  3. Enter Abcd 1234!.
    Expected outcome: the whitespace rule fails and the tooltip shows the no-spaces requirement as not met.

  4. Open the Recover Password form and repeat the invalid and valid password checks above.
    Expected outcome: Recover Password matches the same validation and tooltip behavior as Sign Up.

  5. Open the Login form and enter a 6-character password such as Pass1!.
    Expected outcome: no min-length validation error. Enter a 5-character password & a min-length error appears. The form still requires a password and rejects passwords with spaces.

  6. On Sign Up or Recover Password, try a password with accented letters such as Éclair123!a.
    Expected outcome: accented uppercase and lowercase letters are counted correctly toward the character-type checks.

✏️ Notes

  • This PR updates admin-side validation only.
  • TODO : The designs have to be updated accordingly when we have them

@sricharan-varanasi sricharan-varanasi added the Do not merge Pull request cannot be merged for some reason label Apr 7, 2026
@aws-amplify-us-east-1

Copy link
Copy Markdown

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-2207.d2ccder08v9rmu.amplifyapp.com

@sricharan-varanasi
sricharan-varanasi force-pushed the feature/password-requirements-admin branch from 7fc3d57 to 5519205 Compare April 7, 2026 21:15
@sricharan-varanasi sricharan-varanasi removed the Do not merge Pull request cannot be merged for some reason label Apr 7, 2026
@sricharan-varanasi sricharan-varanasi changed the title Feature/password requirements admin feat: password requirements admin (M2-10506) Apr 7, 2026
Comment thread src/modules/Auth/features/SignUp/SignUpForm/SignUpForm.schema.ts Outdated

@adeiji adeiji left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks great! Just left one comment/question about using constants.

@divbzero divbzero left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sricharan-varanasi I left several comments: 2 of them are [Important] to fix, while the rest are minor and you can use your judgment on whether to clean up.

Going to Approve but make sure you fix the 2 [Important] comments before merging.

Comment thread src/resources/app-en.json Outdated
Comment thread src/resources/app-en.json Outdated
Comment thread src/resources/app-fr.json Outdated
Comment thread src/resources/app-fr.json Outdated
Comment thread src/shared/utils/passwordPatterns.ts Outdated
Comment thread src/modules/Auth/features/RecoverPassword/RecoverForm/RecoverForm.schema.ts Outdated
Comment thread src/modules/Auth/features/RecoverPassword/RecoverForm/RecoverForm.tsx Outdated
Comment thread src/modules/Auth/features/RecoverPassword/RecoverForm/RecoverForm.tsx Outdated
Comment thread src/modules/Auth/features/RecoverPassword/RecoverForm/RecoverForm.tsx Outdated
Comment thread src/shared/utils/passwordValidation.ts
Comment thread src/modules/Auth/features/SignUp/SignUpForm/SignUpForm.tsx Outdated
divbzero added a commit to ChildMindInstitute/mindlogger-backend-refactor that referenced this pull request Apr 9, 2026
divbzero added a commit to ChildMindInstitute/mindlogger-backend-refactor that referenced this pull request Apr 13, 2026
…2038)

🔗 [Jira Ticket M2-10505](https://mindlogger.atlassian.net/browse/M2-10505)

Changes include:

- Validate caseless characters in passwords as both uppercase and lowercase.

This is a follow-up to pull request #2036. After thinking through @jodybrookover’s comments, seems to make sense to allow caseless characters in passwords to validate as both uppercase and lowercase letters. There tend to be more caseless characters than uppercase or lowercase letters, and this matches the behavior already implemented on the frontend with:

- ChildMindInstitute/mindlogger-admin#2207
- ChildMindInstitute/mindlogger-app-refactor#1089
- ChildMindInstitute/mindlogger-web-refactor#719
@adeiji
adeiji requested a review from aweiland April 15, 2026 12:39

@divbzero divbzero left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@adeiji Your additional changes from last week look good! I added just a few minor comments that we can consider fixing.

Comment thread src/modules/Auth/features/RecoverPassword/RecoverForm/RecoverForm.tsx Outdated
Comment thread src/modules/Auth/features/SignUp/SignUpForm/SignUpForm.tsx Outdated
Comment thread src/resources/app-en.json Outdated

@divbzero divbzero left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New changes look good! Should be ready to merge as long as we’re good with testing.

Comment thread src/shared/components/PasswordRequirementsSection/PasswordRequirementsSection.tsx Outdated
Comment thread src/modules/Auth/features/SignUp/SignUpForm/SignUpForm.test.tsx Outdated
Comment thread src/shared/utils/passwordPatterns.ts
adeiji added 2 commits April 27, 2026 11:11
…ops rather then constant in PasswordRequirementsSection.tsx
@adeiji
adeiji merged commit 8a33aca into develop Apr 27, 2026
4 checks passed
divbzero added a commit to ChildMindInstitute/mindlogger-backend-refactor that referenced this pull request Apr 27, 2026
🔗 [Jira Ticket M2-10505](https://mindlogger.atlassian.net/browse/M2-10505)

Changes include:

- Reject passwords that contain standard emoji or regional indicators.

This is a follow-up to pull requests #2036 and #2038 that brings backend password validation in line with what @adeiji implemented for emojis on the front end in:

- ChildMindInstitute/mindlogger-admin#2207
- ChildMindInstitute/mindlogger-app-refactor#1089
- ChildMindInstitute/mindlogger-web-refactor#719
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants