Files
b51b4a8937 Fix FIPS-incompatible passwords and config in e2e test suites (#36001)
* Fix FIPS-incompatible passwords and config in e2e test suites

FIPS OpenSSL requires PBKDF2 HMAC keys >= 14 bytes, so the server
now enforces PasswordSettings.MinimumLength >= 14 under FIPS builds.
The e2e suites were failing (Cypress 0/447, Playwright 16/353) because
they used short passwords and set MinimumLength below the FIPS floor.

- Add newTestPassword() to both Cypress and Playwright utilities,
  returning a static FIPS-compliant password (>= 14 chars)
- Replace all short hardcoded Mattermost user passwords ('passwd',
  'Test123456!', 'Testing123', 'Password123!') with newTestPassword()
- Raise PasswordSettings.MinimumLength from 5 to 14 in default configs
- Update password validation tests for the FIPS minimum (error messages,
  default expectations, test password lengths)

* Fix additional FIPS e2e test failures

- Revert server-constant-dependent assertions (MinimumLength defaults
  and validation errors) since those depend on FIPS build tags, not config
- Fix short hardcoded passwords in signup, forgot_password, and
  existing_email_address specs to use newTestPassword()
- Fix password_spec cancel test to use a different password than
  testUser.password (both resolve to newTestPassword())
- Fix Playwright password reset test to use newTestPassword() instead
  of pw.random.id() (7 chars, too short for MinimumLength=14)
- Update password help text assertions to match MinimumLength=14 config
- Use regex for Playwright signup page password error locator
- Fix import order in ABAC support.ts

* Fix FIPS vs non-FIPS build-dependent e2e test assertions

The server's password minimum constants differ between FIPS (14) and
non-FIPS (8/5) builds. Make three test assertions adaptive:

- MM-T1770: Accept default MinimumLength of either 8 or 14
- MM-T1771: Match validation error with either 5 or 14 as the minimum
- MM-T1773: Reload after save and compare against actual server config,
  since saving MinimumLength=5 (webapp default) is rejected on FIPS

* e2e: upgrade demo plugin to v0.11.0 and configure required settings

* update demo plugin download link

---------

Co-authored-by: sabril <[email protected]>
2026-04-13 12:52:13 +08:00

258 lines
8.0 KiB
TypeScript

// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
import * as TIMEOUTS from '../../../fixtures/timeouts';
import {getAdminAccount} from '../../../support/env';
import {newTestPassword} from '../../../utils';
export type SimpleUser = Pick<Cypress.UserProfile, 'username' | 'first_name' | 'last_name' | 'nickname' | 'password' | 'email'>;
function createPrivateChannel(teamId: string, userToAdd: Cypress.UserProfile = null) {
// # Create a private channel as sysadmin
return createChannel('P', teamId, userToAdd);
}
function createPublicChannel(teamId: string, userToAdd: Cypress.UserProfile = null) {
// # Create a public channel as sysadmin
return createChannel('O', teamId, userToAdd);
}
function createSearchData(prefix: string) {
return cy.apiCreateCustomAdmin({loginAfter: true, hideAdminTrialModal: true}).then(({sysadmin}) => {
const users = getTestUsers(prefix);
cy.apiLogin(sysadmin);
// # Create new team for tests
return cy.apiCreateTeam('search', 'Search').then(({team}) => {
// # Create pool of users for tests
Cypress._.forEach(users, (testUser) => {
cy.apiCreateUser({user: testUser}).then(({user}) => {
cy.apiAddUserToTeam(team.id, user.id);
});
});
return cy.wrap({sysadmin, team, users});
});
});
}
function getTestUsers(prefix = ''): Record<string, SimpleUser> {
if (Cypress.env('searchTestUsers')) {
return JSON.parse(Cypress.env('searchTestUsers'));
}
return {
ironman: generatePrefixedUser({
username: 'ironman',
first_name: 'Tony',
last_name: 'Stark',
nickname: 'protoncannon',
}, prefix),
hulk: generatePrefixedUser({
username: 'hulk',
first_name: 'Bruce',
last_name: 'Banner',
nickname: 'gammaray',
}, prefix),
hawkeye: generatePrefixedUser({
username: 'hawkeye',
first_name: 'Clint',
last_name: 'Barton',
nickname: 'ronin',
}, prefix),
deadpool: generatePrefixedUser({
username: 'deadpool',
first_name: 'Wade',
last_name: 'Wilson',
nickname: 'merc',
}, prefix),
captainamerica: generatePrefixedUser({
username: 'captainamerica',
first_name: 'Steve',
last_name: 'Rogers',
nickname: 'professional',
}, prefix),
doctorstrange: generatePrefixedUser({
username: 'doctorstrange',
first_name: 'Stephen',
last_name: 'Strange',
nickname: 'sorcerersupreme',
}, prefix),
thor: generatePrefixedUser({
username: 'thor',
first_name: 'Thor',
last_name: 'Odinson',
nickname: 'mjolnir',
}, prefix),
loki: generatePrefixedUser({
username: 'loki',
first_name: 'Loki',
last_name: 'Odinson',
nickname: 'trickster',
}, prefix),
dot: generatePrefixedUser({
username: 'dot.dot',
first_name: 'z1First',
last_name: 'z1Last',
nickname: 'z1Nick',
}, prefix),
dash: generatePrefixedUser({
username: 'dash-dash',
first_name: 'z2First',
last_name: 'z2Last',
nickname: 'z2Nick',
}, prefix),
underscore: generatePrefixedUser({
username: 'under_score',
first_name: 'z3First',
last_name: 'z3Last',
nickname: 'z3Nick',
}, prefix),
};
}
function getPostTextboxInput() {
cy.wait(TIMEOUTS.HALF_SEC);
cy.uiGetPostTextBox().
as('input').
clear();
}
function getQuickChannelSwitcherInput() {
cy.findByRole('combobox', {name: 'quick switch input'}).
should('be.visible').
as('input').
clear();
}
function searchAndVerifyChannel(channel: Cypress.Channel, shouldExist = true) {
const name = channel.display_name;
searchForChannel(name);
if (shouldExist) {
// * Channel should appear in suggestions list
cy.get('#suggestionList').findByTestId(channel.name).should('be.visible');
} else {
// * Suggestion list and channel item should not appear
cy.get('#suggestionList').should('not.exist');
cy.findByTestId(channel.name).should('not.exist');
}
}
function searchAndVerifyUser(user: Cypress.UserProfile) {
// # Start @ mentions autocomplete with username
cy.uiGetPostTextBox().
as('input').
clear().
type(`@${user.username}`);
// * Suggestion list should appear
cy.get('#suggestionList', {timeout: TIMEOUTS.FIVE_SEC}).should('be.visible');
// * Verify user appears in results post-change
return cy.uiVerifyAtMentionSuggestion(user);
}
function searchForChannel(name: string) {
// # Open up channel switcher
cy.typeCmdOrCtrl().type('k').wait(TIMEOUTS.ONE_SEC);
// # Clear out and type in the name
cy.findByRole('combobox', {name: 'quick switch input'}).
should('be.visible').
as('input').
clear().
type(name);
}
function startAtMention(string: string) {
// # Get the expected input
cy.get('@input').clear().type(string);
// * Suggestion list should appear
cy.get('#suggestionList').should('be.visible');
}
function verifySuggestionAtPostTextbox(...expectedUsers: SimpleUser[]) {
expectedUsers.forEach((user) => {
cy.wait(TIMEOUTS.HALF_SEC);
cy.uiVerifyAtMentionSuggestion(user);
});
}
function verifySuggestionAtChannelSwitcher(...expectedUsers: SimpleUser[]) {
expectedUsers.forEach((user) => {
cy.findByTestId(user.username).
should('be.visible').
and('have.text', `${user.first_name} ${user.last_name} (${user.nickname})@${user.username}`);
});
}
function createChannel(channelType: string, teamId: string, userToAdd: Cypress.UserProfile = null) {
// # Create a channel as sysadmin
return cy.externalRequest({
user: getAdminAccount(),
method: 'POST',
path: 'channels',
data: {
team_id: teamId,
name: 'test-channel' + Date.now(),
display_name: 'Test Channel ' + Date.now(),
type: channelType,
header: '',
purpose: '',
},
}).then(({data: channel}) => {
if (userToAdd) {
// # Get user profile by email
return cy.apiGetUserByEmail(userToAdd.email).then(({user}) => {
// # Add user to channel
cy.externalAddUserToChannel(user.id, channel.id).then(() => {
// # Explicitly wait to give some time to index before searching
cy.wait(TIMEOUTS.TWO_SEC);
return cy.wrap(channel);
});
});
}
// # Explicitly wait to give some time to index before searching
cy.wait(TIMEOUTS.TWO_SEC);
return cy.wrap(channel);
});
}
function generatePrefixedUser(user: Omit<SimpleUser, 'password' | 'email'>, prefix: string) {
return {
username: withPrefix(user.username, prefix),
password: newTestPassword(),
first_name: withPrefix(user.first_name, prefix),
last_name: withPrefix(user.last_name, prefix),
email: createEmail(user.username, prefix),
nickname: withPrefix(user.nickname, prefix),
};
}
function withPrefix(name: string, prefix: string) {
return prefix + name;
}
function createEmail(name: string, prefix: string) {
return `${prefix}${name}@sample.mattermost.com`;
}
export {
createPrivateChannel,
createPublicChannel,
createSearchData,
getTestUsers,
getPostTextboxInput,
getQuickChannelSwitcherInput,
searchAndVerifyChannel,
searchAndVerifyUser,
searchForChannel,
startAtMention,
verifySuggestionAtChannelSwitcher,
verifySuggestionAtPostTextbox,
};