Files
b51b4a8937 Fix FIPS-incompatible passwords and config in e2e test suites (#36001)
* Fix FIPS-incompatible passwords and config in e2e test suites

FIPS OpenSSL requires PBKDF2 HMAC keys >= 14 bytes, so the server
now enforces PasswordSettings.MinimumLength >= 14 under FIPS builds.
The e2e suites were failing (Cypress 0/447, Playwright 16/353) because
they used short passwords and set MinimumLength below the FIPS floor.

- Add newTestPassword() to both Cypress and Playwright utilities,
  returning a static FIPS-compliant password (>= 14 chars)
- Replace all short hardcoded Mattermost user passwords ('passwd',
  'Test123456!', 'Testing123', 'Password123!') with newTestPassword()
- Raise PasswordSettings.MinimumLength from 5 to 14 in default configs
- Update password validation tests for the FIPS minimum (error messages,
  default expectations, test password lengths)

* Fix additional FIPS e2e test failures

- Revert server-constant-dependent assertions (MinimumLength defaults
  and validation errors) since those depend on FIPS build tags, not config
- Fix short hardcoded passwords in signup, forgot_password, and
  existing_email_address specs to use newTestPassword()
- Fix password_spec cancel test to use a different password than
  testUser.password (both resolve to newTestPassword())
- Fix Playwright password reset test to use newTestPassword() instead
  of pw.random.id() (7 chars, too short for MinimumLength=14)
- Update password help text assertions to match MinimumLength=14 config
- Use regex for Playwright signup page password error locator
- Fix import order in ABAC support.ts

* Fix FIPS vs non-FIPS build-dependent e2e test assertions

The server's password minimum constants differ between FIPS (14) and
non-FIPS (8/5) builds. Make three test assertions adaptive:

- MM-T1770: Accept default MinimumLength of either 8 or 14
- MM-T1771: Match validation error with either 5 or 14 as the minimum
- MM-T1773: Reload after save and compare against actual server config,
  since saving MinimumLength=5 (webapp default) is rejected on FIPS

* e2e: upgrade demo plugin to v0.11.0 and configure required settings

* update demo plugin download link

---------

Co-authored-by: sabril <[email protected]>
2026-04-13 12:52:13 +08:00

246 lines
8.6 KiB
TypeScript

// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
import {Channel} from '@mattermost/types/channels';
import {ChainableT} from 'tests/types';
import * as TIMEOUTS from '../../../../fixtures/timeouts';
import {getAdminAccount} from '../../../../support/env';
import {newTestPassword} from '../../../../utils';
import {SimpleUser} from '../../autocomplete/helpers';
const admin = getAdminAccount();
export function withTimestamp(prefix: string, timestamp: number) {
return prefix + '-' + timestamp;
}
export function createEmail(name: string, timestamp: number) {
return name + timestamp + '@sample.mattermost.com';
}
// Helper function to start @mention
export function startAtMention(mention: string) {
// # Get the expected input
cy.get('@input').clear().type(mention);
// * Suggestion list should appear
cy.get('#suggestionList').should('be.visible');
}
export function searchForChannel(name: string) {
// # Open up channel switcher
cy.typeCmdOrCtrl().type('k').wait(TIMEOUTS.ONE_SEC);
// # Clear out and type in the name
cy.findByRole('combobox', {name: 'quick switch input'}).
should('be.visible').
as('input').
clear().
type(name);
}
function createChannel(channelType, teamId, userToAdd = null): ChainableT<Channel> {
// # Create a channel as sysadmin
return cy.externalRequest({
user: admin,
method: 'POST',
path: 'channels',
data: {
team_id: teamId,
name: 'test-channel' + Date.now(),
display_name: 'Test Channel ' + Date.now(),
type: channelType,
header: '',
purpose: '',
},
}).then(({data: channel}) => {
if (userToAdd) {
// # Get user profile by email
return cy.apiGetUserByEmail(userToAdd.email).then(({user}) => {
// # Add user to channel
return cy.externalAddUserToChannel(user.id, channel.id).then(() => {
// # Explicitly wait to give some time to index before searching
cy.wait(TIMEOUTS.TWO_SEC);
return cy.wrap<Channel>(channel);
});
});
}
// # Explicitly wait to give some time to index before searching
cy.wait(TIMEOUTS.TWO_SEC);
return cy.wrap<Channel>(channel);
});
}
export function enableElasticSearch() {
// # Enable elastic search via the API
cy.apiUpdateConfig({
ElasticsearchSettings: {
EnableIndexing: true,
EnableSearching: true,
},
});
// # Navigate to the elastic search setting page
cy.visit('/admin_console/environment/elasticsearch');
cy.get('#enableIndexingtrue').click();
// * Test the connection and verify that we are successful
cy.contains('button', 'Test Connection').click();
cy.get('.alert-success').should('have.text', 'Test successful. Configuration saved.');
// # Index so we are up to date
cy.contains('button', 'Index Now').click();
// # Small wait to ensure new row is added
cy.wait(TIMEOUTS.ONE_SEC).get('.job-table__table').find('tbody > tr').eq(0).as('firstRow');
// * Newest row should eventually result in Success
const checkFirstRow = () => {
return cy.get('@firstRow').then((el) => {
return el.find('.status-icon-success').length > 0;
});
};
const options = {
timeout: TIMEOUTS.TWO_MIN,
interval: TIMEOUTS.TWO_SEC,
errorMsg: 'Reindex did not succeed in time',
};
cy.waitUntil(checkFirstRow, options);
}
export function getTestUsers(): Record<string, SimpleUser> {
// Reverse the timestamp so that on search,
// the newly created user will get on the list first.
const reverseTimeStamp = (20 * Math.pow(10, 13)) - Date.now();
return {
ironman: {
username: withTimestamp('ironman', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Tony',
last_name: 'Stark',
email: createEmail('ironman', reverseTimeStamp),
nickname: withTimestamp('protoncannon', reverseTimeStamp),
},
hulk: {
username: withTimestamp('hulk', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Bruce',
last_name: 'Banner',
email: createEmail('hulk', reverseTimeStamp),
nickname: withTimestamp('gammaray', reverseTimeStamp),
},
hawkeye: {
username: withTimestamp('hawkeye', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Clint',
last_name: 'Barton',
email: createEmail('hawkeye', reverseTimeStamp),
nickname: withTimestamp('ronin', reverseTimeStamp),
},
deadpool: {
username: withTimestamp('deadpool', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Wade',
last_name: 'Wilson',
email: createEmail('deadpool', reverseTimeStamp),
nickname: withTimestamp('merc', reverseTimeStamp),
},
captainamerica: {
username: withTimestamp('captainamerica', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Steve',
last_name: 'Rogers',
email: createEmail('captainamerica', reverseTimeStamp),
nickname: withTimestamp('professional', reverseTimeStamp),
},
doctorstrange: {
username: withTimestamp('doctorstrange', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Stephen',
last_name: 'Strange',
email: createEmail('doctorstrange', reverseTimeStamp),
nickname: withTimestamp('sorcerersupreme', reverseTimeStamp),
},
thor: {
username: withTimestamp('thor', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Thor',
last_name: 'Odinson',
email: createEmail('thor', reverseTimeStamp),
nickname: withTimestamp('mjolnir', reverseTimeStamp),
},
loki: {
username: withTimestamp('loki', reverseTimeStamp),
password: newTestPassword(),
first_name: 'Loki',
last_name: 'Odinson',
email: createEmail('loki', reverseTimeStamp),
nickname: withTimestamp('trickster', reverseTimeStamp),
},
dot: {
username: withTimestamp('dot.dot', reverseTimeStamp),
password: newTestPassword(),
first_name: 'z1First',
last_name: 'z1Last',
email: createEmail('dot', reverseTimeStamp),
nickname: 'z1Nick',
},
dash: {
username: withTimestamp('dash-dash', reverseTimeStamp),
password: newTestPassword(),
first_name: 'z2First',
last_name: 'z2Last',
email: createEmail('dash', reverseTimeStamp),
nickname: 'z2Nick',
},
underscore: {
username: withTimestamp('under_score', reverseTimeStamp),
password: newTestPassword(),
first_name: 'z3First',
last_name: 'z3Last',
email: createEmail('underscore', reverseTimeStamp),
nickname: 'z3Nick',
},
};
}
export function createPrivateChannel(teamId: string, userToAdd = null) {
// # Create a private channel as sysadmin
return createChannel('P', teamId, userToAdd);
}
export function createPublicChannel(teamId, userToAdd = null) {
// # Create a public channel as sysadmin
return createChannel('O', teamId, userToAdd);
}
export function searchAndVerifyChannel(channel, shouldExist = true) {
const name = channel.display_name;
searchForChannel(name);
if (shouldExist) {
// * Channel should appear in suggestions list
cy.get('#suggestionList').findByTestId(channel.name).should('be.visible');
} else {
// * Suggestion list and channel item should not appear
cy.get('#suggestionList').should('not.exist');
cy.findByTestId(channel.name).should('not.exist');
}
}
export function searchAndVerifyUser(user) {
// # Start @ mentions autocomplete with username
cy.uiGetPostTextBox().
as('input').
clear().
type(`@${user.username}`);
// * Suggestion list should appear
cy.get('#suggestionList', {timeout: TIMEOUTS.FIVE_SEC}).should('be.visible');
// * Verify user appears in results post-change
return cy.uiVerifyAtMentionSuggestion(user);
}