Backport fixes to master

[rjmackay]

Overview

Backport fixes from develop to master, before releasing audit report.

Requirements

• Backport Adding fix for Role feature state check #2851
• Backport Adding reset password validation #2876
• Backport Adding ratelimiter for signups #2896

Acceptance checklist

Roles:

• With Roles feature enabled set to false
• Attempt to create/update a new role via HTTP Post
• You should receive a 422

Password reset

Using link

• Open a deployment where you have an account and go to login
• Select "forgot password"
• Enter email and trigger a password reset
• Receive password reset email
• Click link in password reset email
• Set password to 5 characters
• Returns an error that password is too short
• Try again with 8 characters
• Password is set

Using copy/paste:

• Open a deployment where you have an account and go to login
• Select "forgot password"
• Enter email and trigger a password reset
• Receive password reset email
• Copy the token from in password reset email into reset form
• Set password to 5 characters
• Returns an error that password is too short
• Try again with 8 characters
• Password is set

Registration:

• You should not be able to make more than 3 registration attempts per minute

[rjmackay]

@rowasc I've added an acceptance checklist.
Are you happy to approve this as is?
I'd suggest point score might be a 3 or 5 because of the complexity of backporting

[rowasc]

@rjmackay looks good.
Small fix: " With Roles feature enabled set to falseWith Roles feat" => I think this should be " With Roles feature enabled set to false"

I'd also add that the user should be able to copy and paste the token to the screen where you have the option to paste the token and add your new password (right after the forgot password modal) . It's a bit obvious but since we had a bug with the reset token not being decoded and failing if you just clicked the link, it might make sense to add the opposite behavior (copy-pasting the token) in the test script here as well.

---

Other than those small comments, I'd approve this , but probably a 5 because it's still 3 issues that need to be backported and tested and released.

[rjmackay]

Thanks @rowasc . Fixed those issues and moved to ready for dev :)

[rjmackay]

• Registration rate limit tests pass
• password reset validation works, but not exactly as in the test script:
  • client validation prevent reset with the wrong thing
  • it looks like maybe you can't reuse the token after the first attempt to reset