user.set_password: change your own password; TUI "Byt lösenord"v0.1.68

Needs the current password (wrong ones rate limited like logins) and a
password session, requires at least 10 characters, closes the user's
other sessions and is audited without secrets. The TUI main menu gets
"Byt lösenord" with masked prompts; ^R keeps working with the new
password. Masked prompt buffers are wiped before they are freed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 43 insertions, 3 deletions

diff --git a/scripts/tui-golden.py b/scripts/tui-golden.py
index 0dfde5f..b6aaada 100755
--- a/scripts/tui-golden.py
+++ b/scripts/tui-golden.py
@@ -689,6 +689,42 @@ SCENARIOS = [
             },
         ],
     },
+    {
+        # Keep last: changes the rig's login password, then restores it so
+        # a rerun of the list still logs in.
+        "name": "change-password",
+        "screen": "dashboard",
+        "expect": ["Byt lösenord", "Logga ut / avsluta"],
+        "steps": [
+            {
+                "keys": ["g", "lösen", "enter", "enter"],
+                "expect": ["Nuvarande lösenord:"],
+            },
+            {
+                "keys": ["{password}", "enter", "kort", "enter", "kort",
+                         "enter"],
+                "expect": ["minst 10 tecken"],
+            },
+            {
+                "keys": ["enter", "g", "lösen", "enter", "enter",
+                         "fel-lösenord", "enter", "nyttlosenord99", "enter",
+                         "nyttlosenord99", "enter"],
+                "expect": ["AUTH_FAILED"],
+            },
+            {
+                "keys": ["enter", "g", "lösen", "enter", "enter",
+                         "{password}", "enter", "nyttlosenord99", "enter",
+                         "nyttlosenord99", "enter"],
+                "expect": ["Lösenordet är bytt."],
+            },
+            {
+                "keys": ["enter", "g", "lösen", "enter", "enter",
+                         "nyttlosenord99", "enter", "{password}", "enter",
+                         "{password}", "enter"],
+                "expect": ["Lösenordet är bytt."],
+            },
+        ],
+    },
 ]
 
 # --------------------------------------------------------------------------
@@ -1098,10 +1134,13 @@ def format_expect(strings, ctx):
     return [s.format(**ctx) for s in strings]
 
 
-def resolve_keys(spec):
+def resolve_keys(spec, ctx=None):
     if isinstance(spec, str):
         spec = [spec]
-    return "".join(KEYS.get(k, k) for k in spec).encode("utf-8")
+    text = "".join(KEYS.get(k, k) for k in spec)
+    if ctx and "{password}" in text:  # the rig's random login password
+        text = text.replace("{password}", ctx["password"])
+    return text.encode("utf-8")
 
 
 def report_failure(name, missing, before, current):
@@ -1285,6 +1324,7 @@ def main(argv):
             "fy_label": fy.get("label", ""),
             "fy_start": fy.get("start_date", ""),
             "fy_end": fy.get("end_date", ""),
+            "password": password,
         }
         print(f"bokf TUI golden tests: org {org_id} \"{ORG_NAME}\", "
               f"fy {fy.get('label')} (id {fy.get('id')}), socket {sock}")
@@ -1323,7 +1363,7 @@ def main(argv):
                     continue
                 current = before
                 for step in sc.get("steps", []):
-                    keys = resolve_keys(step["keys"])
+                    keys = resolve_keys(step["keys"], ctx)
                     want = format_expect(step.get("expect", []), ctx)
                     for attempt in range(1, KEY_ATTEMPTS + 1):
                         before = app.render()