Backport 'Add admin's password confirmation validation in system' to v0.26

decidim-system/app/forms/decidim/system/admin_form.rb

@@ -12,7 +12,7 @@ class AdminForm < Form
       attribute :password_confirmation, String
 
       validates :email, presence: true
-      validates :password, presence: true, unless: :admin_exists?
+      validates :password, confirmation: true, presence: true, unless: :admin_exists?
       validates :password_confirmation, presence: true, unless: :admin_exists?
 
       validates :password, password: { email: :email }

decidim-system/spec/commands/decidim/system/create_admin_spec.rb

@@ -42,7 +42,21 @@ module System
           end
         end
 
-        describe "when the admin doesn't exist" do
+        describe "when the password does not match confirmation" do
+          let(:params) do
+            {
+              email: "email@foo.bar",
+              password: "GcvV56wHp5tJ",
+              password_confirmation: "GcvV56wHp5tJ2"
+            }
+          end
+
+          it "broadcasts invalid" do
+            expect { command.call }.to broadcast(:invalid)
+          end
+        end
+
+        describe "when the admin does not exist" do
           before do
             create(:admin, email: "email@foo.bar")
           end