Enforce password validation rules on 'Forgot your password?' form

[andreslucena]

🎩 What? Why?

Password validation rules didn't get enforced when a registered user reset their password through the "Forgot your password?" form (from Devise).

This PR fixes that.

I guess we could remove the validation from the forms:

decidim/decidim-core/app/forms/decidim/registration_form.rb

Line 21 in 05b9883

validates :password, password: { name: :name, email: :email, username: :nickname }

decidim/decidim-core/app/forms/decidim/account_form.rb

Line 28 in 05b9883

validates :password, password: { name: :name, email: :email, username: :nickname }, if: -> { password.present? }

But before changing that, I want to see the specs if it fails some flows that don't need passwords (like Invitations)

(Never mind, we need that so the Forms validations work correctly. If not it gives an error without any detail on what exactly is the error)

📌 Related Issues

• Fixes Password validation isn't enforced when resetting password #9085

Testing

1. Do the "Forgot your password?" flow until the password and confirmation screen
2. Fill a password that doesn't follow the rules, for instance "1234567890"
3. Save it
4. See that it gives you a validation error

♥️ Thank you!

[ahukkanen]

Few small things I noticed. Otherwise this is great and works fine!

[andreslucena]

Failing related specs, I need to check them

[andreslucena]

This is ready to be reviewed again.

Just a comment, the only place that I know for sure that we're not enforcing the password validator is in system. My idea is to handle that in other PR after this is merged.