Release v2.17.0: add read-only user previews and access fallbacks

test/admin-account-password-route.test.js

@@ -4,8 +4,69 @@ const assert = require('node:assert/strict');
 require('../src/common');
 
 const registerAccountRoutes = require('../src/web/routes/admin/account');
+const pages = require('../src/web/pages');
 const { validatePasswordStrength } = require('../src/auth');
 
+test('required-password page shows only password controls and uses an inline warning', () => {
+  const html = pages.renderRequiredPasswordPage({ id: 5, username: 'demo' }, {
+    minimumLength: 12,
+    minimumCategories: 3,
+    requireLowercase: false,
+    requireUppercase: false,
+    requireNumber: false,
+    requireSymbol: false
+  }, 'Current password is incorrect.');
+
+  assert.match(html, /Password change required/);
+  assert.match(html, /Please change your password before continuing\./);
+  assert.match(html, /Current password is incorrect\./);
+  assert.match(html, /name="current_password"/);
+  assert.match(html, /name="new_password"/);
+  assert.match(html, /name="confirm_password"/);
+  assert.doesNotMatch(html, /account-profile-form|name="email"|Active sessions/);
+  assert.doesNotMatch(html, /id="app-toast"/);
+});
+
+test('required-password route renders the password-only page and redirects after the requirement clears', async () => {
+  const handlers = {};
+  const app = {
+    get(path, ...routeHandlers) { handlers[path] = routeHandlers; },
+    post() {}
+  };
+  const deps = {
+    pool: { async query() { return [[]]; } },
+    common: {},
+    pages: {
+      renderRequiredPasswordPage(user, requirements) {
+        return user.username + ':' + requirements.minimumLength;
+      }
+    },
+    formatDashboardDate: () => '',
+    getAuditUserId: () => 5,
+    verifyPassword: () => true,
+    validatePasswordStrength: validatePasswordStrength,
+    hashPassword: () => ({ hash: 'hash', salt: 'salt', iterations: 1 }),
+    createUserSession: async () => 'token',
+    setSessionCookie: () => {}
+  };
+  registerAccountRoutes(app, deps);
+
+  const forcedResponse = {
+    send(value) { this.body = value; },
+    redirect(url) { this.redirectedTo = url; }
+  };
+  await handlers['/account/password'][0]({ currentUser: { id: 5, username: 'demo', mustChangePassword: true } }, forcedResponse, (error) => { throw error; });
+
+  const regularResponse = {
+    send(value) { this.body = value; },
+    redirect(url) { this.redirectedTo = url; }
+  };
+  await handlers['/account/password'][0]({ currentUser: { id: 5, username: 'demo', mustChangePassword: false } }, regularResponse, (error) => { throw error; });
+
+  assert.equal(forcedResponse.body, 'demo:10');
+  assert.equal(regularResponse.redirectedTo, '/account');
+});
+
 test('account password update redirects back to the account page', async () => {
   const handlers = {};
   const app = {