feat: enforce minimum password length

tests/Controller/ResetPasswordControllerTest.php

@@ -16,6 +16,7 @@ class ResetPasswordControllerTest extends WebTestCase
     {
         $client = self::createClient([], [
             'HTTPS' => 'on',
+            'HTTP_HX_REQUEST' => 'true',
         ]);
         $client->disableReboot();
 
@@ -121,7 +122,7 @@ class ResetPasswordControllerTest extends WebTestCase
         $manager
             ->expects(self::once())
             ->method('resetPassword')
-            ->with($user, 'new-password');
+            ->with($user, 'Str0ng-Passw0rd!');
         self::getContainer()->set(PasswordResetManager::class, $manager);
 
         $crawler = $client->request('GET', '/reset-password/[email protected]&nonce=token&expires=9999999999&_hash=signature');
@@ -129,8 +130,8 @@ class ResetPasswordControllerTest extends WebTestCase
         self::assertSelectorTextContains('h1', 'Neues Passwort');
 
         $form = $crawler->selectButton('Passwort speichern')->form([
-            'form[password][first]' => 'new-password',
-            'form[password][second]' => 'new-password',
+            'form[password][first]' => 'Str0ng-Passw0rd!',
+            'form[password][second]' => 'Str0ng-Passw0rd!',
         ]);
         $client->submit($form);
 
@@ -139,4 +140,35 @@ class ResetPasswordControllerTest extends WebTestCase
 
         self::assertStringContainsString('Dein Passwort wurde aktualisiert', $client->getResponse()->getContent());
     }
+
+    public function testPasswordResetConfirmationRejectsTooShortPasswordBeforeSaving(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $user = new User('[email protected]');
+        $manager = $this->createMock(PasswordResetManager::class);
+        $manager
+            ->expects(self::exactly(2))
+            ->method('validateResetRequest')
+            ->with(self::isInstanceOf(Request::class))
+            ->willReturn($user);
+        $manager->expects(self::never())->method('resetPassword');
+        self::getContainer()->set(PasswordResetManager::class, $manager);
+
+        $crawler = $client->request('GET', '/reset-password/[email protected]&nonce=token&expires=9999999999&_hash=signature');
+        self::assertResponseIsSuccessful();
+        self::assertSelectorTextContains('h1', 'Neues Passwort');
+
+        $form = $crawler->selectButton('Passwort speichern')->form([
+            'form[password][first]' => 'short7',
+            'form[password][second]' => 'short7',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(422);
+        self::assertStringContainsString('Das Passwort muss mindestens 8 Zeichen lang sein.', $client->getResponse()->getContent());
+    }
 }