Merge remote-tracking branch 'parent/main' into upstream-20250210

spec/requests/auth/passwords_spec.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Auth Passwords' do
+  describe 'GET /auth/password/edit' do
+    context 'with invalid reset_password_token' do
+      it 'redirects to #new' do
+        get edit_user_password_path, params: { reset_password_token: 'some_invalid_value' }
+
+        expect(response)
+          .to redirect_to new_user_password_path
+      end
+    end
+  end
+
+  describe 'PUT /auth/password' do
+    let(:user) { Fabricate(:user) }
+    let(:password) { 'reset0password' }
+
+    context 'with invalid reset_password_token' do
+      it 'renders reset password and retains password' do
+        put user_password_path, params: { user: { password: password, password_confirmation: password, reset_password_token: 'some_invalid_value' } }
+
+        expect(response.body)
+          .to include(I18n.t('auth.set_new_password'))
+
+        expect(User.find(user.id))
+          .to be_present
+          .and be_external_or_valid_password(user.password)
+      end
+    end
+  end
+end

spec/requests/well_known/webfinger_spec.rb

@@ -116,19 +116,13 @@ RSpec.describe 'The /.well-known/webfinger endpoint' do
       perform_request!
     end
 
-    it 'returns http success' do
+    it 'returns http success with expect headers and media type' do
       expect(response).to have_http_status(200)
-    end
 
-    it 'sets only a Vary Origin header' do
       expect(response.headers['Vary']).to eq('Origin')
-    end
 
-    it 'returns application/jrd+json' do
       expect(response.media_type).to eq 'application/jrd+json'
-    end
 
-    it 'returns links for the internal account' do
       expect(response.parsed_body)
         .to include(
           subject: 'acct:mastodon.internal@cb6e6126.ngrok.io',