Add autocomplete attribute to password fields

This helps the browser autocomplete them with the right thing.

Value based on https://www.w3.org/TR/WCAG21/#input-purposes

app/templates/views/organisations/organisation/settings/edit-name/confirm.html

@@ -19,7 +19,7 @@
     <div class="column-three-quarters">
 
     {% call form_wrapper() %}
-      {{ textbox(form.password) }}
+      {{ textbox(form.password, autocomplete='current-password') }}
       <p> Your organisation name will be changed from {{ current_org.name }} to {{ new_name }} </p>
       {{ page_footer('Confirm') }}
     {% endcall %}

app/templates/views/register-from-invite.html

@@ -23,7 +23,7 @@ Create an account
           {{ textbox(form.mobile_number, width='3-4', hint='We’ll send you a security code by text message') }}
         </div>
       {% endif %}
-      {{ textbox(form.password, hint="At least 8 characters", width='3-4') }}
+      {{ textbox(form.password, hint="At least 8 characters", width='3-4', autocomplete='new-password') }}
       {{ page_footer("Continue") }}
       {{form.service}}
       {{form.email_address}}

app/templates/views/register-from-org-invite.html

@@ -18,7 +18,7 @@ Create an account
       <div class="extra-tracking">
         {{ textbox(form.mobile_number, width='3-4', hint='We’ll send you a security code by text message') }}
       </div>
-      {{ textbox(form.password, hint="At least 8 characters", width='3-4') }}
+      {{ textbox(form.password, hint="At least 8 characters", width='3-4', autocomplete='new-password') }}
       {{ page_footer("Continue") }}
       {{form.organisation}}
       {{form.email_address}}

app/templates/views/register.html

@@ -19,7 +19,7 @@ Create an account
         {{ textbox(form.mobile_number, width='3-4', hint='We’ll send you a security code by text message') }}
       </div>
       <input class="visually-hidden" aria-hidden="true" tabindex="-1" id="defeat-chrome-autocomplete">
-      {{ textbox(form.password, hint="At least 8 characters", width='3-4') }}
+      {{ textbox(form.password, hint="At least 8 characters", width='3-4', autocomplete='new-password') }}
       {{form.auth_type}}
       {{ page_footer("Continue") }}
     {% endcall %}

app/templates/views/service-settings/confirm.html

@@ -19,7 +19,7 @@
     <div class="column-three-quarters">
 
     {% call form_wrapper() %}
-      {{ textbox(form.password) }}
+      {{ textbox(form.password, autocomplete='current-password') }}
       {{ page_footer(
         'Confirm',
         destructive=destructive

app/templates/views/signin.html

@@ -33,7 +33,7 @@
 
     {% call form_wrapper(autocomplete=True) %}
       {{ textbox(form.email_address, autocomplete='email') }}
-      {{ textbox(form.password) }}
+      {{ textbox(form.password, autocomplete='current-password') }}
       {{ page_footer("Continue", secondary_link=url_for('.forgot_password'), secondary_link_text="Forgot your password?") }}
     {% endcall %}
   </div>

app/templates/views/user-profile/authenticate.html

@@ -19,7 +19,7 @@
     <div class="column-three-quarters">
 
     {% call form_wrapper(autocomplete=True) %}
-      {{ textbox(form.password) }}
+      {{ textbox(form.password, autocomplete='current-password') }}
       {{ page_footer('Confirm') }}
     {% endcall %}
     </div>

tests/app/main/views/test_register.py

@@ -17,6 +17,7 @@ def test_render_register_returns_template_with_form(client):
     assert page.find('input', attrs={'name': 'auth_type'}).attrs['value'] == 'sms_auth'
     assert page.select_one('#email_address')['spellcheck'] == 'false'
     assert page.select_one('#email_address')['autocomplete'] == 'email'
+    assert page.select_one('#password')['autocomplete'] == 'new-password'
     assert 'Create an account' in response.get_data(as_text=True)
 
 

tests/app/main/views/test_sign_in.py

@@ -5,20 +5,26 @@ from bs4 import BeautifulSoup
 from flask import url_for
 
 from app.models.user import User
+from tests.conftest import normalize_spaces
 
 
 def test_render_sign_in_template_for_new_user(
-    client
+    client_request
 ):
-    response = client.get(url_for('main.sign_in', next=None))
+    client_request.logout()
-    assert response.status_code == 200
+    page = client_request.get('main.sign_in')
-    resp = response.get_data(as_text=True)
+    assert normalize_spaces(page.select_one('h1').text) == 'Sign in'
-    assert 'Sign in' in resp
+    assert normalize_spaces(page.select('label')[0].text) == 'Email address'
-    assert 'Email address' in resp
+    assert page.select_one('#email_address')['value'] == ''
-    assert 'Password' in resp
+    assert page.select_one('#email_address')['autocomplete'] == 'email'
-    assert 'Forgot your password?' in resp
+    assert normalize_spaces(page.select('label')[1].text) == 'Password'
-    assert 'If you do not have an account, you can' in resp
+    assert page.select_one('#password')['value'] == ''
-    assert 'Sign in again' not in resp
+    assert page.select_one('#password')['autocomplete'] == 'current-password'
+    assert page.select('main a')[0].text == 'create one now'
+    assert page.select('main a')[0]['href'] == url_for('main.register')
+    assert page.select('main a')[1].text == 'Forgot your password?'
+    assert page.select('main a')[1]['href'] == url_for('main.forgot_password')
+    assert 'Sign in again' not in normalize_spaces(page.text)
 
 
 def test_sign_in_explains_session_timeout(client):