Account Protection: Add password detection flow #41105

dkmyta · 2025-01-15T20:39:28Z

Description

Add the password detection flow as described in the designs.

TODOs:

Add tests - https://github.com/Automattic/jetpack-scan-team/issues/1669
Enable module by default and remove strict mode settings:
- https://github.com/Automattic/jetpack-scan-team/issues/1674
- https://github.com/Automattic/jetpack-scan-team/issues/1675
Update flow to account for rollout plan changes - https://github.com/Automattic/jetpack-scan-team/issues/1676

Reliant on:

Other information:

Have you written new tests for your changes, if applicable?
Have you checked the E2E test CI results, and verified that your changes do not break them?
Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

https://github.com/Automattic/jetpack-scan-team/issues/1639
p1HpG7-vsU-p2

Does this pull request change what data or activity we track or use?

No

Testing instructions:

Checkout this branch
Run Jurassic Tube
Install and activate either Jetpack or Protect and enable the Account Protection settings
Log out and proceed to the wp-login.php form an attempt to log in
- Note that the validation mechanism here has been forced to detect all attempts as fails
Ensure that after the validation fails you are redirected to wp-login.php?action=password-detection and that the initial state of the page is styled as per designs and you are presented relevant details and options
Verify that clicking the Proceed without updating button redirects you to /wp-admin and that you now logged in
Verify that clicking the Create new password button updates the content accordingly and that the email action is triggered only once on the initial render (disabled by setting and a checking a transient)
- Note that the email action is not yet hooked up to the new endpoint and does not actually perform anything yet
Ensure that the Resend email action dynamically updates the UI with status details and that the email function is triggered
Ensure no regressions are introduced to core functionality and that the functionality only applies when the toggle is enabled
Review the package code responsible for each task

Screen capture

…add/protect/account-protection-settings

github-actions · 2025-01-15T20:40:19Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WordPress.com Simple site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin, and enable the add/packages/account-protection-password-detection-flow branch.

To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack add/packages/account-protection-password-detection-flow

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2025-01-15T20:40:31Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Team Review, ...).
🔴 Add a "[Type]" label (Bug, Enhancement, Janitorial, Task).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

The e2e test report can be found here. Please note that it can take a few minutes after the e2e tests checks are complete for the report to be available.

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Choose a review path based on your changes:
- A. Team Review: add the "[Status] Needs Team Review" label
  - For most changes, including minor cross-team impacts.
  - Example: Updating a team-specific component or a small change to a shared library.
- B. Crew Review: add the "[Status] Needs Review" label
  - For significant changes to core functionality.
  - Example: Major updates to a shared library or complex features.
- C. Both: Start with Team, then request Crew
  - For complex changes or when you need extra confidence.
  - Example: Refactor affecting multiple systems.
Get at least one approval before merging.

Still unsure? Reach out in #jetpack-developers for guidance!

Jetpack plugin:

The Jetpack plugin has different release cadences depending on the platform:

WordPress.com Simple releases happen semi-continuously (PCYsg-Jjm-p2).
WoA releases happen weekly.
Releases to self-hosted sites happen monthly. The next release is scheduled for February 4, 2025 (scheduled code freeze on February 4, 2025).

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

Protect plugin:

Next scheduled release: none scheduled.

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

…tion-security-settings

…add/protect/account-protection-settings

…ges/account-protection-password-detection-flow

…add/protect/account-protection-settings

…ges/account-protection-password-detection-flow

ArSn

Some small comments / notes, but nothing that keeps us from merging this. I was also able to test this, contrary to that other PR (which I will try again now).

ArSn · 2025-01-24T13:53:23Z

projects/packages/account-protection/src/class-password-detection.php

+	 * @return bool True if the password is valid, false otherwise.
+	 */
+	public function validate_password( string $password ): bool {
+		// TODO: Uncomment out once endpoint is live


It is actually live by now :)

ArSn · 2025-01-24T13:55:04Z

projects/packages/account-protection/src/class-password-detection.php

+
+		// Check if the password is in the list of common/compromised passwords
+		$password_suffix = substr( $hashed_password, 5 );
+		if ( in_array( $password_suffix, $body['compromised'] ?? array(), true ) ) {


you might also want to check the common index that is available now. However if we're just going to return true in both cases, we could also combine them. The idea was to adjust the messaging based on what hits, I think (tell the user specifically if it is a common or compromised one) - that being said, most common passwords are also compromised by their nature

ArSn · 2025-01-24T13:57:05Z

projects/packages/account-protection/src/class-password-detection.php

+			<head>
+				<meta charset="UTF-8">
+				<meta name="viewport" content="width=device-width, initial-scale=1.0">
+				<title><?php echo esc_html( $reset ? 'Jetpack - Stay Secure' : 'Jetpack - Secure Your Account' ); ?></title>


should all these texts be translateable? i.e. using esc_html__ functions et. al.?

ArSn · 2025-01-24T13:59:54Z

projects/packages/account-protection/src/class-password-detection.php

+								<button class="action action-reset" type="submit" name="reset-password">Create a new password</button>
+							</form>
+							<form method="post">
+								<?php wp_nonce_field( 'proceed_action', '_wpnonce_proceed' ); ?>


I wonder if we really need a nonce in this case, because we're not updating any data?

ArSn · 2025-01-24T14:03:31Z

projects/plugins/protect/changelog/add-packages-account-protection-password-detection-flow

+Significance: patch
+Type: changed
+
+Fixes Account Protection endpoint callback


I think this PR does a bit more than that? :)

…tion-security-settings

…count-protection-mutation.ts Co-authored-by: Kolja Zuelsdorf <[email protected]>

…ges/account-protection-password-detection-flow

dkmyta · 2025-01-24T20:01:47Z

Merging as is, and will add follow-ups to address the items highlighted.

dkmyta added 22 commits January 9, 2025 10:10

Add Account Protection toggle to Jetpack security settings

3f56ee7

Import package and run activation/deactivation on module toggle

719f950

changelog

c83c604

Add Protect Settings page and hook up Account Protection toggle

ab4f99a

changelog

c2e8f1e

Update changelog

b64fdaf

Merge branch 'add/jetpack/account-protection-security-settings' into …

13949a6

…add/protect/account-protection-settings

Register modules on plugin activation

3f68536

Ensure package is initialized on plugin activation

3628b02

Make account protection class init static

3f90fe4

Merge branch 'add/jetpack/account-protection-security-settings' into …

911e1db

…add/protect/account-protection-settings

Add auth hooks, redirect and a custom login action template

3bfbcb3

Reorg, add Password_Detection class

289dbdb

Remove user cxn req and banner

7eabdd3

Do not enabled module by default

5a1af0b

Add strict mode option and settings toggle

3b35efe

changelog

4ddb644

Merge branch 'add/jetpack/account-protection-security-settings' into …

2a0e811

…add/protect/account-protection-settings

Add strict mode toggle

b62811b

Add strict mode toggle and endpoints

28f5820

Rebase

da260ea

Reorg and add kill switch and is supported check

b72e93a

github-actions bot added [Package] Account Protection [Status] In Progress labels Jan 15, 2025

github-actions bot added the [Status] Needs Author Reply We would need you to make some changes or provide some more details about your PR. Thank you! label Jan 15, 2025

dkmyta added 2 commits January 15, 2025 13:59

Add testing infrastructure

7fad7f9

Add email handlings, resend AJAX action, and attempt limitations

39a28d5

github-actions bot added the [Tests] Includes Tests label Jan 16, 2025

dkmyta added 12 commits January 20, 2025 15:41

Add tests dir

f07e52e

Reapply default test infrastructure

80d0e92

Reorg and rename

c03d626

Update @Package

ae3b6b6

Use never phpdoc return type as per static analysis error

30f2329

Merge branch 'add/account-protection' into add/jetpack/account-protec…

55ccadb

…tion-security-settings

Merge branch 'add/jetpack/account-protection-security-settings' into …

3fed240

…add/protect/account-protection-settings

Merge branch 'add/protect/account-protection-settings' into add/packa…

2beaca5

…ges/account-protection-password-detection-flow

Enable module by default

aad7ff6

Merge branch 'add/jetpack/account-protection-security-settings' into …

de4fc75

…add/protect/account-protection-settings

Enable module by default

448079b

Merge branch 'add/protect/account-protection-settings' into add/packa…

bc263e0

…ges/account-protection-password-detection-flow

ArSn approved these changes Jan 24, 2025

View reviewed changes

dkmyta and others added 6 commits January 24, 2025 10:55

Merge branch 'add/account-protection' into add/jetpack/account-protec…

13cdb4d

…tion-security-settings

Update projects/plugins/protect/src/js/data/account-protection/use-ac…

b07ecd1

…count-protection-mutation.ts Co-authored-by: Kolja Zuelsdorf <[email protected]>

Rebase

ce17441

Merge branch 'add/protect/account-protection-settings' into add/packa…

2f5e6b7

…ges/account-protection-password-detection-flow

Update lock files

5edfaca

Merge branch 'add/protect/account-protection-settings' into add/packa…

073c105

…ges/account-protection-password-detection-flow

Base automatically changed from add/protect/account-protection-settings to add/account-protection January 24, 2025 20:15

github-actions bot added [Feature] WPCOM API [JS Package] API Admin Page React-powered dashboard under the Jetpack menu RNA labels Jan 24, 2025

Fix conflicts

464c58f

dkmyta merged commit 1ec2c34 into add/account-protection Jan 24, 2025
47 checks passed

dkmyta deleted the add/packages/account-protection-password-detection-flow branch January 24, 2025 20:22

github-actions bot removed [Status] Needs Author Reply We would need you to make some changes or provide some more details about your PR. Thank you! [Status] In Progress labels Jan 24, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Account Protection: Add password detection flow #41105

Account Protection: Add password detection flow #41105

dkmyta commented Jan 15, 2025 •

edited

Loading

github-actions bot commented Jan 15, 2025 •

edited

Loading

github-actions bot commented Jan 15, 2025 •

edited

Loading

ArSn left a comment

ArSn Jan 24, 2025

ArSn Jan 24, 2025

ArSn Jan 24, 2025

ArSn Jan 24, 2025

ArSn Jan 24, 2025

dkmyta commented Jan 24, 2025

Account Protection: Add password detection flow #41105

Account Protection: Add password detection flow #41105

Conversation

dkmyta commented Jan 15, 2025 • edited Loading

Description

Other information:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Screen capture

github-actions bot commented Jan 15, 2025 • edited Loading

github-actions bot commented Jan 15, 2025 • edited Loading

ArSn left a comment

Choose a reason for hiding this comment

ArSn Jan 24, 2025

Choose a reason for hiding this comment

ArSn Jan 24, 2025

Choose a reason for hiding this comment

ArSn Jan 24, 2025

Choose a reason for hiding this comment

ArSn Jan 24, 2025

Choose a reason for hiding this comment

ArSn Jan 24, 2025

Choose a reason for hiding this comment

dkmyta commented Jan 24, 2025

dkmyta commented Jan 15, 2025 •

edited

Loading

github-actions bot commented Jan 15, 2025 •

edited

Loading

github-actions bot commented Jan 15, 2025 •

edited

Loading