<commit_before>Feature: Restricted access to the admin console
  In order to prevent unauthorised people accessing the admin area
  I can only access the admin area if I have logged on and my password does not need resetting

  Scenario: Accessing admin when not logged in
    When I go to the Admin home page
    Then I should be on the admin login page
    And I should be connected to the server via an ssl connection
    And the markup should be valid

  Scenario: Login and logout to the admin console as a sysadmin
    Given a sysadmin user exists with first_name: "John", last_name: "Admin", email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    When I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin all petitions page
    And I should be connected to the server via an ssl connection
    And the markup should be valid
    And I should see "Users"
    And I should see "John Admin"
    And I follow "Logout"
    And I should be on the admin login page

  Scenario: Login and logout to the admin console as a moderator user
    Given a moderator user exists with first_name: "John", last_name: "Moderator", email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    When I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin all petitions page
    And I should see "John Moderator"
    And I should not see "Users"
    And I follow "Logout"
    And I should be on the admin login page

  Scenario: Invalid login
    Given I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>"
    And I press "Log in"
    Then I should see "Invalid email/password combination"
    And should not see "Logout"

  Scenario: 5 failed logins disables an account
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    And I go to the admin login page
    And I try the password "<PASSWORD>" 5 times in a row
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>"
    And I press "Log in"
    Then I should see "Consecutive failed logins limit exceeded, account has been temporarily disabled."
    And should not see "Logout"

  Scenario: 5 failed logins with an email address containing a wildcard does not disable an account
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    And I go to the admin login page
    And I try the password "<PASSWORD>" 5 times in a row for the email "admin%"
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin all petitions page

  Scenario: Login as a user who hasn't changed their password for over 9 months
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!", password_changed_at: "<PASSWORD>"
    When I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin edit profile page for "<EMAIL>"
    And I should be connected to the server via an ssl connection
    And I fill in "Current password" with "<PASSWORD>!"
    And I fill in "New password" with "<PASSWORD>!"
    And I fill in "Password confirmation" with "<PASSWORD>!"
    And I press "Save"
    Then I should be on the admin home page

  Scenario: Login as a user who is logging in for the first time
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!", force_password_reset: true
    When I go to the admin login page<commit_msg>Updating tests with redirect to hub page for admin signin<commit_after>Feature: Restricted access to the admin console
  In order to prevent unauthorised people accessing the admin area
  I can only access the admin area if I have logged on and my password does not need resetting

  Scenario: Accessing admin when not logged in
    When I go to the Admin home page
    Then I should be on the admin login page
    And I should be connected to the server via an ssl connection
    And the markup should be valid

  Scenario: Login and logout to the admin console as a sysadmin
    Given a sysadmin user exists with first_name: "John", last_name: "Admin", email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    When I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin home page
    And I should be connected to the server via an ssl connection
    And the markup should be valid
    And I should see "Users"
    And I should see "John Admin"
    And I follow "Logout"
    And I should be on the admin login page

  Scenario: Login and logout to the admin console as a moderator user
    Given a moderator user exists with first_name: "John", last_name: "Moderator", email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    When I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin home page
    And I should see "John Moderator"
    And I should not see "Users"
    And I follow "Logout"
    And I should be on the admin login page

  Scenario: Invalid login
    Given I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>"
    And I press "Log in"
    Then I should see "Invalid email/password combination"
    And should not see "Logout"

  Scenario: 5 failed logins disables an account
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    And I go to the admin login page
    And I try the password "<PASSWORD>" 5 times in a row
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>"
    And I press "Log in"
    Then I should see "Consecutive failed logins limit exceeded, account has been temporarily disabled."
    And should not see "Logout"

  Scenario: 5 failed logins with an email address containing a wildcard does not disable an account
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!"
    And I go to the admin login page
    And I try the password "<PASSWORD>" 5 times in a row for the email "admin%"
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin home page

  Scenario: Login as a user who hasn't changed their password for over 9 months
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!", password_changed_at: "<PASSWORD>"
    When I go to the admin login page
    And I fill in "Email" with "<EMAIL>"
    And I fill in "Password" with "<PASSWORD>!"
    And I press "Log in"
    Then I should be on the admin edit profile page for "<EMAIL>"
    And I should be connected to the server via an ssl connection
    And I fill in "Current password" with "<PASSWORD>!"
    And I fill in "New password" with "<PASSWORD>!"
    And I fill in "Password confirmation" with "<PASSWORD>!"
    And I press "Save"
    Then I should be on the admin home page

  Scenario: Login as a user who is logging in for the first time
    Given a moderator user exists with email: "<EMAIL>", password: "<PASSWORD>!", password_confirmation: "<PASSWORD>!", force_password_reset: true
    When I go to the admin login page
{'fraction_non_alphanumeric': 0.07482229704451927, 'fraction_numerical': 0.0012470382840753212, 'mean_word_length': 3.4580322401334076, 'pattern_counts': {'":': 0, '<': 77, '<?xml version=': 0, '>': 77, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6701017', 'n_tokens_mistral': 2246, 'n_tokens_neox': 2190, 'n_words': 1251}