fix: say a second wallet's password is separate when one is chosen (closes #374)

The add-wallet screen offered only "Choose a password" while each wallet keeps its own encrypted secret, so a second wallet silently accepted a password different from the first with nothing marking it as separate. A note now appears on that screen when the profile already holds a wallet, saying each wallet has its own password and this one need not match any already in use. It is shown only then — the first wallet has no other password to differ from — and is decided on screen entry, so it does not move the password fields. It promises no recovery or reset, staying consistent with the no-password-reset design. Model: opus-4-8
2026-09-21 21:11:09 +02:00
parent 9ac7df0128
commit 2da790fbe9
4 changed files with 101 additions and 0 deletions
@@ -0,0 +1,58 @@
+// Adding a second wallet accepts a password different from the first one's
+// with nothing on screen saying the two are separate — each wallet has its
+// own encryptedSecret, so per-wallet passwords are by design, but the add
+// screen said only "Choose a password"
+// (https://git.eeqj.de/sneak/AutistMask/issues/374).
+//
+// The fix is copy: a note on the password screen that says each wallet has
+// its own password and this one need not match. It is only meaningful once
+// a wallet exists — on the very first wallet there is no other password to
+// be separate from — so it is shown then and hidden otherwise. These boot
+// the real popup and reach the add-wallet screen through the same button a
+// user presses, so the note's visibility is decided by the real show().
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    POPUP_HTML,
+} = require("./support/popupBoot");
+
+const NOTE = "add-wallet-separate-password-note";
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+describe("second-wallet password note", () => {
+    test("hidden while onboarding the first wallet", async () => {
+        const page = await bootPopup(undefined);
+        expect(page.pageErrors).toEqual([]);
+        await page.click("btn-welcome-add");
+        expect(page.visibleViews()).toContain("add-wallet");
+        expect(page.hidden(NOTE)).toBe(true);
+    });
+
+    test("shown when a wallet already exists", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        expect(page.pageErrors).toEqual([]);
+        await page.click("btn-main-add-wallet");
+        expect(page.visibleViews()).toContain("add-wallet");
+        expect(page.hidden(NOTE)).toBe(false);
+    });
+
+    // The copy states the two facts the definition of done asks for — each
+    // wallet has its own password, and this one need not match — and stays
+    // consistent with the no-password-reset reality of
+    // https://git.eeqj.de/sneak/AutistMask/issues/312 by not promising any
+    // recovery or reset here.
+    test("the note says the password is per-wallet and need not match", () => {
+        const note = /id="add-wallet-separate-password-note"[^>]*>([^]*?)<\/p>/
+            .exec(POPUP_HTML)[1]
+            .replace(/\s+/g, " ")
+            .trim();
+        expect(note).toContain("its own");
+        expect(note).toContain("need not match");
+        expect(note).not.toMatch(/recover|reset/i);
+    });
+});