From 13b177822ea8382c9c5986862424f8ff8f08f16f Mon Sep 17 00:00:00 2001
From: Peter Keresztes Schmidt <carbenium@outlook.com>
Date: Tue, 9 Jun 2020 23:00:21 +0200
Subject: [PATCH] WebUI: move OTP to be the last field in the PW reset form

Since TOTPs have a limited validity, let the user enter
them as the last item in the form.
This reduces the chance of the TOTP getting invalid while
the user is still filling out other fields.

Related: https://pagure.io/freeipa/issue/5628
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
---
 install/ui/src/freeipa/user.js                |  8 ++++---
 install/ui/src/freeipa/widgets/LoginScreen.js | 22 +++++++++----------
 ipatests/test_webui/data_loginscreen.py       |  8 +++----
 3 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/install/ui/src/freeipa/user.js b/install/ui/src/freeipa/user.js
index 8f1f5cd85..2e329292c 100644
--- a/install/ui/src/freeipa/user.js
+++ b/install/ui/src/freeipa/user.js
@@ -776,13 +776,15 @@ IPA.user.password_dialog_pre_op0 = function(spec) {
 
 IPA.user.password_dialog_pre_op = function(spec) {
 
-    spec.sections[0].fields.splice(0, 0, {
+    spec.sections[0].fields.unshift({
         name: 'current_password',
         label: '@i18n:password.current_password',
         $type: 'password',
         required: true
-    }, {
-         name: 'otp',
+    });
+
+    spec.sections[0].fields.push({
+        name: 'otp',
         label: '@i18n:password.otp',
         $type: 'password'
     });
diff --git a/install/ui/src/freeipa/widgets/LoginScreen.js b/install/ui/src/freeipa/widgets/LoginScreen.js
index c3431e1d0..51c1b4f9a 100644
--- a/install/ui/src/freeipa/widgets/LoginScreen.js
+++ b/install/ui/src/freeipa/widgets/LoginScreen.js
@@ -673,17 +673,6 @@ define(['dojo/_base/declare',
             show_errors: false,
             undo: false
         },
-        {
-            name: 'otp',
-            $type: 'password',
-            label: text.get('@i18n:password.otp', "OTP"),
-            placeholder: text.get(
-                '@i18n:password.otp_long',
-                'One-Time-Password'
-            ),
-            show_errors: false,
-            undo: false
-        },
         {
             name: 'new_password',
             $type: 'password',
@@ -717,6 +706,17 @@ define(['dojo/_base/declare',
             }],
             show_errors: false,
             undo: false
+        },
+        {
+            name: 'otp',
+            $type: 'password',
+            label: text.get('@i18n:password.otp', "OTP"),
+            placeholder: text.get(
+                '@i18n:password.otp_long',
+                'One-Time-Password'
+            ),
+            show_errors: false,
+            undo: false
         }
     ];
 
diff --git a/ipatests/test_webui/data_loginscreen.py b/ipatests/test_webui/data_loginscreen.py
index 62063a606..cb76dae6a 100644
--- a/ipatests/test_webui/data_loginscreen.py
+++ b/ipatests/test_webui/data_loginscreen.py
@@ -58,12 +58,12 @@ RESET_AND_LOGIN_FORM = {
          PKEY, None),
         ('current_password', 'Current Password', False, True, 'password',
          'current_password', '', 'Current Password'),
-        ('otp', 'OTP', False, True, 'password', 'otp', '',
-         'One-Time-Password'),
         ('new_password', 'New Password', True, True, 'password',
          'new_password', '', 'New Password'),
         ('verify_password', 'Verify Password', True, True, 'password',
          'verify_password', '', 'New Password'),
+        ('otp', 'OTP', False, True, 'password', 'otp', '',
+         'One-Time-Password'),
     ],
     # structure of buttons
     # button_name, button_title
@@ -89,12 +89,12 @@ RESET_PASSWORD_FORM = {
          'Username'),
         ('current_password', 'Current Password', True, True, 'password',
          'current_password', '', 'Current Password'),
-        ('otp', 'OTP', False, True, 'password', 'otp', '',
-         'One-Time-Password'),
         ('new_password', 'New Password', True, True, 'password',
          'new_password', '', 'New Password'),
         ('verify_password', 'Verify Password', True, True, 'password',
          'verify_password', '', 'New Password'),
+        ('otp', 'OTP', False, True, 'password', 'otp', '',
+         'One-Time-Password'),
     ],
     # structure of buttons
     # button_name, button_title