{
  "id": "starter-connection-password",
  "name": "Create, reset, and cancel a Starter database password",
  "risk": "mutating",
  "goal": [
    "Open Connect for the main branch. If no database password exists, generate one and wait until the generated password confirmation is visible; otherwise do not generate an extra password.",
    "Use Reset Password to open the confirmation, choose Sure, reset it exactly once, and wait for Reset successfully! Password. Merely opening or canceling the confirmation does not reset the password.",
    "Open the reset confirmation one more time, cancel it without resetting again, and finish on the normal connection dialog."
  ],
  "success": {
    "beforeEvidence": [{ "kind": "visibleText", "text": "Reset successfully! Password:", "exact": false }],
    "evidence": [
      { "kind": "testIdVisible", "testId": "serverless-connection-modal" },
      { "kind": "testIdVisible", "testId": "connection-reset-password-btn" },
      {
        "kind": "visibleText",
        "text": "Existing connections are based on password you've set before.",
        "exact": false
      },
      {
        "kind": "absentText",
        "matches": "Are you sure you want to reset your password|Failed to (?:generate|reset) password"
      }
    ]
  },
  "recovery": [
    "Wait for each generated or reset password confirmation before continuing; never submit a password mutation twice because the page is slow.",
    "The generated/reset password confirmation does not show Reset Password. After observing that confirmation, close Connect with Escape and reopen it to return to the normal connection dialog; do not keep waiting for the confirmation view to change by itself.",
    "After the successful reset, remain in or reopen the main Connect dialog, use Reset Password only to open the confirmation, then choose Keep the old one.",
    "Main branch is the branch selector inside Connect. Never close Connect to visit the Branches navigation page."
  ],
  "limits": { "maxDurationMs": 180000, "maxActions": 18 },
  "safety": {
    "deny": [
      "Do not copy, type, repeat, or expose a generated credential outside the protected connection dialog.",
      "Do not change a password for any branch other than main or for any other instance.",
      "Do not open the Branches navigation page."
    ],
    "networkGuards": [
      {
        "id": "starter-password-change",
        "method": "PUT",
        "pathMatches": "^/api/v2023/serverless/v1beta1/clusters/([^/]+)/password$",
        "bodyMatches": { "password": "^[A-Za-z0-9]{16}$" },
        "maxRequests": 2,
        "required": true,
        "resourceIdentity": {
          "requestPathMatches": "^/api/v2023/serverless/v1beta1/clusters/([^/]+)/password$",
          "capturedVariable": "starterClusterId"
        }
      }
    ]
  }
}