alphagov/EFG — pull request #236 by jabley (2014-04-23 13:31:43+00:00)
Title: Add password history feature

People should not be able to reuse their existing password. That means that
any password reset event (such as caused by heartbleed) is somewhat
meaningless if the same password can be recycled.

We allow the encrypted_password in old_passwords to be null, since when we
create a user, we don't create a password for them.

A CfE Admin will create a new Lender Admin by specifying first and last
names, and an email address where the confirmation link will be sent. The
password isn't set until the new Lender Admin follows the link to complete
the sign-up flow.

We could get around this by generating a random value for the password, but
that was a bigger change.

Also remove password migration functionality

This was introduced to migrate all users over from bcrypt hashes to SHA512.
This migration happened transparently when each user logged in.

See https://github.com/alphagov/EFG/commit/c1258856d86846eaeec89fba6c68fd3217b08970 and https://github.com/alphagov/EFG/commit/65e08d8

Since we now expire passwords after 90 days, all users have either been
migrated over, or will need to reset their password.

See https://github.com/alphagov/EFG/commit/b239792

This means we can remove this migration code.