Merge commit 'f79b96a5ef0f6c4f57eee7f44ce2579b28a22098' into glitch-soc/merge-upstream

Conflicts:
- `app/lib/feed_manager.rb`:
  Not a real conflict, but glitch-soc has an extra `populate_direct_feed` method.
  Added upstream's code.
- `app/models/user_settings.rb`:
  Not a real conflict, glitch-soc has an extra setting textually-adjacent to a
  setting added upstream.
  Added upstream's setting.
- `app/serializers/initial_state_serializer.rb`:
  Same.
- `app/services/precompute_feed_service.rb`:
  Not a real conflict, glitch-soc has extra code for the direct feed.
  Added upstream's new code for populating lists.

spec/requests/api/v2/notifications_spec.rb

@@ -153,7 +153,7 @@ RSpec.describe 'Notifications' do
         it 'returns a notification group covering all notifications' do
           subject
 
-          notification_ids = user.account.notifications.reload.pluck(:id)
+          notification_ids = user.account.notifications.order(id: :asc).pluck(:id)
 
           expect(response).to have_http_status(200)
           expect(response.content_type)
@@ -175,7 +175,7 @@ RSpec.describe 'Notifications' do
         it 'returns a notification group covering all notifications' do
           subject
 
-          notification_ids = user.account.notifications.reload.pluck(:id)
+          notification_ids = user.account.notifications.order(id: :asc).pluck(:id)
 
           expect(response).to have_http_status(200)
           expect(response.content_type)

spec/requests/auth/passwords_spec.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Auth Passwords' do
+  describe 'GET /auth/password/edit' do
+    context 'with invalid reset_password_token' do
+      it 'redirects to #new' do
+        get edit_user_password_path, params: { reset_password_token: 'some_invalid_value' }
+
+        expect(response)
+          .to redirect_to new_user_password_path
+      end
+    end
+  end
+
+  describe 'PUT /auth/password' do
+    let(:user) { Fabricate(:user) }
+    let(:password) { 'reset0password' }
+
+    context 'with invalid reset_password_token' do
+      it 'renders reset password and retains password' do
+        put user_password_path, params: { user: { password: password, password_confirmation: password, reset_password_token: 'some_invalid_value' } }
+
+        expect(response.body)
+          .to include(I18n.t('auth.set_new_password'))
+
+        expect(User.find(user.id))
+          .to be_present
+          .and be_external_or_valid_password(user.password)
+      end
+    end
+  end
+end