0 Fork 0

Files

T

John O'Keefe cc5677eb17 docs(auth,users,devices,progress,matching): Beam batch 8 — WO5 backfill complete

14 endpoints backfilled: devices pending/approve/reject; users
password/profile/profile-delete self-service (admin variants in prose);
admin list_users + update_user_max_devices; progress history; book
matching; new password-rules doc.

Gate fix: authLabel missed JWT middleware written inline as
createJWTMiddleware(cfg) (uppercase 'JWT') — reported auth 'none' for
/api/auth self-service routes and would have for any wrapper-inlined
group. Labeled 'JWTMiddleware' + fallthrough 'jwt' case.

Claude registry: 12 entries. Drift fixed by gate: list_users on-device —
handler returns raw []database.Users (bare array, full model incl.
password_hash — real leak the API emits; pinned + documented; earlier
draft had invented {users,total,limit,offset} wrapper). max-devices
response is {message} only. books/match is GET /api/books/match
{matches, action}. progress history sessions = ReadingHistory rows
(pgtype fields). make test 9/9.

2026-10-24 17:33:32 -04:00

2.3 KiB

Raw Blame History

method, path, auth, area

method	path	auth	area
PUT	/api/auth/password	jwt	authentication

Change Password

Change user password. Supports both self-service and admin modes.

Endpoints:

Self-service: PUT /api/auth/password
Admin reset: PUT /api/auth/password/:id

Auth: Required Content-Type: application/json

Self-Service Mode

Users can change their own password by providing current password verification.

Request Body

Field	Type	Required	Description
current_password	string	Yes	Current password for verification
new_password	string	Yes	New password (min 8 chars, complexity required)
confirm_password	string	Yes	Must match new_password

Example Request

{
  "current_password": "OldPassword123!",
  "new_password": "NewSecureP@ss123!",
  "confirm_password": "NewSecureP@ss123!"
}

Admin Mode

Admins can reset any user's password without knowing the current password.

URL Parameter: :id - Target user's UUID

Request Body (Admin Mode)

Field	Type	Required	Description
new_password	string	Yes	New password (min 8 chars, complexity required)
confirm_password	string	Yes	Must match new_password

Example Admin Request

{
  "new_password": "NewSecureP@ss123!",
  "confirm_password": "NewSecureP@ss123!"
}

Response (200 OK)

{
  "message": "password updated"
}

Error Responses

Code	Description
400	Invalid input, weak password, or passwords don't match
401	Current password is incorrect (self-service mode)
403	Admin access required (admin mode only)
404	User not found (admin mode only)

2.3 KiB Raw Blame History