Function update_user_password

apps/api/src/services/users/users.py:460–523

Update user password. SECURITY: Users can only change their own password. This function: 1. Validates that user_id matches current_user.id (IDOR protection) 2. Verifies the old password before allowing change 3. Validates password complexity requirements

(
    request: Request,
    db_session: AsyncSession,
    current_user: PublicUser | AnonymousUser,
    user_id: int,
    form: UserUpdatePassword,
)

async def update_user_password(
    request: Request,
    db_session: AsyncSession,
    current_user: PublicUser | AnonymousUser,
    user_id: int,
    form: UserUpdatePassword,
):
    """
    Update user password.

    SECURITY: Users can only change their own password. This function:
    1. Validates that user_id matches current_user.id (IDOR protection)
    2. Verifies the old password before allowing change
    3. Validates password complexity requirements
    """

    # Users can ONLY change their own password
    if current_user.id != user_id:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="You can only change your own password",
        )

    # Validate new password complexity
    validation_result = validate_password_complexity(form.new_password)
    if not validation_result.is_valid:
        raise HTTPException(
            status_code=400,
            detail={
                "code": "WEAK_PASSWORD",
                "message": "Password does not meet security requirements",
                "errors": validation_result.errors,
                "requirements": validation_result.requirements,
            },
        )

    # Get user (we already verified it's the current user)
    statement = select(User).where(User.id == user_id)
    user = (await db_session.execute(statement)).scalars().first()

    if not user:
        raise HTTPException(
            status_code=400,
            detail="User does not exist",
        )

    # Verify old password before allowing change
    if not security_verify_password(form.old_password, user.password):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED, detail="Wrong password"
        )

    # Update user
    user.password = security_hash_password(form.new_password)
    user.update_date = str(datetime.now())

    # Update user in database
    db_session.add(user)