Method handleVerifyPassword

src/Routers/UsersRouter.js:450–491

(req)

  }

  handleVerifyPassword(req) {
    return this._authenticateUserFromRequest(req)
      .then(async user => {
        // Remove hidden properties.
        UsersRouter.removeHiddenProperties(user);
        // Re-fetch the user with the caller's auth context so that
        // protectedFields and CLP apply correctly; if the caller used master key,
        // protectedFields are bypassed, matching the behavior of GET /users/:id
        const refetchAuth =
          req.auth.isMaster || req.auth.isMaintenance
            ? req.auth
            : new Auth.Auth({
              config: req.config,
              isMaster: false,
              user: Parse.Object.fromJSON({ className: '_User', objectId: user.objectId }),
              installationId: req.info.installationId,
            });
        let filteredUser;
        try {
          const filteredUserResponse = await rest.get(
            req.config,
            refetchAuth,
            '_User',
            user.objectId,
            {},
            req.info.clientSDK,
            req.info.context
          );
          filteredUser = filteredUserResponse.results?.[0];
        } catch {
          // re-fetch may fail for legacy users without ACL; fall through
        }
        if (!filteredUser) {
          filteredUser = user;
        }
        UsersRouter.removeHiddenProperties(filteredUser);
        return { response: filteredUser };
      })
      .catch(error => {
        throw error;
      });
  }

  async handleLogOut(req) {
    const success = { response: {} };