fix(19): CR-03 return 403 for wrong current password so change-password does not log user out

2026-06-17 20:17:32 -04:00
parent 93c47b38aa
commit 6ef8e03f8c
3 changed files with 20 additions and 6 deletions
@@ -257,7 +257,12 @@ meRouter.post(
    // T-19-07: verify current password before any update
    const isCorrect = verifyPassword(credRow.passwordHash, currentPassword);
    if (!isCorrect) {
-      return c.json({ error: 'Current password incorrect' }, 401);
+      // CR-03: return 403 (NOT 401) for a wrong current password. The PWA's global
+      // MutationCache treats any 401 as "session expired" and arms the re-auth
+      // interstitial / login redirect — so a 401 here would force-log-out a user who
+      // merely mistyped their current password. 403 is in-app authorization-failure and
+      // lets the client surface "current password incorrect" without dropping the session.
+      return c.json({ error: 'Current password incorrect' }, 403);
    }

    try {