fix(auth): hash new password in updatePassword to stop plaintext storage + self-lockout (#3925) (#3937)

The change-password handler validated strength via checkPassword (zxcvbn only,
returns the raw string) then persisted it verbatim. The user model has no
pre-save hash hook, so the new password landed in the DB in plaintext — storing
credentials at rest AND locking the user out on next signin (comparePassword
compares the entered password against the stored plaintext, never matching).

Mirror the sibling reset() path: hashPassword(checkedPassword) before persisting.

Tests: strengthen the change-password success test to read the stored value and
assert bcrypt format (/^$2[aby]$/), plus a runtime signin oracle (new password
authenticates, old one 401). This bug shipped undetected because no test ever
checked the persisted value. Verified the strengthened test fails on the
pre-fix code.

Follow-up (out of scope, downstream ops): remediate any already-corrupted rows
with a plaintext password persisted before this fix.

Author: PierreBrisorgueil

modules/auth/controllers/auth.password.controller.js

@@ -163,7 +163,8 @@ const updatePassword = async (req, res) => {
     if (!(await AuthService.comparePassword(req.body.currentPassword, user.password)))
       return responses.error(res, 422, 'Unprocessable Entity', 'Current password is incorrect')();
     if (req.body.newPassword !== req.body.verifyPassword) return responses.error(res, 422, 'Unprocessable Entity', 'Passwords do not match')();
-    password = AuthService.checkPassword(req.body.newPassword);
+    const checkedPassword = AuthService.checkPassword(req.body.newPassword);
+    password = await AuthService.hashPassword(checkedPassword);
     user = await UserService.update(user, { password }, 'recover');
     return res
       .status(200)

modules/users/tests/user.account.integration.tests.js

@@ -76,19 +76,39 @@ describe('User integration tests:', () => {
     });
 
     test('should be able to change user own password successfully', async () => {
+      const newPassword = 'Waos.azs@^:SA3$&2';
       try {
         const result = await agent
           .post('/api/users/password')
           .send({
-            newPassword: 'Waos.azs@^:SA3$&2',
-            verifyPassword: 'Waos.azs@^:SA3$&2',
+            newPassword,
+            verifyPassword: newPassword,
             currentPassword: credentials[0].password,
           })
           .expect(200);
         expect(result.body.message).toBe('Password changed successfully');
       } catch (err) {
         expect(err).toBeFalsy();
       }
+
+      // Regression guard (#3925): the STORED password must be a bcrypt hash,
+      // never the raw plaintext. updatePassword previously persisted the
+      // plaintext verbatim (the model has no pre-save hash hook), which both
+      // stored credentials in the clear and locked the user out on next signin.
+      // This shipped undetected precisely because no test read the persisted
+      // value — assert the hash format at rest, then confirm via signin oracle.
+      try {
+        const stored = await UserService.getBrut({ id: user.id });
+        expect(stored.password).toMatch(/^\$2[aby]\$/);
+        expect(stored.password).not.toBe(newPassword);
+
+        // Runtime oracle: the NEW password authenticates, the OLD one does not.
+        await request(app).post('/api/auth/signin').send({ email: credentials[0].email, password: newPassword }).expect(200);
+        await request(app).post('/api/auth/signin').send({ email: credentials[0].email, password: credentials[0].password }).expect(401);
+      } catch (err) {
+        console.log(err);
+        expect(err).toBeFalsy();
+      }
     });
 
     test('should not be able to change user own password if wrong verifyPassword is given', async () => {