@mohasinac/appkit 4.5.3 → 4.6.1

package/dist/client.d.ts

@@ -191,7 +191,7 @@ export { AuctionBidsTable } from "./features/auctions/components/AuctionBidsTabl
 export type { AuctionBidsTableProps, AuctionWithBids } from "./features/auctions/components/AuctionBidsTable";
 export { ProtectedRoute, AuthStatusPanel, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index";
 export type { AuthGuardUser, ForgotPasswordViewProps, LoginFormProps, LoginFormValues, RegisterFormProps, RegisterFormValues, ResetPasswordViewProps, VerifyEmailViewProps, } from "./features/auth/index";
-export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useChangeEmail } from "./features/auth/index";
+export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useRequestPasswordChangeOtp, useVerifyPasswordChangeOtp, useChangeEmail } from "./features/auth/index";
 export type { LoginCredentials, RegisterData, ForgotPasswordData, ResetPasswordData, VerifyEmailData, ChangePasswordData, ChangeEmailData } from "./features/auth/index";
 export { CartView, CartItemRow, CartSummary, CartDrawer, CheckoutView, CheckoutSuccessView, CheckoutAddressStep, useGuestCart, useCartCount, useAddToCart, useCart, useGuestCartMerge, useCartQuery } from "./features/cart/index";
 export type { CartItem, CartItemMeta, CartData, GuestCartItem } from "./features/cart/index";

package/dist/client.js

@@ -222,7 +222,7 @@ export { PageViewTracker } from "./features/analytics/components/PageViewTracker
 export { PAGE_VIEW_ENTITY_TYPES } from "./features/analytics/types";
 export { AuctionBidsTable } from "./features/auctions/components/AuctionBidsTable";
 export { ProtectedRoute, AuthStatusPanel, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index";
-export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useChangeEmail } from "./features/auth/index";
+export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangePassword, useRequestPasswordChangeOtp, useVerifyPasswordChangeOtp, useChangeEmail } from "./features/auth/index";
 export { CartView, CartItemRow, CartSummary, CartDrawer, CheckoutView, CheckoutSuccessView, CheckoutAddressStep, useGuestCart, useCartCount, useAddToCart, useCart, useGuestCartMerge, useCartQuery } from "./features/cart/index";
 export { useAddresses, useCreateAddress, useUpdateAddress, useDeleteAddress, useSetDefaultAddress, useAddress } from "./features/account/index";
 export { AddressBook, AddressCard, AddressForm } from "./features/account/index";

package/dist/constants/api-endpoints.d.ts

@@ -32,6 +32,8 @@ export declare const ACCOUNT_ENDPOINTS: {
     readonly BY_ID: (userId: string) => string;
     readonly PROFILE: "/api/user/profile";
     readonly CHANGE_PASSWORD: "/api/user/change-password";
+    readonly CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request";
+    readonly CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify";
     /** @param userId — for public profile pages */
     readonly PUBLIC_PROFILE: (userId: string) => string;
     /** @param userId — seller profile page */
@@ -481,6 +483,8 @@ export declare const API_ENDPOINTS: {
         readonly BY_ID: (userId: string) => string;
         readonly PROFILE: "/api/user/profile";
         readonly CHANGE_PASSWORD: "/api/user/change-password";
+        readonly CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request";
+        readonly CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify";
         /** @param userId — for public profile pages */
         readonly PUBLIC_PROFILE: (userId: string) => string;
         /** @param userId — seller profile page */
@@ -932,6 +936,8 @@ export declare const API_ROUTES: {
         readonly BY_ID: (userId: string) => string;
         readonly PROFILE: "/api/user/profile";
         readonly CHANGE_PASSWORD: "/api/user/change-password";
+        readonly CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request";
+        readonly CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify";
         /** @param userId — for public profile pages */
         readonly PUBLIC_PROFILE: (userId: string) => string;
         /** @param userId — seller profile page */

package/dist/constants/api-endpoints.js

@@ -47,6 +47,8 @@ export const ACCOUNT_ENDPOINTS = {
     BY_ID: (userId) => `/api/account/${userId}`,
     PROFILE: "/api/user/profile",
     CHANGE_PASSWORD: "/api/user/change-password",
+    CHANGE_PASSWORD_OTP_REQUEST: "/api/user/change-password/otp/request",
+    CHANGE_PASSWORD_OTP_VERIFY: "/api/user/change-password/otp/verify",
     /** @param userId — for public profile pages */
     PUBLIC_PROFILE: (userId) => `/api/profile/${userId}`,
     /** @param userId — seller profile page */

package/dist/contracts/client-auth.d.ts

@@ -15,6 +15,14 @@ export interface IClientAuthProvider {
     confirmPasswordReset(code: string, newPassword: string): Promise<void>;
     /** Re-authenticate with current password and change to new password */
     reauthenticateAndChangePassword(currentPassword: string, newPassword: string): Promise<void>;
+    /**
+     * Verify the current password only — does NOT change anything. Used to
+     * prove current-password knowledge before an OTP is sent, without the
+     * side effect of immediately applying a new password ahead of that OTP
+     * being verified (see password-change-otp.ts for why the two steps must
+     * stay separate).
+     */
+    reauthenticateOnly(currentPassword: string): Promise<void>;
     /** Re-authenticate and send a verification email to the new address; email updates after user clicks the link */
     reauthenticateAndSendEmailUpdateVerification(currentPassword: string, newEmail: string): Promise<void>;
     /** Reload the current user's profile */

package/dist/features/auth/actions/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./profile-actions";
 export * from "./realtime-token-actions";
+export * from "./password-change-otp-actions";

package/dist/features/auth/actions/index.js

@@ -1,2 +1,3 @@
 export * from "./profile-actions";
 export * from "./realtime-token-actions";
+export * from "./password-change-otp-actions";

package/dist/features/auth/actions/password-change-otp-actions.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Password Change OTP Actions.
+ *
+ * Server-side gate for POST /api/user/change-password — see
+ * ../password-change-otp.ts for the full incident writeup. Mirrors
+ * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
+ * separate Firestore namespace and copy).
+ */
+/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
+export declare function sendPasswordChangeOtp(userId: string, userEmail: string): Promise<{
+    maskedEmail: string;
+}>;
+/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
+export declare function verifyPasswordChangeOtp(userId: string, code: string): Promise<void>;
+/** Whether the account has a currently-verified password-change OTP on file. */
+export declare function isPasswordChangeOtpVerified(userId: string): Promise<boolean>;
+/** Consumes the verified OTP so it can't be reused for a future password change. */
+export declare function consumePasswordChangeOtp(userId: string): Promise<void>;

package/dist/features/auth/actions/password-change-otp-actions.js

@@ -0,0 +1,88 @@
+/**
+ * Password Change OTP Actions.
+ *
+ * Server-side gate for POST /api/user/change-password — see
+ * ../password-change-otp.ts for the full incident writeup. Mirrors
+ * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
+ * separate Firestore namespace and copy).
+ */
+import { timingSafeEqual } from "crypto";
+import { ValidationError } from "../../../errors";
+import { serverLogger } from "../../../monitoring";
+import { sendEmail } from "../../contact/email";
+import { getAdminDb } from "../../../providers/db-firebase";
+import { resolveDate } from "../../../utils";
+import { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, passwordChangeOtpRef, enforcePasswordChangeOtpRateLimit, } from "../password-change-otp";
+/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
+export async function sendPasswordChangeOtp(userId, userEmail) {
+    const db = getAdminDb();
+    await enforcePasswordChangeOtpRateLimit(db, userId);
+    const code = generateOtpCode();
+    const codeHash = hashOtp(code);
+    const expiresAt = new Date(Date.now() + PASSWORD_CHANGE_OTP_EXPIRY_MS);
+    await passwordChangeOtpRef(db, userId).set({
+        codeHash,
+        expiresAt,
+        attempts: 0,
+        verified: false,
+        createdAt: new Date(),
+    });
+    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
+    const [local, domain] = userEmail.split("@");
+    const maskedEmail = domain
+        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
+        : "***";
+    await sendEmail({
+        to: userEmail,
+        subject: `${siteName}: Verify your password change`,
+        html: `
+      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
+        <h2 style="margin-bottom:8px">Confirm Password Change</h2>
+        <p style="color:#555">Someone requested to change this account's password. Enter this code to confirm it was you:</p>
+        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
+        <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, your password has NOT been changed — but consider securing your account.</p>
+      </div>
+    `,
+    });
+    serverLogger.info(`Password change OTP sent: uid=${userId}`);
+    return { maskedEmail };
+}
+/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
+export async function verifyPasswordChangeOtp(userId, code) {
+    const db = getAdminDb();
+    const ref = passwordChangeOtpRef(db, userId);
+    const snap = await ref.get();
+    if (!snap.exists) {
+        throw new ValidationError("No verification code found. Please request a new code.");
+    }
+    const otpDoc = snap.data();
+    if (otpDoc.verified)
+        return;
+    if (otpDoc.attempts >= PASSWORD_CHANGE_OTP_MAX_ATTEMPTS) {
+        throw new ValidationError("Too many failed attempts. Please request a new code.");
+    }
+    if (Date.now() > (resolveDate(otpDoc.expiresAt)?.getTime() ?? 0)) {
+        throw new ValidationError("Code expired. Please request a new one.");
+    }
+    const inputHash = hashOtp(code);
+    if (!timingSafeEqual(Buffer.from(inputHash, "hex"), Buffer.from(otpDoc.codeHash, "hex"))) {
+        await ref.update({ attempts: otpDoc.attempts + 1 });
+        throw new ValidationError("Invalid code. Please check and try again.");
+    }
+    await ref.update({ verified: true, verifiedAt: new Date() });
+    serverLogger.info(`Password change OTP verified: uid=${userId}`);
+}
+/** Whether the account has a currently-verified password-change OTP on file. */
+export async function isPasswordChangeOtpVerified(userId) {
+    const db = getAdminDb();
+    const snap = await passwordChangeOtpRef(db, userId).get();
+    if (!snap.exists)
+        return false;
+    const otpDoc = snap.data();
+    return otpDoc.verified === true;
+}
+/** Consumes the verified OTP so it can't be reused for a future password change. */
+export async function consumePasswordChangeOtp(userId) {
+    const db = getAdminDb();
+    await passwordChangeOtpRef(db, userId).delete();
+}

package/dist/features/auth/hooks/useAuth.d.ts

@@ -90,6 +90,35 @@ export declare function useResetPassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResetPasswordData, unknown>;
+/**
+ * Password change is now a 3-step flow (root-caused 2026-08-20 — see
+ * appkit/src/features/auth/password-change-otp.ts): the old single-step
+ * reauthenticateAndChangePassword() applied the new password immediately
+ * client-side, before any server-verified identity check beyond the
+ * session cookie. Step order:
+ *   1. useRequestPasswordChangeOtp — verifies currentPassword via Firebase
+ *      reauth (proves the caller actually knows it, without changing
+ *      anything yet), then emails a 6-digit code.
+ *   2. useVerifyPasswordChangeOtp — verifies the code server-side.
+ *   3. useChangePassword — only now actually applies newPassword; the API
+ *      route rejects this call unless step 2 already succeeded.
+ */
+export declare function useRequestPasswordChangeOtp(options?: {
+    onSuccess?: (data: {
+        maskedEmail: string;
+    }) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<{
+    maskedEmail: string;
+}, Error, {
+    currentPassword: string;
+}, unknown>;
+export declare function useVerifyPasswordChangeOtp(options?: {
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, {
+    code: string;
+}, unknown>;
 export declare function useChangePassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -353,16 +353,43 @@ export function useResetPassword(options) {
         onError: options?.onError,
     });
 }
-export function useChangePassword(options) {
+/**
+ * Password change is now a 3-step flow (root-caused 2026-08-20 — see
+ * appkit/src/features/auth/password-change-otp.ts): the old single-step
+ * reauthenticateAndChangePassword() applied the new password immediately
+ * client-side, before any server-verified identity check beyond the
+ * session cookie. Step order:
+ *   1. useRequestPasswordChangeOtp — verifies currentPassword via Firebase
+ *      reauth (proves the caller actually knows it, without changing
+ *      anything yet), then emails a 6-digit code.
+ *   2. useVerifyPasswordChangeOtp — verifies the code server-side.
+ *   3. useChangePassword — only now actually applies newPassword; the API
+ *      route rejects this call unless step 2 already succeeded.
+ */
+export function useRequestPasswordChangeOtp(options) {
     return useMutation({
-        mutationFn: async (data) => {
-            await getClientAuthProvider().reauthenticateAndChangePassword(data.currentPassword, data.newPassword);
-            return apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD, data);
+        mutationFn: async ({ currentPassword }) => {
+            await getClientAuthProvider().reauthenticateOnly(currentPassword);
+            return apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD_OTP_REQUEST, {});
         },
         onSuccess: options?.onSuccess,
         onError: options?.onError,
     });
 }
+export function useVerifyPasswordChangeOtp(options) {
+    return useMutation({
+        mutationFn: async ({ code }) => apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD_OTP_VERIFY, { code }),
+        onSuccess: options?.onSuccess,
+        onError: options?.onError,
+    });
+}
+export function useChangePassword(options) {
+    return useMutation({
+        mutationFn: async (data) => apiClient.post(ACCOUNT_ENDPOINTS.CHANGE_PASSWORD, data),
+        onSuccess: options?.onSuccess,
+        onError: options?.onError,
+    });
+}
 export function useChangeEmail(options) {
     return useMutation({
         mutationFn: async (data) => {

package/dist/features/auth/password-change-otp.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Password Change OTP.
+ *
+ * Root-caused 2026-08-20: POST /api/user/change-password validated the
+ * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
+ * but the handler never read or verified it — `getAdminAuth().updateUser()`
+ * overwrote the password unconditionally for whatever `uid` the session
+ * cookie carried. The only real current-password check
+ * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
+ * the browser and is trivially bypassed by calling the API directly with a
+ * stolen session cookie — a session hijack (XSS, log leak, etc.) was
+ * enough to take over the account's password with zero server-enforced
+ * identity check. This module gates the actual server-side write behind an
+ * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
+ * pattern exactly (same crypto primitives, reused not duplicated) so a
+ * session-cookie thief also needs access to the account's inbox.
+ */
+import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./checkout-value-otp";
+export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
+type Db = FirebaseFirestore.Firestore;
+/** Single-slot doc per user — a user can only be mid-password-change once. */
+export declare function passwordChangeOtpRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
+export declare function passwordChangeOtpRateLimitRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
+export interface PasswordChangeOtpDoc {
+    codeHash: string;
+    expiresAt: FirebaseFirestore.Timestamp;
+    attempts: number;
+    verified: boolean;
+}
+/**
+ * Enforce the per-user send rate-limit.
+ * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
+ */
+export declare function enforcePasswordChangeOtpRateLimit(db: Db, uid: string): Promise<void>;

package/dist/features/auth/password-change-otp.js

@@ -0,0 +1,56 @@
+/**
+ * Password Change OTP.
+ *
+ * Root-caused 2026-08-20: POST /api/user/change-password validated the
+ * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
+ * but the handler never read or verified it — `getAdminAuth().updateUser()`
+ * overwrote the password unconditionally for whatever `uid` the session
+ * cookie carried. The only real current-password check
+ * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
+ * the browser and is trivially bypassed by calling the API directly with a
+ * stolen session cookie — a session hijack (XSS, log leak, etc.) was
+ * enough to take over the account's password with zero server-enforced
+ * identity check. This module gates the actual server-side write behind an
+ * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
+ * pattern exactly (same crypto primitives, reused not duplicated) so a
+ * session-cookie thief also needs access to the account's inbox.
+ */
+import { AuthorizationError } from "../../errors";
+import { resolveDate } from "../../utils";
+import { USER_COLLECTION } from "./schemas";
+import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, } from "./checkout-value-otp";
+export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
+/** Single-slot doc per user — a user can only be mid-password-change once. */
+export function passwordChangeOtpRef(db, uid) {
+    return db
+        .collection(USER_COLLECTION)
+        .doc(uid)
+        .collection("passwordChangeOtps")
+        .doc("current");
+}
+export function passwordChangeOtpRateLimitRef(db, uid) {
+    return db
+        .collection(USER_COLLECTION)
+        .doc(uid)
+        .collection("passwordChangeOtpRateLimit")
+        .doc("meta");
+}
+/**
+ * Enforce the per-user send rate-limit.
+ * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
+ */
+export async function enforcePasswordChangeOtpRateLimit(db, uid) {
+    const metaRef = passwordChangeOtpRateLimitRef(db, uid);
+    await db.runTransaction(async (tx) => {
+        const metaSnap = await tx.get(metaRef);
+        const meta = metaSnap.exists
+            ? metaSnap.data()
+            : null;
+        const lastSentMs = resolveDate(meta?.lastSentAt)?.getTime() ?? 0;
+        const elapsed = Date.now() - lastSentMs;
+        if (elapsed < PASSWORD_CHANGE_OTP_COOLDOWN_MS) {
+            throw new AuthorizationError("passwordChangeOtpRateLimit");
+        }
+        tx.set(metaRef, { lastSentAt: new Date() }, { merge: true });
+    });
+}

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -71,6 +71,12 @@ const rawTesterChecklistItems = [
                 { key: "avatar-upload", label: "Uploading a profile avatar works" },
                 { key: "notification-prefs", label: "Notification preferences save correctly" },
                 { key: "public-profile-toggle", label: "Public profile visibility toggle works" },
+                {
+                    key: "password-change-otp-required",
+                    label: "Changing your password from Settings requires entering an emailed 6-digit code before it actually takes effect — the password does not change just from submitting the current/new password form",
+                    description: "Fixed 2026-08-20 — the password-change API previously trusted the session cookie alone, with no server-side check of the current password at all. Submit the Change Password form with a correct current password; confirm you land on a \"we sent a code to your email\" step, and the password only actually updates after entering the correct code. Also verify: an expired/wrong code is rejected with a clear error, and \"Resend code\" works.",
+                    href: "/user/settings",
+                },
                 {
                     key: "own-public-profile-quick-links",
                     label: "\"View public profile\" is easy to find and works from three places: the My Account dashboard header, the My Account quick-links grid (\"My Public Profile\" tile), and the /user/profile page (next to \"Manage Addresses\")",

package/dist/index.d.ts

@@ -1396,7 +1396,9 @@ export { placeBid, buyNowAuction } from "./features/auctions/server";
 export type { PlaceBidInput, BuyNowAuctionInput, BuyNowAuctionResult } from "./features/auctions/server";
 export type { PlaceBidResult } from "./features/auctions/server";
 export { CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/checkout-value-otp";
+export { PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/password-change-otp";
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, } from "./features/checkout/server";
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 export { authMeGET } from "./features/auth/server";
 export { createPasswordResetToken } from "./features/auth/server";
 export { createVerificationToken } from "./features/auth/server";

package/dist/index.js

@@ -2591,12 +2591,16 @@ export { placeBid, buyNowAuction } from "./features/auctions/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT - Constant used across modules.
 export { CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/checkout-value-otp";
+// PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT - Constant used across modules.
+export { PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/password-change-otp";
 // [SERVER-ONLY] Tier PP — high-value checkout OTP gate. "use server" actions
 // belong in both index.ts and server.ts per the appkit Export Rules table;
 // these were only in server.ts, leaving src/actions/checkout.actions.ts's
 // `import { sendCheckoutValueOtp, verifyCheckoutValueOtp } from "@mohasinac/appkit"`
 // unresolved.
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, } from "./features/checkout/server";
+// [SERVER-ONLY] Password-change OTP gate — see features/auth/password-change-otp.ts.
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // authMeGET - Shared export for auth me get.
 export { authMeGET } from "./features/auth/server";

package/dist/providers/firebase-client/auth.d.ts

@@ -15,6 +15,7 @@ export declare class FirebaseClientAuthProvider implements IClientAuthProvider {
     sendPasswordResetEmail(email: string): Promise<void>;
     confirmPasswordReset(code: string, newPassword: string): Promise<void>;
     reauthenticateAndChangePassword(currentPassword: string, newPassword: string): Promise<void>;
+    reauthenticateOnly(currentPassword: string): Promise<void>;
     reauthenticateAndSendEmailUpdateVerification(currentPassword: string, newEmail: string): Promise<void>;
     reloadCurrentUser(): Promise<void>;
 }

package/dist/providers/firebase-client/auth.js

@@ -30,6 +30,13 @@ export class FirebaseClientAuthProvider {
         await reauthenticateWithCredential(user, credential);
         await updatePassword(user, newPassword);
     }
+    async reauthenticateOnly(currentPassword) {
+        const user = this._auth.currentUser;
+        if (!user?.email)
+            throw new Error("No authenticated user.");
+        const credential = EmailAuthProvider.credential(user.email, currentPassword);
+        await reauthenticateWithCredential(user, credential);
+    }
     async reauthenticateAndSendEmailUpdateVerification(currentPassword, newEmail) {
         const user = this._auth.currentUser;
         if (!user?.email)

package/dist/server.d.ts

@@ -248,6 +248,7 @@ export { listTopLevelCategories } from "./features/categories/server";
 export { updateCategory } from "./features/categories/server";
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, isCheckoutValueOtpVerified, } from "./features/checkout/server";
 export { FailedCheckoutRepository, failedCheckoutRepository } from "./features/checkout/server";
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 export type { FailedCheckoutMeta, FailedPaymentMeta } from "./features/checkout/server";
 export { EmailButton, EmailColumn, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailImage, EmailLink, EmailRow, } from "./features/email";
 export type { EmailButtonProps, EmailColumnProps, EmailContainerProps, EmailDividerProps, EmailDocProps, EmailFooterProps, EmailHeaderProps, EmailImageProps, EmailLinkProps, EmailRowProps, EmailTone, } from "./features/email";

package/dist/server.js

@@ -715,6 +715,8 @@ export { updateCategory } from "./features/categories/server";
 // [SERVER-ONLY] Tier PP — high-value checkout OTP gate.
 export { sendCheckoutValueOtp, verifyCheckoutValueOtp, isCheckoutValueOtpVerified, } from "./features/checkout/server";
 export { FailedCheckoutRepository, failedCheckoutRepository } from "./features/checkout/server";
+// [SERVER-ONLY] Password-change OTP gate — see features/auth/password-change-otp.ts.
+export { sendPasswordChangeOtp, verifyPasswordChangeOtp, isPasswordChangeOtpVerified, consumePasswordChangeOtp, } from "./features/auth/server";
 // [SERVER-ONLY] Email primitives — table-based, inline-styled components
 // that render email-client-compatible HTML via renderToStaticMarkup. Use
 // these instead of authoring raw <table>/<tr>/<td> in email templates.

package/dist/validation/schemas.d.ts

@@ -114,17 +114,17 @@ export declare const changePasswordSchema: z.ZodEffects<z.ZodObject<{
     currentPassword: z.ZodString;
     newPassword: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
 }, "strip", z.ZodTypeAny, {
-    newPassword: string;
     currentPassword: string;
-}, {
     newPassword: string;
+}, {
     currentPassword: string;
-}>, {
     newPassword: string;
+}>, {
     currentPassword: string;
-}, {
     newPassword: string;
+}, {
     currentPassword: string;
+    newPassword: string;
 }>;
 export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     sourceUrl: z.ZodEffects<z.ZodString, string, string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.5.3",
+  "version": "4.6.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"