@mohasinac/appkit 4.6.0 → 4.6.2

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -71,6 +71,12 @@ const rawTesterChecklistItems = [
                 { key: "avatar-upload", label: "Uploading a profile avatar works" },
                 { key: "notification-prefs", label: "Notification preferences save correctly" },
                 { key: "public-profile-toggle", label: "Public profile visibility toggle works" },
+                {
+                    key: "password-change-otp-required",
+                    label: "Changing your password from Settings requires entering an emailed 6-digit code before it actually takes effect — the password does not change just from submitting the current/new password form",
+                    description: "Fixed 2026-08-20 — the password-change API previously trusted the session cookie alone, with no server-side check of the current password at all. Submit the Change Password form with a correct current password; confirm you land on a \"we sent a code to your email\" step, and the password only actually updates after entering the correct code. Also verify: an expired/wrong code is rejected with a clear error, and \"Resend code\" works.",
+                    href: "/user/settings",
+                },
                 {
                     key: "own-public-profile-quick-links",
                     label: "\"View public profile\" is easy to find and works from three places: the My Account dashboard header, the My Account quick-links grid (\"My Public Profile\" tile), and the /user/profile page (next to \"Manage Addresses\")",

package/dist/providers/firebase-client/auth.d.ts

@@ -14,6 +14,8 @@ export declare class FirebaseClientAuthProvider implements IClientAuthProvider {
     applyActionCode(code: string): Promise<void>;
     sendPasswordResetEmail(email: string): Promise<void>;
     confirmPasswordReset(code: string, newPassword: string): Promise<void>;
+    /** Re-authenticates the current user against `currentPassword`, returning the now-fresh user. Throws if no user is signed in. */
+    private _reauthenticate;
     reauthenticateAndChangePassword(currentPassword: string, newPassword: string): Promise<void>;
     reauthenticateOnly(currentPassword: string): Promise<void>;
     reauthenticateAndSendEmailUpdateVerification(currentPassword: string, newEmail: string): Promise<void>;

package/dist/providers/firebase-client/auth.js

@@ -1,4 +1,5 @@
 import { applyActionCode as fbApplyActionCode, confirmPasswordReset as fbConfirmPasswordReset, EmailAuthProvider, reauthenticateWithCredential, sendPasswordResetEmail as fbSendPasswordResetEmail, signInWithEmailAndPassword as fbSignInWithEmailAndPassword, updatePassword, verifyBeforeUpdateEmail, } from "firebase/auth";
+const NO_AUTHENTICATED_USER_MESSAGE = "No authenticated user.";
 /**
  * Firebase Auth client SDK implementation of IClientAuthProvider.
  *
@@ -22,27 +23,24 @@ export class FirebaseClientAuthProvider {
     async confirmPasswordReset(code, newPassword) {
         await fbConfirmPasswordReset(this._auth, code, newPassword);
     }
-    async reauthenticateAndChangePassword(currentPassword, newPassword) {
+    /** Re-authenticates the current user against `currentPassword`, returning the now-fresh user. Throws if no user is signed in. */
+    async _reauthenticate(currentPassword) {
         const user = this._auth.currentUser;
         if (!user?.email)
-            throw new Error("No authenticated user.");
+            throw new Error(NO_AUTHENTICATED_USER_MESSAGE);
         const credential = EmailAuthProvider.credential(user.email, currentPassword);
         await reauthenticateWithCredential(user, credential);
+        return user;
+    }
+    async reauthenticateAndChangePassword(currentPassword, newPassword) {
+        const user = await this._reauthenticate(currentPassword);
         await updatePassword(user, newPassword);
     }
     async reauthenticateOnly(currentPassword) {
-        const user = this._auth.currentUser;
-        if (!user?.email)
-            throw new Error("No authenticated user.");
-        const credential = EmailAuthProvider.credential(user.email, currentPassword);
-        await reauthenticateWithCredential(user, credential);
+        await this._reauthenticate(currentPassword);
     }
     async reauthenticateAndSendEmailUpdateVerification(currentPassword, newEmail) {
-        const user = this._auth.currentUser;
-        if (!user?.email)
-            throw new Error("No authenticated user.");
-        const credential = EmailAuthProvider.credential(user.email, currentPassword);
-        await reauthenticateWithCredential(user, credential);
+        const user = await this._reauthenticate(currentPassword);
         await verifyBeforeUpdateEmail(user, newEmail);
     }
     async reloadCurrentUser() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.6.0",
+  "version": "4.6.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"