Max PeintnerandGitHub 00481bd2dc fix(login): prevent eventual consistency issues on /password/change, missing permissions (#11371) ...

Closes #11345 

# Which Problems Are Solved

When changing password, users could have run into a race condition /
eventual consistency issue which resulted in:

- Verification failures in `sendPassword`
- The user receiving a `couldNotCreateSession` or
`couldNotCreateSessionForUser` error despite providing a valid password.
 
# How the Problems Are Solved

- Previously, `checkSessionAndSetPassword` was fired without await,
causing the code to proceed immediately to
`sendPassword`. This resulted in `sendPassword` trying to verify the
user's session with the new password before the password update had
actually completed on the server.
- Now the password change call is executed by the login service user
only, ommitting eventual `membership not found (AUTHZ-cdgFk)` errors
from the API by using the user session itself. The login checks for a
recent password change (within 5 minutes) as well to ensure session
freshness.

2026-01-20 09:15:13 +00:00

..

api

chore: replace given and family names with first and last names (#11343)

2026-01-15 10:29:48 +00:00

login

fix(login): prevent eventual consistency issues on /password/change, missing permissions (#11371)

2026-01-20 09:15:13 +00:00