Change the Password in TypeScript

Users must be able to change their password, for instance when they think someone saw it. The route is PUT /me/password: PUT because it replaces a value the user already has, and /me because it is about the logged-in user. It sits behind loginRequired, so the route finds the user in req.user.

Changing a value of "me": the same pattern works for any value of the logged-in user. Here is a route that changes the user's email:

app.put("/me/email", loginRequired, (req: Request, res: Response) => {
  const data = req.body;
  db.prepare("UPDATE users SET email = ? WHERE id = ?").run(data.email, req.user.id);
  res.json({ email: data.email });
});

A password needs three more safety rules. Ask for the old password and check it against the stored hash: a stolen token, or a laptop left logged in, must not be enough to take the account, so a wrong old password gets 403. Store only the hash of the new password. Then delete all the user's tokens and destroy the session: every device, this one too, must log in again with the new password.

Ana is logged in twice: on her phone with the token <phone> and on her laptop with <token>. Your code must give these answers, in this order:

PUT /me/password  {"old_password": "guess123", "new_password": "newsecret456"}   (Bearer <token>)
    →  403  {"error": "Wrong password"}
PUT /me/password  {"old_password": "secret123", "new_password": "newsecret456"}  (Bearer <token>)
    →  200  {"message": "Password changed, please log in again"}
GET /me  (Bearer <phone>)  →  401  {"error": "Login required"}
GET /me  (Bearer <token>)  →  401  {"error": "Login required"}
POST /login  {"email": "ana@example.com", "password": "secret123"}     →  401  {"error": "Wrong email or password"}
POST /login  {"email": "ana@example.com", "password": "newsecret456"}  →  200  {"token": "<new>"}
GET /me  (the new login's session)  →  200  {"email": "ana@example.com", "id": 2, "role": "customer"}

Your task: below the /logout route, add PUT /me/password behind loginRequired. Answer { error: "Wrong password" } with 403 when the old password doesn't match. Otherwise store the new password's hash, delete all the user's tokens, destroy the session and answer { message: "Password changed, please log in again" }.

Assignment
Follow the Coding Tutorial to build the PUT /me/password route, one safety rule at a time.

Hint
req.user has no password hash in it: fetch it with SELECT password_hash FROM users WHERE id = ? and cast the row as { password_hash: string }. Delete the tokens with WHERE user_id = ?, not WHERE token = ?, so every device is logged out.