AuthService.changePassword keeps the remember-me store write inside the same try as the request, so a failure to write to disk is reported as a failed password change:
// src/main/services/auth.service.ts
try {
const response = await this.client.changePassword({ ... });
if (response.error) {
return { success: false, error: response.error.message || 'Change password failed' };
}
if (configStore.getConfig().rememberMe) {
configStore.updateConfig({ password: newPassword }); // <- inside the try
}
return { success: true };
} catch {
return { success: false, error: 'Change password failed' }; // <- swallows it
}
If electron-store throws (disk full, permissions, a corrupted file), the password has already been changed on the server. The user is told the change failed, and the dialog invites them to try again with a "current password" that is no longer current, so the retry fails too. Nothing on screen says the change actually went through.
Why now
This is the same defect that was just fixed on the reset path in #103 (02fdc7e), where the consequence was worse because the reset code is single-use. changePassword is the same shape and was left alone there only because it was outside that PR's scope.
login.tsx already draws this line explicitly for the same reason:
// Persisting the remember-me choice must never block the sign-in attempt.
Fix
Give the store write its own try, log on failure, and return { success: true } regardless, matching what resetPassword now does. Add a check to test/change-password.test.mjs (or the existing main-process suite) that makes updateConfig throw and asserts the change is still reported as successful, mirroring test/password-reset.test.mjs.
Pre-existing on main.
AuthService.changePasswordkeeps the remember-me store write inside the sametryas the request, so a failure to write to disk is reported as a failed password change:If
electron-storethrows (disk full, permissions, a corrupted file), the password has already been changed on the server. The user is told the change failed, and the dialog invites them to try again with a "current password" that is no longer current, so the retry fails too. Nothing on screen says the change actually went through.Why now
This is the same defect that was just fixed on the reset path in #103 (
02fdc7e), where the consequence was worse because the reset code is single-use.changePasswordis the same shape and was left alone there only because it was outside that PR's scope.login.tsxalready draws this line explicitly for the same reason:// Persisting the remember-me choice must never block the sign-in attempt.Fix
Give the store write its own
try, log on failure, and return{ success: true }regardless, matching whatresetPasswordnow does. Add a check totest/change-password.test.mjs(or the existing main-process suite) that makesupdateConfigthrow and asserts the change is still reported as successful, mirroringtest/password-reset.test.mjs.Pre-existing on
main.