fix(auth): never report a completed password change as failed

[alpha5611331]

Closes #104

The remember-me write in changePassword sat inside the same try as the request:

if (configStore.getConfig().rememberMe) {
  configStore.updateConfig({ password: newPassword });   // inside the try
}
return { success: true };
} catch {
  return { success: false, error: 'Change password failed' };   // swallows it
}

So an electron-store failure (disk full, permissions, a corrupted file) returned success: false from a change the server had already made.

Why that is worse than it sounds

The password is live at that point. The user is told the change failed, and the change-password dialog then asks them to retry with a current password that is no longer current, so the retry fails too. There is no path from that state back to a correct message: nothing on screen ever says the change went through, and the one thing the UI invites them to do cannot work.

This is the same defect fixed on the reset path in #103 (02fdc7e), where it was sharper still because the reset code is single-use. changePassword has the identical shape and was left alone there only because it was outside that PR's scope. login.tsx has drawn this line all along:

// Persisting the remember-me choice must never block the sign-in attempt.

The change

The store write gets its own try and logs on failure. The return value now depends only on what the server said, which is the only thing that reflects whether the password actually changed.

Tests

New test/change-password.test.mjs, modelled on test/password-reset.test.mjs, registered in test/run.mjs:

• the password is written when rememberMe is on, and not when it is off
• a rejected change reports failure and leaves the store alone
• the regression: updateConfig throws, and the change still reports success

The last one fails against the old shape. The run log shows the throw actually happening and being caught, so it is not passing vacuously.

Verification

eslint, both tsc configs, and pnpm test:main all clean locally (the set CI runs). 7 new checks.

Cut from main at 7128884, immediately after #103 merged.

🤖 Generated with Claude Code

[gitar-bot]

Code Review ✅ Approved

Isolates the remember-me store write during changePassword so disk errors no longer falsely report server-side password changes as failed. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}