feat: add password change, class unenroll, and optional notify flags

Let admins skip SMS on user, class, and invoice actions, and let users change their own password with the current one.

components/auth/authController.js

@@ -22,3 +22,13 @@ exports.logout = catchAsync(async (req, res, next) => {
   await authService.logout(userId, refreshToken);
   return successResponse(res, 200, 'Logout successful');
 });
+
+exports.changePassword = catchAsync(async (req, res) => {
+  const { currentPassword, newPassword, refreshToken } = req.body;
+  await authService.changePassword(req.user._id, {
+    currentPassword,
+    newPassword,
+    refreshToken
+  });
+  return successResponse(res, 200, 'Password changed successfully');
+});

components/auth/authRoutes.js

@@ -10,5 +10,6 @@ const router = express.Router();
 router.post('/login', validateLogin, authController.login);
 router.post('/refresh', validateRefresh, authController.refresh);
 router.post('/logout', authMiddleware, authController.logout);
+router.put('/change-password', authMiddleware, authController.changePassword);
 
 module.exports = router;

components/auth/authService.js

@@ -6,6 +6,7 @@ const User = require('../users/userModel');
 const config = require('../../config/config');
 const AppError = require('../../utils/AppError');
 const { isBootstrapSuperAdminDisabled } = require('../../utils/superAdmin');
+const { assertPasswordStrength } = require('../../utils/passwordRules');
 
 const generateTokens = (user) => {
   const payload = {
@@ -104,8 +105,37 @@ const logout = async (userId, refreshTokenString) => {
   return true;
 };
 
+const changePassword = async (userId, { currentPassword, newPassword, refreshToken: currentRefreshToken }) => {
+  if (!currentPassword) {
+    throw new AppError('INVALID_CURRENT_PASSWORD');
+  }
+  assertPasswordStrength(newPassword);
+
+  const user = await User.findById(userId);
+  if (!user || !user.isActive || isBootstrapSuperAdminDisabled(user)) {
+    throw new AppError('USER_NOT_FOUND');
+  }
+
+  const isMatch = await bcrypt.compare(currentPassword, user.passwordHash);
+  if (!isMatch) {
+    throw new AppError('INVALID_CURRENT_PASSWORD');
+  }
+
+  user.passwordHash = await bcrypt.hash(newPassword, 10);
+
+  if (currentRefreshToken) {
+    user.refreshTokens = user.refreshTokens.filter((rt) => rt.token === currentRefreshToken);
+  } else {
+    user.refreshTokens = [];
+  }
+
+  await user.save();
+  return true;
+};
+
 module.exports = {
   login,
   refreshToken,
-  logout
+  logout,
+  changePassword
 };