Change Password Notifier

Authenticated password rotation from the settings screen. Posts old + new password to /store/change-password/emailpass-verified using the current customer token.

1. ChangePasswordScreen calls changePassword(oldPassword, newPassword).
2. DioHelper.post fires with authScope='customer' — interceptor attaches the customer bearer token.
3. 200 → state.isUpdated = true; the screen pops back to settings with a success snackbar.
4. Non-200 / network error → state.error is set with a generic message.

• Backend HTML 500 (rare) — caught and surfaced as 'Server error. Please try again later.' (see auth-api-service _handleBadResponse-like logic inline).
• Wrong old password → 401/403 with message rewritten to 'Current password is incorrect'.
• Successful rotation does not invalidate the local token — the same bearer keeps working until natural expiry.

• lib/src/features/shared/auth/change_password/presentation/providers/change_password_notifier.dart:13
• lib/src/core/services/auth_service.dart:270 // AuthApiService.changePassword (legacy /auth/password-change/)

• POST/store/change-password/emailpass-verifiedno status

  Rotate the authenticated customer's password from the settings screen.

  Request

  { old_password: string, new_password: string }

  Response

  200 (no body)

  Errors

  • ·401/403 wrong old password — rewritten as 'Current password is incorrect'
  • ·HTML 5xx — surfaced as 'Server error. Please try again later.'

  lib/src/features/shared/auth/change_password/presentation/change_password.dart

  auth: customer bearer (authScope='customer'). Token is NOT invalidated on success — same bearer keeps working.

• POST/auth/password-change/no status

  Legacy password-change endpoint kept on AuthApiService but no longer wired into any UI.

  Request

  { current_password: string, new_password: string, new_password_confirm: string }

  Response

  200 (no body)

  lib/src/core/services/auth_service.dart:270

  auth: customer bearer. Unused in UI today — kept for backwards compatibility.

There are TWO change-password endpoints in the code: this notifier hits /store/change-password/emailpass-verified; AuthApiService.changePassword hits /auth/password-change/. Only the notifier path is wired into the UI today.