Old password is not required for signed in users to change password

[elitan]

hasura-auth-js PR: nhost/hasura-auth-js#7

[nunopato]

Are there any cases where it would make sense to provide the old password? if yes, then we should consider making it optional? If not, this is good to go 👍

[elitan]

Yea maybe making the oldPassword optional is something we could do.

My reasoning is, that I foresee us refactoring this password-change feature in the near future to support:

1. oldPassword - for people who know their old password
2. Some ticket - that comes from the fact that the user clicks on the password reset link in the email.

Basically, the user can change password if they either know their old password or recently clicked on a password reset link. Not, just by the fact that they are signed in.

However, having the oldPassword optional feels a bit... strange.

My intuition is that we remove the oldPassword parameter for now, to avoid optimizing for the future before we really know what route we want to go.

What do you think is the better approach here @nunopato ?

For reference: supabase/supabase#4042

[nunopato]

That sounds reasonable 🚢