{"record":{"id":"bbc096f7cf3cbaef","repo":"mem0ai/mem0","slug":"current-password-is-incorrect","errorCode":null,"errorMessage":"Current password is incorrect.","messagePattern":"Current password is incorrect\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"server/routers/auth.py","lineNumber":207,"sourceCode":"        if collision is not None:\n            raise HTTPException(status_code=409, detail=\"Email is already in use.\")\n        db_user.email = body.email\n\n    db.commit()\n    return db_user\n\n\n@router.post(\"/change-password\", response_model=MessageResponse)\ndef change_password(\n    body: ChangePasswordRequest,\n    user: User = Depends(require_auth),\n    db: Session = Depends(get_db),\n):\n    # require_auth resolves the user in its own short-lived session, so `user` is\n    # detached from this request's `db`. Load a session-managed copy to mutate.\n    db_user = db.get(User, user.id)\n    if db_user is None or not verify_password(body.current_password, db_user.password_hash):\n        raise HTTPException(status_code=401, detail=\"Current password is incorrect.\")\n\n    _require_password_length(body.new_password)\n\n    db_user.password_hash = hash_password(body.new_password)\n    db.commit()\n    return MessageResponse(message=\"Password updated.\")\n\n\n@router.post(\"/onboarding-complete\", response_model=MessageResponse)\ndef onboarding_complete(body: OnboardingCompleteRequest, user: User = Depends(require_auth)):\n    \"\"\"Fire the one-shot telemetry event after the setup wizard reaches its success state.\"\"\"\n    capture_onboarding_completed(email=user.email, use_case=body.use_case)\n    return MessageResponse(message=\"Onboarding completed.\")\n","sourceCodeStart":189,"sourceCodeEnd":221,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/server/routers/auth.py#L189-L221","documentation":"Raised by POST /auth/change-password when db.get(User, user.id) fails or verify_password(body.current_password, db_user.password_hash) returns False — i.e. the account no longer exists or the supplied current password does not match the stored hash. The server deliberately returns one 401 message for both conditions rather than distinguishing them.","triggerScenarios":"POST /auth/change-password with a wrong current_password; account deleted between authentication and the handler (db_user is None); password was changed in another session/tab after this client's token was issued, so the old password no longer verifies.","commonSituations":"User typos the current password; password recently rotated elsewhere and the client form holds the stale one; copy/paste with trailing whitespace in the password field; user row removed by an admin mid-session.","solutions":["Confirm current_password exactly matches the account's existing password (check for stray whitespace/newlines in the payload)","If the password was changed in another session, re-enter the new current password or use password reset","If the account was deleted, no fix is possible — re-register and log in again"],"exampleFix":"// before\nawait post(\"/auth/change-password\", { current_password: formData.pass, new_password: formData.newPass }); // typo in current\n\n// after\nconst pw = formData.currentPassword.trim(); // only if your product trims; otherwise ensure exact input\nawait post(\"/auth/change-password\", { current_password: pw, new_password: formData.newPassword });","handlingStrategy":"try-catch","validationCode":"// cheap client-side sanity checks before the call\nif (!formData.currentPassword) throw new Error(\"Current password is required\");\nif (formData.newPassword.length < minPasswordLength) throw new Error(\"New password too short\");","typeGuard":null,"tryCatchPattern":"catch (e) {\n  if (e.status === 401 && e.detail === \"Current password is incorrect.\") {\n    showFieldError(\"currentPassword\", \"Incorrect current password\");\n    return;\n  }\n  throw e;\n}","preventionTips":["Show a dedicated inline error on the current-password field for this 401; never auto-retry","If the password may have changed elsewhere, offer a reset-password link on the second failure","Submit the exact user input; do not transform the password field (trim, lowercase) client-side"],"tags":["auth","password","http-401","change-password"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}