moeru-ai/airi · error · Error

changePassword failed

Error message

changePassword failed

What it means

Thrown by changePassword when better-auth's client.changePassword returns an error. The call sends currentPassword, newPassword, and revokeOtherSessions (defaulting true). The fallback 'changePassword failed' appears only when the server error has no message. A documented case: social-only users (no credential account) get a server-side error here.

Source

Thrown at apps/ui-server-auth/src/modules/profile.ts:151

 * Change the signed-in user's password using their current credential.
 *
 * Use when:
 * - User is signed in and wants to rotate their password from the profile
 *   page (not the forgot-password email flow).
 *
 * Expects:
 * - The user has a `credential` account; social-only users get a server-side
 *   error which surfaces as a thrown `Error` here.
 */
export async function changePassword(args: ChangePasswordArgs): Promise<void> {
  const client = getAuthClient(args)
  const { error } = await client.changePassword({
    currentPassword: args.currentPassword,
    newPassword: args.newPassword,
    revokeOtherSessions: args.revokeOtherSessions ?? true,
  })
  if (error)
    throw new Error(error.message ?? 'changePassword failed')
}

/**
 * Sign the current user out via better-auth's `/sign-out` endpoint.
 *
 * Use when:
 * - User clicks "Sign out" on the profile page.
 *
 * Returns:
 * - Resolves once the better-auth session cookie has been cleared by the
 *   server. Caller is expected to navigate the user back to the sign-in
 *   page after this resolves.
 */
export async function signOut(args: AuthFetchBase): Promise<void> {
  const client = getAuthClient(args)
  const { error } = await client.signOut()
  if (error)
    throw new Error(error.message ?? 'signOut failed')

View on GitHub (pinned to 27111382b4)

Solutions

1. Surface error.message to the currentPassword field — 'Invalid credentials' style messages come straight from better-auth.
2. For social-only users, guide them to set a password via forgot-password flow instead.
3. Validate newPassword against the same complexity rules client-side before submitting.
4. Handle revokeOtherSessions semantics: inform the user other devices will be signed out.

function meetsPasswordPolicy(pw) {
  return typeof pw === 'string' && pw.length >= 8
}
if (!meetsPasswordPolicy(args.newPassword))
  throw new Error('New password does not meet policy.')

try {
  await changePassword(args)
} catch (e) {
  // map e.message to the currentPassword or newPassword field
}

When it happens

Trigger: Submitting the change-password form with an incorrect currentPassword; newPassword failing server complexity rules; the user has only social/OAuth accounts and no credential to rotate; session expired mid-flow.

Common situations: User mistypes current password; new password violates server policy; attempting password change on an account created via Google/GitHub sign-in; rate limiting on password endpoints.

Related errors

• Auth request failed (${error.status ?? 'unknown'})
• updateUser failed
• signOut failed
• Auth request failed (${response.status})
• Unexpected response

AI-assisted analysis of moeru-ai/airi@27111382b4 (2026-08-12). Data as JSON: /api/errors/8567949093ace4ca. Report an issue: GitHub.