diff --git a/innungsapp/apps/admin/lib/auth.ts b/innungsapp/apps/admin/lib/auth.ts
index 6a1f297..0e158bc 100644
--- a/innungsapp/apps/admin/lib/auth.ts
+++ b/innungsapp/apps/admin/lib/auth.ts
@@ -48,8 +48,7 @@ export const auth = betterAuth({
],
session: {
cookieCache: {
- enabled: true,
- maxAge: 60 * 5, // 5 minutes cache
+ enabled: false,
},
},
})
diff --git a/innungsapp/apps/admin/server/routers/members.ts b/innungsapp/apps/admin/server/routers/members.ts
index 2b3a36c..ec1313b 100644
--- a/innungsapp/apps/admin/server/routers/members.ts
+++ b/innungsapp/apps/admin/server/routers/members.ts
@@ -55,11 +55,14 @@ async function createUserDirectly(opts: { email: string; name: string; password:
return { id: userId }
}
+const nonEmptyString = (min = 2) =>
+ z.preprocess((val) => (val === '' ? undefined : val), z.string().min(min).optional())
+
const MemberInput = z.object({
name: z.string().min(2),
- betrieb: z.string().min(2),
- sparte: z.string().min(2),
- ort: z.string().min(2),
+ betrieb: z.preprocess((v) => (v === '' ? undefined : v), z.string().optional()),
+ sparte: z.preprocess((v) => (v === '' ? undefined : v), z.string().optional()),
+ ort: z.preprocess((v) => (v === '' ? undefined : v), z.string().optional()),
telefon: z.string().optional(),
email: z.string().email(),
status: z.enum(['aktiv', 'ruhend', 'ausgetreten']).default('aktiv'),
@@ -375,7 +378,22 @@ export const membersRouter = router({
* Update member (admin only)
*/
update: adminProcedure
- .input(z.object({ id: z.string(), data: MemberInput.partial().extend({ role: z.enum(['member', 'admin']).optional() }) }))
+ .input(z.object({
+ id: z.string(),
+ data: z.object({
+ name: nonEmptyString(),
+ betrieb: nonEmptyString(),
+ sparte: nonEmptyString(),
+ ort: nonEmptyString(),
+ telefon: z.string().optional(),
+ email: z.preprocess((v) => (v === '' ? undefined : v), z.string().email().optional()),
+ status: z.enum(['aktiv', 'ruhend', 'ausgetreten']).optional(),
+ istAusbildungsbetrieb: z.boolean().optional(),
+ seit: z.number().int().min(1900).max(2100).optional(),
+ role: z.enum(['member', 'admin']).optional(),
+ password: z.preprocess((val) => (val === '' ? undefined : val), z.string().min(8).optional()),
+ }),
+ }))
.mutation(async ({ ctx, input }) => {
const { role, password, ...memberData } = input.data
@@ -524,19 +542,12 @@ export const membersRouter = router({
where: { userId: targetUserId, providerId: 'credential' }
})
if (existingCredAccount) {
- const authHeaders = await getSanitizedHeaders()
- let nameForUpdate = memberData.name
- if (!nameForUpdate) {
- const existingUser = await ctx.prisma.user.findUnique({ where: { id: targetUserId }, select: { name: true } })
- nameForUpdate = existingUser?.name ?? undefined
- }
- await auth.api.updateUser({
- body: {
- userId: targetUserId,
- password,
- ...(nameForUpdate && { name: nameForUpdate }),
- },
- headers: authHeaders,
+ // Update password hash directly — auth.api.updateUser requires Better Auth admin role
+ // which our custom UserRole system doesn't set, causing silent failures.
+ const newHash = await hashPassword(password)
+ await ctx.prisma.account.update({
+ where: { id: existingCredAccount.id },
+ data: { password: newHash },
})
} else {
// No credential account — create one from scratch using Better Auth's own hash format
diff --git a/innungsapp/apps/mobile/app/(app)/_layout.tsx b/innungsapp/apps/mobile/app/(app)/_layout.tsx
index b611075..7b01923 100644
--- a/innungsapp/apps/mobile/app/(app)/_layout.tsx
+++ b/innungsapp/apps/mobile/app/(app)/_layout.tsx
@@ -57,7 +57,6 @@ function ChatTabIcon({ color, focused }: { color: string; focused: boolean }) {
function ForcePasswordChangeScreen() {
const { setSession, signOut } = useAuthStore()
- const [current, setCurrent] = useState('')
const [next, setNext] = useState('')
const [confirm, setConfirm] = useState('')
const [loading, setLoading] = useState(false)
@@ -65,32 +64,39 @@ function ForcePasswordChangeScreen() {
async function handleSubmit() {
setError('')
- if (!current) { setError('Bitte temporäres Passwort eingeben.'); return }
if (next.length < 8) { setError('Das neue Passwort muss mindestens 8 Zeichen haben.'); return }
if (next !== confirm) { setError('Die Passwörter stimmen nicht überein.'); return }
setLoading(true)
- const result = await authClient.changePassword({ currentPassword: current, newPassword: next })
- setLoading(false)
-
- if (result.error) {
- setError(result.error.message ?? 'Passwort konnte nicht geändert werden.')
- return
- }
-
- // Refresh session — mustChangePassword is now false
- const sessionResult = await authClient.getSession()
- if (sessionResult?.data?.user) {
- const u = sessionResult.data.user as any
- await setSession({
- user: {
- id: u.id,
- email: u.email,
- name: u.name,
- mustChangePassword: false,
+ // Set password directly via tRPC (no old password needed — user is already authenticated)
+ try {
+ const apiUrl = process.env.EXPO_PUBLIC_API_URL ?? 'http://localhost:3032'
+ const sessionResult = await authClient.getSession()
+ const token = (sessionResult?.data as any)?.session?.token
+ const res = await fetch(`${apiUrl}/api/auth/force-set-password`, {
+ method: 'POST',
+ headers: {
+ 'Content-Type': 'application/json',
+ ...(token ? { Authorization: `Bearer ${token}` } : {}),
},
+ credentials: 'include',
+ body: JSON.stringify({ newPassword: next }),
})
+ const data = await res.json()
+ if (!res.ok || data.error) {
+ setError(data.error ?? 'Passwort konnte nicht geändert werden.')
+ setLoading(false)
+ return
+ }
+ // Update local session state
+ if (sessionResult?.data?.user) {
+ const u = sessionResult.data.user as any
+ await setSession({ user: { id: u.id, email: u.email, name: u.name, mustChangePassword: false } })
+ }
+ } catch (e) {
+ setError('Verbindungsfehler. Bitte erneut versuchen.')
}
+ setLoading(false)
}
return (
@@ -100,23 +106,11 @@ function ForcePasswordChangeScreen() {
- Passwort ändern
+ Passwort festlegen
- Ihr Administrator hat ein temporäres Passwort vergeben. Bitte legen Sie jetzt Ihr persönliches Passwort fest.
+ Bitte legen Sie jetzt Ihr persönliches Passwort fest.
-
- Temporäres Passwort
-
-
Neues Passwort