Passwords

Three methods on ESPRMNeoAuth cover the password lifecycle after registration: recovering a forgotten password, and changing a known one. Recovery works without a session; change requires the user to be signed in.

All three are on the auth instance:

const auth = ESPRMNeoBase.getAuthInstance();

Recover a forgotten password

Two calls; request a code, then set the new password with it.

await auth.forgotPassword("<email>");
// user reads the code from their email or SMS
await auth.setNewPassword("<email>", "<new-password>", "<verification-code>");

forgotPassword(username) returns Promise<ForgotPasswordResponse>, which carries an optional message and nothing else. Do not branch on its contents to decide whether the account exists; that answer is deliberately not given.

setNewPassword(username, newPassword, verificationCode) returns Promise<SetNewPasswordResponse>, again an optional message. Argument order puts the password before the code; getting them the wrong way round produces an invalid-code failure rather than a type error, since both are strings.

Both throw ESPAuthError on failure, including when the code is wrong or expired.

Change a known password

await auth.changePassword("<old-password>", "<new-password>");

changePassword(oldPassword, newPassword) returns Promise<ChangePasswordResponse>. It requires a signed-in user: the call is authorised with the stored access token, so it throws ESPAuthError when nobody is signed in.

Changing a password does not invalidate the current session, and the SDK does not re-issue tokens afterwards. If your app wants other devices signed out, that is a deployment-level decision, not something this call does.

Which one to use

Situation	Method
User cannot sign in	forgotPassword then setNewPassword
User is signed in	changePassword

Method summary

Method	Returns
forgotPassword(username)	ForgotPasswordResponse
setNewPassword(username, newPassword, verificationCode)	SetNewPasswordResponse
changePassword(oldPassword, newPassword)	ChangePasswordResponse

Each response type is an object with an optional message. Success is the absence of a thrown error, not a field in the body.

Related

• Authentication — sign-up, sign-in and session restore
• Sessions and credentials — what a session holds
• Errors — ESPAuthError codes to branch on
• Types — the response interfaces in full