Feat: change password functionality

public/js/app.js

@@ -5,6 +5,7 @@
          statsModal: closeStats, settingsModal: closeSettings,
          cardSearchModal: closeCardSearch,
          attachViewerModal: closeAttachViewer,
+         changePasswordModal: closeChangePasswordModal,
          tasksModal: closeTasks })[id]?.();
     }
   }
@@ -15,7 +16,7 @@
       clearSearch(); closeAddModal(); closeDayModal(); closeStats(); closeSettings(); closeTasks();
       closeCurveModal(); closeLinkModal(); closeGraphModal();
       closeDeckPrompt(); closeDeckModal(); closeStudyModal(); closeCardSearch();
-      closeSidebar(); closeAttachViewer();
+      closeSidebar(); closeAttachViewer(); closeChangePasswordModal();
     }
     // Study modal keyboard navigation
     if (studyState) {

public/js/auth.js

@@ -12,6 +12,12 @@
     }
     const menuEmail = document.getElementById('userMenuEmail');
     if (menuEmail) menuEmail.textContent = user.email || '';
+
+    const changePwdBtn = document.getElementById('changePasswordMenuBtn');
+    if (changePwdBtn) {
+      const isLocal = localStorage.getItem('recall_mode') === 'local';
+      changePwdBtn.style.display = isLocal ? 'none' : 'block';
+    }
   })();
 
   function toggleUserMenu() {

public/js/stats.js

@@ -605,3 +605,88 @@
   }
 
   function closeSettings() { document.getElementById('settingsModal').classList.remove('active'); }
+
+  async function submitChangePassword() {
+    const oldPassword = document.getElementById('oldPasswordInput').value;
+    const newPassword = document.getElementById('newPasswordInput').value;
+    const confirmPassword = document.getElementById('confirmPasswordInput').value;
+    const msgEl = document.getElementById('changePasswordMessage');
+
+    // Reset message
+    msgEl.style.display = 'none';
+    msgEl.textContent = '';
+    msgEl.style.color = '';
+
+    if (!oldPassword || !newPassword || !confirmPassword) {
+      msgEl.textContent = 'All fields are required.';
+      msgEl.style.color = 'var(--amber-dk)';
+      msgEl.style.display = 'block';
+      return;
+    }
+
+    if (newPassword.length < 8) {
+      msgEl.textContent = 'New password must be at least 8 characters.';
+      msgEl.style.color = 'var(--amber-dk)';
+      msgEl.style.display = 'block';
+      return;
+    }
+
+    if (newPassword !== confirmPassword) {
+      msgEl.textContent = 'New passwords do not match.';
+      msgEl.style.color = 'var(--amber-dk)';
+      msgEl.style.display = 'block';
+      return;
+    }
+
+    try {
+      const res = await authFetch('/api/user/change-password', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ oldPassword, newPassword })
+      });
+
+      const data = await res.json();
+
+      if (!res.ok) {
+        msgEl.textContent = data.error || 'Failed to update password.';
+        msgEl.style.color = 'var(--amber-dk)';
+        msgEl.style.display = 'block';
+      } else {
+        msgEl.textContent = 'Password updated successfully!';
+        msgEl.style.color = 'var(--accent)';
+        msgEl.style.display = 'block';
+        // Clear fields
+        document.getElementById('oldPasswordInput').value = '';
+        document.getElementById('newPasswordInput').value = '';
+        document.getElementById('confirmPasswordInput').value = '';
+      }
+    } catch (err) {
+      console.error(err);
+      msgEl.textContent = 'Network or server error.';
+      msgEl.style.color = 'var(--amber-dk)';
+      msgEl.style.display = 'block';
+    }
+  }
+
+  function openChangePasswordModal() {
+    const menu = document.getElementById('userMenu');
+    if (menu) menu.classList.remove('open');
+
+    const isLocal = localStorage.getItem('recall_mode') === 'local';
+    if (isLocal) {
+      showToast('ℹ️ Change password is not available in local mode.');
+      return;
+    }
+
+    document.getElementById('oldPasswordInput').value = '';
+    document.getElementById('newPasswordInput').value = '';
+    document.getElementById('confirmPasswordInput').value = '';
+    const msgEl = document.getElementById('changePasswordMessage');
+    msgEl.style.display = 'none';
+    msgEl.textContent = '';
+    document.getElementById('changePasswordModal').classList.add('active');
+  }
+
+  function closeChangePasswordModal() {
+    document.getElementById('changePasswordModal').classList.remove('active');
+  }

server.js

@@ -7,8 +7,11 @@ const crypto   = require('crypto');
 const os       = require('os');
 const fs       = require('fs');
 const AdmZip   = require('adm-zip');
+
 const { computeSM2, addDays, todayUTC, nextRecurDate, toResponse, sanitizeCards } = require('./public/shared-utils');
 
+
+
 const app  = express();
 const dbPath = process.env.DB_PATH || path.join(__dirname, 'recall.db');
 const db   = new Database(dbPath);
@@ -305,6 +308,10 @@ app.put('/api/settings', requireAuth, (req, res) => {
   res.json({ ok: true });
 });
 
+// ── User ─────────────────────────────────────────────────────────────────────
+const { changePassword } = require('./src/controllers/userController');
+app.post('/api/user/change-password', requireAuth, changePassword(db));
+
 // ── Study Sessions (per-user) ─────────────────────────────────────────────────
 
 app.get('/api/sessions', requireAuth, (req, res) => {

src/controllers/userController.js

@@ -0,0 +1,45 @@
+const bcrypt = require('bcrypt');
+const SALT_ROUNDS = 12;
+
+function changePassword(db) {
+  return async (req, res) => {
+    const { oldPassword, newPassword } = req.body;
+    const userId = req.user.id;
+
+    if (!oldPassword || !newPassword) {
+      return res.status(400).json({ error: 'Old password and new password are required' });
+    }
+    if (newPassword.length < 8) {
+      return res.status(400).json({ error: 'New password must be at least 8 characters' });
+    }
+
+    try {
+      // Get current user password hash from db
+      const user = db.prepare('SELECT password_hash FROM users WHERE id = ?').get(userId);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+
+      // Compare old password
+      const match = await bcrypt.compare(oldPassword, user.password_hash);
+      if (!match) {
+        return res.status(400).json({ error: 'Incorrect old password' });
+      }
+
+      // Hash new password
+      const hash = await bcrypt.hash(newPassword, SALT_ROUNDS);
+
+      // Update password hash in db
+      db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(hash, userId);
+
+      res.json({ message: 'Password updated successfully' });
+    } catch (error) {
+      console.error('Error changing password:', error);
+      res.status(500).json({ error: 'Internal server error' });
+    }
+  };
+}
+
+module.exports = {
+  changePassword
+};