From be15f3107330f50ce042520f7f7d822a7c546f0e Mon Sep 17 00:00:00 2001
From: enlineawork <enlinea.work@gmail.com>
Date: Tue, 8 Sep 2026 17:18:56 -0300
Subject: [PATCH] feat(auth): expose audited mobile password change

---
 api-v3/src/auth/mobile-auth.controller.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/api-v3/src/auth/mobile-auth.controller.ts b/api-v3/src/auth/mobile-auth.controller.ts
index 05cad07..296a084 100644
--- a/api-v3/src/auth/mobile-auth.controller.ts
+++ b/api-v3/src/auth/mobile-auth.controller.ts
@@ -13,6 +13,7 @@ import type {
 import { CurrentAuth } from './decorators/current-auth.decorator';
 import { Public } from './decorators/public.decorator';
 import { SkipCsrf } from './decorators/skip-csrf.decorator';
+import { ChangePasswordDto } from './dto/change-password.dto';
 import { LoginDto } from './dto/login.dto';
 import { MobileRefreshDto } from './dto/mobile-refresh.dto';
 import { MobileAuthService } from './mobile-auth.service';
@@ -53,4 +54,15 @@ export class MobileAuthController {
   ) {
     return this.mobileAuth.logout(principal, request);
   }
+
+  @Post('change-password')
+  @HttpCode(200)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
+  changePassword(
+    @CurrentAuth() principal: AuthPrincipal,
+    @Body() dto: ChangePasswordDto,
+    @Req() request: RequestWithContext,
+  ) {
+    return this.mobileAuth.changePassword(principal, dto, request);
+  }
 }