Summary
A signed-in retail customer (ROLE_USER) has no way to change their own password. The customer self-service portal should let a customer change their password.
Scope
GET /customer/password — form: current password, new password, confirm new password.POST /customer/password — verify the current password (BCrypt match), require new == confirm and non-blank, persist the BCrypt-encoded new password.- "Change Password" nav item in the customer navbar.
- Resolve the current customer via the authenticated principal (username); no other account is touchable.
@PreAuthorize("isAuthenticated()").
Acceptance
A logged-in customer can change their password (wrong current password / mismatch are rejected with a clear message) and then log in with the new password.
Summary
A signed-in retail customer (ROLE_USER) has no way to change their own password. The customer self-service portal should let a customer change their password.
Scope
GET /customer/password— form: current password, new password, confirm new password.POST /customer/password— verify the current password (BCrypt match), require new == confirm and non-blank, persist the BCrypt-encoded new password.@PreAuthorize("isAuthenticated()").Acceptance
A logged-in customer can change their password (wrong current password / mismatch are rejected with a clear message) and then log in with the new password.