feat: complete remaining Go backend modules

backend/internal/identity/password_change_test.go

@@ -0,0 +1,44 @@
+package identity
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+type passwordChangeStoreStub struct {
+	snapshot          AuthorizationSnapshot
+	err               error
+	id, current, next string
+}
+
+func (s *passwordChangeStoreStub) ChangeOwnPassword(_ context.Context, id, current, next string, _ time.Time) (AuthorizationSnapshot, error) {
+	s.id, s.current, s.next = id, current, next
+	return s.snapshot, s.err
+}
+
+func TestPasswordChangeReturnsRefreshedSession(t *testing.T) {
+	now := time.Unix(1770000000, 0)
+	store := &passwordChangeStoreStub{snapshot: AuthorizationSnapshot{
+		Account:      AccountSnapshot{ID: "user-1", Phone: "13800138000", DisplayName: "User", Role: "user", OrganizationID: "org-1", Status: "active", SessionVersion: 8},
+		Organization: &OrganizationSnapshot{ID: "org-1", Name: "Acme", Status: "active"},
+	}}
+	session, err := NewPasswordChange(store, func() time.Time { return now }).Change(context.Background(), PasswordChangeCommand{AccountID: "user-1", CurrentPassword: " current-pass ", NewPassword: "next-pass"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if store.current != "current-pass" || store.next != "next-pass" || session.SessionVersion == nil || *session.SessionVersion != 8 || session.User.OrganizationName != "Acme" {
+		t.Fatalf("store=%+v session=%+v", store, session)
+	}
+}
+
+func TestPasswordChangeValidatesInput(t *testing.T) {
+	store := &passwordChangeStoreStub{}
+	_, err := NewPasswordChange(store, nil).Change(context.Background(), PasswordChangeCommand{AccountID: "user-1", CurrentPassword: "old", NewPassword: "short"})
+	if !IsPasswordChangeFailure(err, PasswordChangeInvalidNewPassword) {
+		t.Fatalf("err=%v", err)
+	}
+	if store.id != "" {
+		t.Fatal("store called for invalid input")
+	}
+}