presseportale/app/Actions/Fortify/UpdateUserPassword.php

<?php

namespace App\Actions\Fortify;

use App\Models\User;
use App\Services\Auth\PasswordChanger;
use Illuminate\Support\Facades\Validator;
use Laravel\Fortify\Contracts\UpdatesUserPasswords;

class UpdateUserPassword implements UpdatesUserPasswords
{
    use PasswordValidationRules;

    /**
     * Validate and update the user's password. Die Fortify-Route dazu ist
     * abgeschaltet (Sicherheitsaudit 07.10.2026, Entscheidung 4); die Action
     * nutzt trotzdem den gemeinsamen PasswordChanger, falls sie wieder
     * aktiviert wird.
     *
     * @param  array<string, string>  $input
     */
    public function update(User $user, array $input): void
    {
        Validator::make($input, [
            'current_password' => ['required', 'string', 'current_password:web'],
            'password' => $this->passwordRules(),
        ], [
            'current_password.current_password' => __('The provided password does not match your current password.'),
        ])->validateWithBag('updatePassword');

        app(PasswordChanger::class)->change($user, $input['password'], request()->hasSession() ? request()->session() : null);
    }
}