backend: harden rootless app lifecycle orchestration

core/archipelago/src/auth.rs

@@ -86,6 +86,11 @@ pub struct AuthManager {
     data_dir: PathBuf,
 }
 
+pub struct ChangePasswordOutcome {
+    pub ssh_updated: bool,
+    pub ssh_error: Option<String>,
+}
+
 impl AuthManager {
     pub fn new(data_dir: PathBuf) -> Self {
         Self { data_dir }
@@ -288,7 +293,7 @@ impl AuthManager {
         current_password: &str,
         new_password: &str,
         also_change_ssh: bool,
-    ) -> Result<()> {
+    ) -> Result<ChangePasswordOutcome> {
         if !self.verify_password(current_password).await? {
             anyhow::bail!("Current password is incorrect");
         }
@@ -314,11 +319,21 @@ impl AuthManager {
         let content = serde_json::to_string_pretty(&user)?;
         fs::write(&user_file, content).await?;
 
+        let mut outcome = ChangePasswordOutcome {
+            ssh_updated: false,
+            ssh_error: None,
+        };
         if also_change_ssh {
-            change_ssh_password(new_password).await?;
+            match change_ssh_password(new_password).await {
+                Ok(()) => outcome.ssh_updated = true,
+                Err(e) => {
+                    tracing::warn!("Web password changed but SSH password update failed: {}", e);
+                    outcome.ssh_error = Some(e.to_string());
+                }
+            }
         }
 
-        Ok(())
+        Ok(outcome)
     }
 }
 
@@ -485,6 +500,23 @@ mod tests {
         assert!(validate_password_strength("MyP@ssw0rd!123").is_ok());
     }
 
+    #[tokio::test]
+    async fn test_change_password_updates_web_password_without_ssh() {
+        let dir = tempfile::tempdir().unwrap();
+        let auth = AuthManager::new(dir.path().to_path_buf());
+        auth.setup_user("password123").await.unwrap();
+
+        let outcome = auth
+            .change_password("password123", "MyP@ssw0rd!123", false)
+            .await
+            .unwrap();
+
+        assert!(!outcome.ssh_updated);
+        assert!(outcome.ssh_error.is_none());
+        assert!(auth.verify_password("MyP@ssw0rd!123").await.unwrap());
+        assert!(!auth.verify_password("password123").await.unwrap());
+    }
+
     #[test]
     fn test_validate_password_strength_too_short() {
         assert!(validate_password_strength("Ab1!").is_err());