Allow legacy stateless tokens that were minted without a password fingerprint.

src/lib/auth.test.ts

@@ -66,6 +66,15 @@ describe('checkAuth password fingerprint', () => {
     expect(result?.user?.id).toBe('user-1');
   });
 
+  test('authorizes a legacy stateless token that does not include a password fingerprint', async () => {
+    parseSecureTokenMock.mockReturnValue({ userId: 'user-1' } as any);
+    mockUser();
+
+    const result = await checkAuth(authedRequest());
+
+    expect(result?.user?.id).toBe('user-1');
+  });
+
   test('rejects a stateless token whose fingerprint predates a password change', async () => {
     // Token minted against the old password must stop working once the password changes.
     parseSecureTokenMock.mockReturnValue({

src/lib/auth.ts

@@ -32,7 +32,8 @@ export async function checkAuth(request: Request) {
     user = await getUser(userId, { includePassword: true });
 
     // Reject tokens issued before the current password.
-    if (user && hash(user.password) !== payload.pwd) {
+    // Allow legacy stateless tokens that were minted without a password fingerprint.
+    if (user && payload.pwd && hash(user.password) !== payload.pwd) {
       user = null;
     }
   } else if (redis.enabled && authKey) {