From 9defe7e3e02d604073d663f673ef3abd9d9f8c0e Mon Sep 17 00:00:00 2001
From: Francis Cao <franciscao@gmail.com>
Date: Tue, 23 Jun 2026 00:27:44 -0700
Subject: [PATCH] Only enforce password-change invalidation for sessions that
 include a password fingerprint.

---
 src/lib/auth.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 70eab7047..4450cd92a 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -41,7 +41,8 @@ export async function checkAuth(request: Request) {
     if (key?.userId) {
       user = await getUser(key.userId, { includePassword: true });
 
-      if (user && hash(user.password) !== key.pwd) {
+      // Only enforce password-change invalidation for sessions that include a password fingerprint.
+      if (user && key.pwd && hash(user.password) !== key.pwd) {
         user = null;
       }
     }