Function change_own_password 

pub async fn change_own_password(
    pool: &PgPool,
    throttle: &SignInThrottle,
    actor: &Actor,
    current: &str,
    new: &str,
    keep_session: Option<&str>,
) -> AppResult<()>

Changes the caller’s own password after verifying the current one.

Signs out every other web session of the user (a session stolen before the change must not outlive it); keep_session is the token of the session that made the change. Personal access tokens stay: they are separate credentials the user revokes one by one.

Wrong current passwords count on the same per-username counter of throttle as failed sign-ins (whoever holds a stolen session or token must not guess the password without a limit); a full counter refuses the attempt before the password is checked. The web form and POST /api/v1/me/password both come here, so neither path is unthrottled.

Invariants

• Permission: a local account (single sign-on accounts have no password, 400, not counted); not throttled (429 with the wait, also for the right password); the current password must be right (400, counted); the new one must pass the password rules (400).
• Locks: none.
• Data: the password is stored only as a hash; every web session of the user except keep_session is deleted, personal access tokens stay. A right current password clears the username’s counter.
• Audit: user.password (with the number of sessions ended); a wrong current password writes user.password_failed (never a password).
• Notifications / webhooks: none.
• Atomic: one transaction.