Rifiuta il riuso della password attuale in cambio e reset.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/controllers/admin/passwords_controller.rb

@@ -24,6 +24,11 @@ module Admin
         return render :edit, status: :unprocessable_entity
       end
 
+      if PasswordComplexity.same_as_current?(current_admin_account, params[:password])
+        flash.now[:alert] = t("admin.flash.password_same_as_current")
+        return render :edit, status: :unprocessable_entity
+      end
+
       if current_admin_account.update(password: params[:password])
         redirect_to admin_root_path, notice: t("admin.flash.password_updated")
       else

backend/app/controllers/api/v1/accounts_controller.rb

@@ -51,6 +51,7 @@ module Api
         when :too_long then "Password cannot exceed 72 characters"
         when :too_weak
           "Password must include at least 3 of: lowercase, uppercase, number, symbol"
+        when :same_as_current then "New password must be different from the current password"
         when :mismatch then "Passwords do not match"
         else "Unable to update password"
         end

backend/app/controllers/public/password_resets_controller.rb

@@ -40,6 +40,12 @@ module Public
         return render :edit, status: :unprocessable_entity
       end
 
+      if PasswordComplexity.same_as_current?(@user, params[:password])
+        flash.now[:alert] = t("flash.password_resets.password_same_as_current")
+        @token = params[:token]
+        return render :edit, status: :unprocessable_entity
+      end
+
       @user.update!(password: params[:password])
       @user.clear_password_reset!
       redirect_to public_login_path, notice: t("flash.password_resets.password_updated")

backend/app/models/concerns/password_complexity.rb

@@ -31,6 +31,13 @@ module PasswordComplexity
       matched >= REQUIRED_CLASSES
     end
 
+    # Confronta con il digest già salvato (prima di assegnare la nuova password).
+    def same_as_current?(record, password)
+      return false if password.blank? || !record.respond_to?(:authenticate)
+
+      record.authenticate(password).present?
+    end
+
     def requirement_summary
       I18n.t("password_policy.hint")
     end

backend/app/services/users/change_password.rb

@@ -31,6 +31,10 @@ module Users
         return Result.new(ok?: false, error: code == :blank ? :too_short : code)
       end
 
+      if PasswordComplexity.same_as_current?(@user, @password)
+        return Result.new(ok?: false, error: :same_as_current)
+      end
+
       unless @user.update(password: @password)
         complexity_error = @user.errors.details[:password]&.any? { |d| d[:error] == :complexity }
         return Result.new(ok?: false, error: complexity_error ? :too_weak : :too_short)