Merge pull request #50 from ssntpl/bugs/password_history_blocks_registration

Fix PasswordHistory rule blocking first-time registration

Author: JYOTSANASHARMAA

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- **`PasswordHistory` rule blocked first-time registration** — with the default `neev.password` rules, `PasswordHistory::notReused()` failed with "Unable to verify password history." whenever no user could be resolved, which is exactly the first-time-signup case (no authenticated user; the submitted email belongs to nobody yet). The rule now passes vacuously when there is no user — there is no history to reuse. Reported by a consuming-app developer
+
 ## [0.5.0] - 2026-07-02
 
 ### Added

src/Rules/PasswordHistory.php

@@ -40,7 +40,11 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
         }
 
         if (!$user) {
-            $fail('Unable to verify password history.');
+            // No resolvable user means there is no history to reuse —
+            // first-time registration lands here (no authenticated user,
+            // and the submitted email belongs to nobody yet). The check
+            // is vacuously satisfied; failing would block every
+            // registration under the default password rules.
             return;
         }
 

tests/Feature/Auth/RegistrationTest.php

@@ -21,6 +21,26 @@ protected function setUp(): void
         config(['neev.password' => ['required', 'confirmed']]);
     }
 
+    public function test_registration_succeeds_with_the_default_password_rules(): void
+    {
+        // Regression: PasswordHistory::notReused() used to fail with
+        // "Unable to verify password history." for first-time signups
+        // (no resolvable user), blocking every registration under the
+        // shipped default config. This test runs WITHOUT the simplified
+        // rules from setUp().
+        config(['neev.password' => (require dirname(__DIR__, 3) . '/config/neev.php')['password']]);
+
+        $response = $this->postJson('/neev/register', [
+            'name' => 'Default Rules',
+            'email' => 'default-rules@company.com',
+            'password' => 'Str0ng@Passw0rd!',
+            'password_confirmation' => 'Str0ng@Passw0rd!',
+        ]);
+
+        $response->assertOk();
+        $response->assertJsonPath('auth_state', 'authenticated');
+    }
+
     public function test_api_registration_returns_token(): void
     {
         $response = $this->postJson('/neev/register', [

tests/Unit/Rules/PasswordHistoryTest.php

@@ -61,17 +61,19 @@ public function test_not_reused_creates_instance_with_custom_count(): void
     }
 
     // -----------------------------------------------------------------
-    // Fails when no user is found (rule rejects)
+    // Passes when no user is found — no history exists to reuse.
+    // First-time registration lands here; failing would block every
+    // registration under the default password rules.
     // -----------------------------------------------------------------
 
-    public function test_fails_when_no_user_found(): void
+    public function test_passes_when_no_user_found(): void
     {
         // No authenticated user, no email input
         $rule = PasswordHistory::notReused(5);
 
         $failed = $this->runRule($rule, 'anything');
 
-        $this->assertTrue($failed);
+        $this->assertFalse($failed);
     }
 
     // -----------------------------------------------------------------