Fix player getAccount has_password: read the raw row, not sanitized req.user

req.user comes from getById which strips password_hash, so has_password was
always false — the account page mis-rendered a real password account as the
SSO-only 'set a password' variant (and the change-password form omitted the
required current-password field). Read the raw row for that one flag.

Caught by a browser click-through of the /account portal. Adds a regression
test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/src/router/v1/admin/account.controller.js

@@ -16,17 +16,24 @@ const log = require('../../../utils/logger')('account')
 
 // Current user's security status (does not expose the secret). has_password lets
 // the player portal tell an SSO-only account (must *set* a password, no current
-// one required) apart from one that already has a usable password.
+// one required) apart from one that already has a usable password. req.user is the
+// sanitized row (password_hash stripped), so read the raw row for that one flag.
 async function getAccount(req, res) {
-  return res.json({
+  try {
-    id: req.user.id,
+    const raw = await users.getRawById(req.user.id)
-    username: req.user.username,
+    return res.json({
-    role: req.user.role,
+      id: req.user.id,
-    email: req.user.email || null,
+      username: req.user.username,
-    status: req.user.status || 'active',
+      role: req.user.role,
-    totp_enabled: Boolean(req.user.totp_enabled),
+      email: req.user.email || null,
-    has_password: Boolean(req.user.password_hash),
+      status: req.user.status || 'active',
-  })
+      totp_enabled: Boolean(req.user.totp_enabled),
+      has_password: Boolean(raw && raw.password_hash),
+    })
+  } catch (err) {
+    log.error('getAccount', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
 }
 
 // Re-mint this caller's session and refresh their cookie so a self-service change

server/test/playerAccounts.test.js

@@ -8,6 +8,7 @@ const assert = require('node:assert/strict')
 const bcrypt = require('bcryptjs')
 
 const authCtrl = require('../src/router/v1/auth/auth.controller')
+const account = require('../src/router/v1/admin/account.controller')
 const users = require('../src/model/users/users.model')
 const settings = require('../src/model/settings/settings.model')
 const botScore = require('../src/middleware/botScore')
@@ -73,6 +74,28 @@ test('isDuplicateUsername recognizes the driver duplicate-key error', () => {
   assert.equal(users.isDuplicateUsername(null), false)
 })
 
+// ── getAccount.has_password reads the RAW row ─────────────────────────────
+// Regression: req.user is the sanitized row (password_hash stripped), so
+// has_password must come from users.getRawById, not req.user.password_hash —
+// otherwise a real password account is mis-rendered as "set a password".
+test('getAccount reports has_password from the raw row, not the sanitized req.user', async () => {
+  const origGetRaw = users.getRawById
+  try {
+    users.getRawById = async () => ({ id: 1, password_hash: '$2a$hash' }) // has a password
+    const req = { user: { id: 1, username: 'p', role: 'player', status: 'active', totp_enabled: 0 } } // sanitized: no hash
+    const res = mockRes()
+    await account.getAccount(req, res)
+    assert.equal(res.body.has_password, true)
+
+    users.getRawById = async () => ({ id: 1, password_hash: null }) // SSO-only, no password
+    const res2 = mockRes()
+    await account.getAccount(req, res2)
+    assert.equal(res2.body.has_password, false)
+  } finally {
+    users.getRawById = origGetRaw
+  }
+})
+
 // ── Registration honeypot (does not need the DB) ──────────────────────────
 test('register with a filled honeypot fails and bans the IP before any DB hit', async () => {
   const ip = '203.0.113.90'