#[Route(path: '/api/_action/user/user-recovery/password', defaults: ['auth_required' => false], name: 'api.action.user.user-recovery.password', methods: ['PATCH'])]
public function updateUserPassword(Request
$request, Context
$context): Response
{ $hash =
(string) $request->request->
get('hash'
);
$password =
(string) $request->request->
get('password'
);
$passwordConfirm =
(string) $request->request->
get('passwordConfirm'
);
if ($passwordConfirm !==
$password) { return $this->
getErrorResponse();
} $user =
$this->userRecoveryService->
getUserByHash($hash,
$context);
if ($user === null
) { return $this->
getErrorResponse();
} if (!
$this->userRecoveryService->
updatePassword($hash,
$password,
$context)) { return $this->
getErrorResponse();
} $this->rateLimiter->
reset(RateLimiter::OAUTH,
strtolower($user->
getUsername()) . '-' .
$request->
getClientIp());
$this->rateLimiter->
reset(RateLimiter::USER_RECOVERY,
strtolower($user->
getEmail()) . '-' .
$request->
getClientIp());