05/22 Enhance codes and fix bugs 2

app/routes/auth.py

@@ -1,7 +1,10 @@
+import logging
 import re
 import time
 
 from flask import Blueprint, request, jsonify, g
+
+_log = logging.getLogger(__name__)
 from app import db, limiter, client_ip
 from app.models.user import User
 from app.models.audit_log import AuditLog
@@ -584,7 +587,7 @@ def change_password():
 
     user = db.session.get(User, g.current_user_id)
 
-    if not verify_auth_token(current_auth_hash, user.master_hash):
+    if not verify_auth_token(current_auth_hash, user.master_hash, user=user):
         AuditLog.log(
             user_id=user.id,
             action='auth.change_password_failed',
@@ -646,9 +649,10 @@ def change_password():
             ip_address=client_ip(),
         )
         db.session.commit()
-    except Exception as e:
+    except Exception:
         db.session.rollback()
-        return jsonify({'error': f'Password change failed: {str(e)}'}), 500
+        _log.exception('change_password failed for user %s', g.current_user_id)
+        return jsonify({'error': 'Password change failed. Please try again.'}), 500
 
     return jsonify({'message': 'Password changed successfully. Please log in again.'}), 200
 
@@ -696,9 +700,10 @@ def delete_account():
         )
         db.session.delete(user)
         db.session.commit()
-    except Exception as e:
+    except Exception:
         db.session.rollback()
-        return jsonify({'error': f'Account deletion failed: {str(e)}'}), 500
+        _log.exception('delete_account failed for user %s', user_id)
+        return jsonify({'error': 'Account deletion failed. Please try again.'}), 500
 
     return jsonify({'message': 'Account deleted'}), 200
 
@@ -849,9 +854,10 @@ def recover_account():
             ip_address=client_ip(),
         )
         db.session.commit()
-    except Exception as e:
+    except Exception:
         db.session.rollback()
-        return jsonify({'error': f'Recovery failed: {str(e)}'}), 500
+        _log.exception('recover_account failed for user %s', user.id)
+        return jsonify({'error': 'Account recovery failed. Please try again.'}), 500
 
     tokens = generate_tokens(user.id)
     return jsonify({