2 files changed, 15 insertions, 6 deletions
diff --git a/src/user/handlers/password/mod.rs b/src/user/handlers/password/mod.rs
index c327e87..5e69c1c 100644
--- a/src/user/handlers/password/mod.rs
+++ b/src/user/handlers/password/mod.rs
@@ -7,13 +7,13 @@ use axum::{
 use crate::{
     app::App,
     clock::RequestedAt,
+    empty::Empty,
     error::Internal,
     password::Password,
     token::{
         app,
         extract::{Identity, IdentityCookie},
     },
-    user::User,
 };
 
 #[cfg(test)]
@@ -25,14 +25,14 @@ pub async fn handler(
     identity: Identity,
     cookie: IdentityCookie,
     Json(request): Json<Request>,
-) -> Result<(IdentityCookie, Json<User>), Error> {
-    let (login, secret) = app
+) -> Result<(IdentityCookie, Empty), Error> {
+    let secret = app
         .tokens()
         .change_password(&identity.user, &request.password, &request.to, &now)
         .await
         .map_err(Error)?;
     let cookie = cookie.set(secret);
-    Ok((cookie, Json(login)))
+    Ok((cookie, Empty))
 }
 
 #[derive(serde::Deserialize)]
diff --git a/src/user/handlers/password/test.rs b/src/user/handlers/password/test.rs
index 278d27b..ffa12f3 100644
--- a/src/user/handlers/password/test.rs
+++ b/src/user/handlers/password/test.rs
@@ -1,6 +1,7 @@
 use axum::extract::{Json, State};
 
 use crate::{
+    empty::Empty,
     test::fixtures,
     token::app::{LoginError, ValidateError},
 };
@@ -20,7 +21,7 @@ async fn password_change() {
         password: password.clone(),
         to: to.clone(),
     };
-    let (new_cookie, Json(response)) = super::handler(
+    let (new_cookie, Empty) = super::handler(
         State(app.clone()),
         fixtures::now(),
         identity.clone(),
@@ -34,7 +35,15 @@ async fn password_change() {
     assert_ne!(cookie.secret(), new_cookie.secret());
 
     // Verify that we're still ourselves
-    assert_eq!(identity.user, response);
+    let new_secret = new_cookie
+        .secret()
+        .expect("we should have a secret after changing our password");
+    let (_, login) = app
+        .tokens()
+        .validate(&new_secret, &fixtures::now())
+        .await
+        .expect("the newly-issued secret should be valid");
+    assert_eq!(identity.user, login);
 
     // Verify that our original token is no longer valid
     let validate_err = app