fix(07.2): add user_nbf write to password_reset_confirm — CR-02 gap closure

backend/tests/test_auth_api.py

@@ -695,3 +695,26 @@ async def test_disable_totp_writes_user_nbf_to_redis(authed_client, db_session:
     nbf_bytes = await app.state.redis.get(f"user_nbf:{user.id}")
     assert nbf_bytes is not None
     assert int(nbf_bytes.decode() if isinstance(nbf_bytes, (bytes, bytearray)) else nbf_bytes) > 0
+
+
+@pytest.mark.asyncio
+async def test_password_reset_confirm_writes_user_nbf_to_redis(authed_client, db_session: AsyncSession):
+    """POST /api/auth/password-reset/confirm must write user_nbf:{user_id} to Redis (CR-02 gap closure)."""
+    from main import app
+    from services.auth import create_password_reset_token
+    from sqlalchemy import select as sa_select
+
+    await _register(authed_client, handle="nbfw_prc1", email="nbfw_prc1@example.com")
+    result = await db_session.execute(sa_select(User).where(User.email == "nbfw_prc1@example.com"))
+    user = result.scalar_one()
+
+    reset_token = create_password_reset_token(str(user.id))
+    resp = await authed_client.post(
+        "/api/auth/password-reset/confirm",
+        json={"token": reset_token, "new_password": "NewSecure!Pass99#"},
+    )
+    assert resp.status_code == 200
+
+    nbf_bytes = await app.state.redis.get(f"user_nbf:{user.id}")
+    assert nbf_bytes is not None
+    assert int(nbf_bytes.decode() if isinstance(nbf_bytes, (bytes, bytearray)) else nbf_bytes) > 0