fixed blocking important issues

internal/user/repository.go

@@ -19,6 +19,7 @@ type Repository interface {
 	Update(ctx context.Context, user *User) error
 	Delete(ctx context.Context, id string) error
 	GetByID(ctx context.Context, id string) (*User, error)
+	UpdatePasswordReset(ctx context.Context, id, hashedPassword, updatedBy string) error
 	GetByEmail(ctx context.Context, email string) (*User, error)
 	GetByUsername(ctx context.Context, username string) (*User, error)
 	GetByIDs(ctx context.Context, userIDs []string) ([]User, error)
@@ -177,7 +178,7 @@ func (r *userRepository) GetByID(ctx context.Context, id string) (*User, error)
 				return legacyUser, nil
 			}
 			if errors.Is(legacyErr, orm.ErrDocumentNotFound) {
-				return nil, errors.New("user not found")
+				return nil, ErrUserNotFound
 			}
 			r.logger.Error("Failed to get user by legacy string ID", map[string]interface{}{
 				"error":   legacyErr.Error(),
@@ -195,6 +196,43 @@ func (r *userRepository) GetByID(ctx context.Context, id string) (*User, error)
 	return user, nil
 }
 
+// UpdatePasswordReset atomically persists a new password hash and audit fields.
+func (r *userRepository) UpdatePasswordReset(ctx context.Context, id, hashedPassword, updatedBy string) error {
+	now := time.Now().Unix()
+	updateDoc := bson.M{
+		"$set": bson.M{
+			"password":   hashedPassword,
+			"updated_at": now,
+			"updated_by": updatedBy,
+		},
+	}
+
+	objectID, err := bson.ObjectIDFromHex(id)
+	if err == nil {
+		result, updateErr := r.collection.UpdateOne(ctx, bson.M{"_id": objectID}, updateDoc)
+		if updateErr == nil && result.MatchedCount > 0 {
+			return nil
+		}
+		if updateErr != nil {
+			return updateErr
+		}
+	}
+
+	result, err := r.collection.UpdateOne(ctx, bson.M{"_id": id}, updateDoc)
+	if err != nil {
+		r.logger.Error("Failed to update password reset", map[string]interface{}{
+			"error":   err.Error(),
+			"user_id": id,
+		})
+		return err
+	}
+	if result.MatchedCount == 0 {
+		return ErrUserNotFound
+	}
+
+	return nil
+}
+
 // GetByEmail retrieves a user by email
 func (r *userRepository) GetByEmail(ctx context.Context, email string) (*User, error) {
 	user, err := r.ormRepo.FindOne(ctx, bson.M{"email": email})