Decides everything setting a password decides, and writes nothing: the policy, the breach check, the history, and the hash.
the person
the new password
Optional
current and history from an entry the caller holds, and generated for a password this service just made up
current
history
generated
{ ok: true, hash, history, … }, or a refusal with its reason and code
{ ok: true, hash, history, … }
Decides everything setting a password decides, and writes nothing: the policy, the breach check, the history, and the hash.