[Bug]: user:resetpassword with encryption enabled

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

occ user:resetpassword username doesn't work with encryption enabled.

Steps to reproduce

1. enable server encryption

# occ user:resetpassword user1
Warning: Resetting the password when using encryption will result in data loss!
Do you want to continue?
Enter a new password: 
Confirm the new password: 
An unhandled exception has been thrown:
TypeError: OCA\Encryption\Crypto\Crypt::generatePasswordHash(): Argument #1 ($password) must be of type string, null given, called in /home/nextcloud/nextcloud/apps/encryption/lib/Crypto/Crypt.php on line 363 and defined in /home/nextcloud/nextcloud/apps/encryption/lib/Crypto/Crypt.php:304
Stack trace:
#0 /home/nextcloud/nextcloud/apps/encryption/lib/Crypto/Crypt.php(363): OCA\Encryption\Crypto\Crypt->generatePasswordHash()
#1 /home/nextcloud/nextcloud/apps/encryption/lib/Hooks/UserHooks.php(204): OCA\Encryption\Crypto\Crypt->decryptPrivateKey()
#2 /home/nextcloud/nextcloud/lib/private/legacy/OC_Hook.php(82): OCA\Encryption\Hooks\UserHooks->setPassphrase()
#3 /home/nextcloud/nextcloud/lib/private/Server.php(539): OC_Hook::emit()
#4 [internal function]: OC\Server->OC\{closure}()
#5 /home/nextcloud/nextcloud/lib/private/Hooks/EmitterTrait.php(88): call_user_func_array()
#6 /home/nextcloud/nextcloud/lib/private/Hooks/PublicEmitter.php(22): OC\Hooks\BasicEmitter->emit()
#7 /home/nextcloud/nextcloud/lib/private/User/User.php(339): OC\Hooks\PublicEmitter->emit()
#8 /home/nextcloud/nextcloud/core/Command/User/ResetPassword.php(103): OC\User\User->setPassword()
#9 /home/nextcloud/nextcloud/3rdparty/symfony/console/Command/Command.php(326): OC\Core\Command\User\ResetPassword->execute()
#10 /home/nextcloud/nextcloud/core/Command/Base.php(161): Symfony\Component\Console\Command\Command->run()
#11 /home/nextcloud/nextcloud/3rdparty/symfony/console/Application.php(1078): OC\Core\Command\Base->run()
#12 /home/nextcloud/nextcloud/3rdparty/symfony/console/Application.php(324): Symfony\Component\Console\Application->doRunCommand()
#13 /home/nextcloud/nextcloud/3rdparty/symfony/console/Application.php(175): Symfony\Component\Console\Application->doRun()
#14 /home/nextcloud/nextcloud/lib/private/Console/Application.php(183): Symfony\Component\Console\Application->run()
#15 /home/nextcloud/nextcloud/console.php(87): OC\Console\Application->run()
#16 /home/nextcloud/nextcloud/occ(11): require_once('...')
#17 {main}

Expected behavior

password is reseted normally.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

This temporay patch of apps/encryption/lib/Crypto/Crypt.php fixed the problem (new password is working, encryption keys are lost).

@@ -301,7 +301,7 @@
 	 *
 	 * @param string $uid only used for user keys
 	 */
-	protected function generatePasswordHash(string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
+	protected function generatePasswordHash(?string $password, string $cipher, string $uid = '', int $iterations = 600000): string {
 		$instanceId = $this->config->getSystemValue('instanceid');
 		$instanceSecret = $this->config->getSystemValue('secret');
 		$salt = hash('sha256', $uid . $instanceId . $instanceSecret, true);

Start by reproducing occ user:resetpassword user1 with encryption enabled, then read apps/encryption/lib/Crypto/Crypt.php around generatePasswordHash() and decryptPrivateKey(). Trace how core/Command/User/ResetPassword.php reaches the encryption hook. Done means the command resets the password without the TypeError while preserving the documented encryption data-loss behavior.