Why wp_set_password not working within a api endpoint?

Question

I try to build a custom api route for resetting the password from a WordPress user. I build a custom route with a function and al the data passing in the function is correct but the function not executes end returns an error (the 500 error can't reset). I build this because I didn't want to send the user to the wp-admin. The WordPress user must have the ability to reset the password in the app I building and the reset must reset the password and send a mail with the new password.

Custom route:

register_rest_route( $namespace, '/' .  $base . '/reset', array(
            array(
               'methods'                => 'POST',
               'callback'               => array( $this, 'myplugin_reset_user_pass' ),
            ),
        ));

Function:

public function myplugin_reset_user_pass( $request ) {

        $params = $request->get_params();

        $userdata = array( 
            'user_email'    => $params['user_email']
        );

        $user = get_user_by( 'email', $userdata['user_email'] );

        // check if username / email exist
        $username = username_exists( $user->user_login );
        if ( $username and email_exists($user->user_email) == true ) {
            if ( function_exists( 'wp_set_password')  ) {
                // generate new password

                $password = wp_generate_password( 8, true );
                $resetPass = wp_set_password( $password, $user->id );

                if($resetPass){
                    return new WP_REST_Response(true, 200);
                }
            }
        }
        return new WP_Error( 'cant-reset', __( 'message', 'text-domain'), array( 'status' => 500 ) );
    }

Answer 1

wp_set_password does not appear to do anything (at least in my testing) but instead calling wp_update_user does the trick:

$update_password = wp_update_user(array(
  'ID' => get_current_user_id(),
  'user_pass' => $data['newPassword']
));

It will hash the plaintext password you give to it, and trigger any email notifications about the password changing.

Then you can see if it worked by doing this:

if (is_wp_error( $update_password )) {
  // it did not work :(
}else{
  // it worked!
}

Hope this helps someone!