I am implementing auth for a web app and want to implement forgot/reset password functionality, and the user is not supposed to enter old used passwords when resetting their password. My specific question is this:

I have 1 mongoose user model that looks like this:

const UserSchema = new mongoose.Schema({
  email: {
    type: String,
    required: true,
    unique: true,
  },
  password: {
    type: String,
    required: true,
    select: false,
  },
  passwordChangedAt: {
    type: Date,
    required: false,
    default: null,
  },
  role: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'Role',
    required: true,
  },
  ...Base,
});

I also have one password reset model:

const PasswordResetSchema = new mongoose.Schema({
  user: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'User',
    required: true,
  },
  token: {
    type: String,
    required: true,
  },
  isUsed: {
    type: Boolean,
    required: false,
    default: false,
  },
  expireDate: {
    type: Date,
    required: true,
  },
  oldPassword: {
    type: String,
    required: true,
  },
  newPassword: {
    type: String,
    required: false,
    default: null,
  },
  ...Base,
});

Now when resetting the password I want to lookup in the password reset tables, and check if oldPassword or newPassword was already used before, and if it was used show an error to the user that they already once used that password.I use bcrypt to hash the password using a salt, which means that the same password can have a different hash in the database. So the problem is when querying the password reset collection, for same passwords use before, is there a way to query the passwords while comparing hashes and new plaintext password to check if the password was used.

  const hashedPassword = await bcrypt.hash(password, bcrypt.genSaltSync());
  // Here the hashedPassword is different, since the salt is different

  const usedSamePassPreviously = await PasswordReset.find({
    _id: { $nin: [passwordReset._id] },
    user: user._id,
    $or: [{ oldPassword: hashedPassword }, { newPassword: hashedPassword }],
    isUsed: true,
  });

I also tried querying using the $where clause in mongo, which allows me to use pure JavaScript function, but there we dont have access to bcrypt.compare function. I dont want to load all data in back-end and then find if a password was used, or use the same salt for all passwords since that is a security problem. How can i approach this query and is it possible to achieve this in the database side. Thanks in advance.