Add self-service admin password change (requires current password)

backend/models.py

@@ -20,6 +20,11 @@ class UserLogin(BaseModel):
     password: str
 
 
+class PasswordChange(BaseModel):
+    current_password: str
+    new_password: str
+
+
 class UserPublic(BaseModel):
     model_config = ConfigDict(extra="ignore")
     id: str

backend/server.py

@@ -15,7 +15,7 @@ from starlette.middleware.cors import CORSMiddleware
 from motor.motor_asyncio import AsyncIOMotorClient
 
 from models import (
-    UserCreate, UserLogin, UserPublic, TokenResponse,
+    UserCreate, UserLogin, UserPublic, TokenResponse, PasswordChange,
     Profile, ProfileCreate, ProfileUpdate, RATING_ORDER,
     Movie, MovieCreate, MovieUpdate,
     Subtitle,
@@ -235,6 +235,19 @@ async def me(user: dict = Depends(get_current_user)):
     return _user_public(user)
 
 
+@api.post("/auth/change-password")
+async def change_password(payload: PasswordChange, user: dict = Depends(get_current_user)):
+    full_user = await db.users.find_one({"id": user["id"]})
+    if not full_user or not verify_password(payload.current_password, full_user["password_hash"]):
+        raise HTTPException(status_code=401, detail="Current password is incorrect")
+    if len(payload.new_password) < 8:
+        raise HTTPException(status_code=400, detail="New password must be at least 8 characters")
+    await db.users.update_one(
+        {"id": user["id"]}, {"$set": {"password_hash": hash_password(payload.new_password)}}
+    )
+    return {"ok": True}
+
+
 # ============ PROFILES ============
 @api.get("/profiles", response_model=List[Profile])
 async def list_profiles(user: dict = Depends(get_current_user)):