Fixed bug

You could set the password to be an empty string

backend/src/handlers/auth.rs

@@ -275,7 +275,7 @@ pub async fn get_current_user(
 /// - `404 Not Found` if user doesn't exist
 /// - `500 Internal Server Error` if database error occurs
 pub async fn delete_user(
-    Path(id): Path<i32>,
+    Path(id): Path<i16>,
     State(data): State<Arc<AppState>>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
     let query = sqlx::query(r#"DELETE FROM users WHERE id = $1"#)
@@ -414,32 +414,43 @@ pub async fn get_user_by_id(
 /// - Passwords are hashed using Argon2 before storage.
 /// - This endpoint typically requires admin privileges (enforced by middleware).
 pub async fn update_user(
-    Path(id): Path<i32>,
+    Path(id): Path<i16>,
     State(data): State<Arc<AppState>>,
     Json(body): Json<UserUpdateScheme>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
-    let argon = Argon2::default();
+    let update_result = if !body.new_pwd.is_empty() {
-    let salt = SaltString::generate(&mut OsRng);
+        let argon = Argon2::default();
-    let hashed_pwd = match argon.hash_password(body.new_pwd.clone().as_bytes(), &salt) {
+        let salt = SaltString::generate(&mut OsRng);
-        Ok(h) => h.to_string(),
+        let hashed_pwd = match argon.hash_password(body.new_pwd.clone().as_bytes(), &salt) {
-        Err(e) => panic!("Error hashing {:}", e),
+            Ok(h) => h.to_string(),
-    };
+            Err(e) => panic!("Error hashing {:}", e),
+        };
 
-    let update_result = sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, pwd = $4, is_admin = $5 WHERE id = $6"#)
+        sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, pwd = $4, is_admin = $5 WHERE id = $6"#)
-        .bind(body.first_name.to_owned())
+            .bind(body.first_name.to_owned())
-        .bind(body.last_name.to_owned())
+            .bind(body.last_name.to_owned())
-        .bind(body.username.to_owned())
+            .bind(body.username.to_owned())
-        .bind(&hashed_pwd)
+            .bind(hashed_pwd)
-        .bind(body.make_admin.to_owned())
+            .bind(body.make_admin.to_owned())
-        .bind(id)
+            .bind(id)
-        .execute(&data.db)
+            .execute(&data.db)
-        .await
+            .await
-        .map_err(|e| {
+    } else {
-            (
+        sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, is_admin = $4 WHERE id = $5"#)
-                StatusCode::INTERNAL_SERVER_ERROR,
+            .bind(body.first_name.to_owned())
-                Json(json!({"status": "error", "message": format!("{:?}", e)})),
+            .bind(body.last_name.to_owned())
-            )
+            .bind(body.username.to_owned())
-        })?;
+            .bind(body.make_admin.to_owned())
+            .bind(id)
+            .execute(&data.db)
+            .await
+    }
+    .map_err(|e| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(json!({"status": "error", "message": format!("{:?}", e)})),
+        )
+    })?;
 
     if update_result.rows_affected() == 0 {
         let error_response = serde_json::json!({

frontend/src/pages/user.rs

@@ -566,6 +566,7 @@ pub fn user_by_id_component(props: &UserProps) -> Html {
             let last_name = (*last_name).clone();
             let username = (*username).clone();
             let make_admin = *make_admin;
+            let new_pwd_state = new_pwd.clone();
             let new_pwd = (*new_pwd).clone();
 
             saving.set(true);
@@ -600,6 +601,7 @@ pub fn user_by_id_component(props: &UserProps) -> Html {
                         if let Ok(updated) = resp.json::<FilteredUser>().await {
                             user_state.set(Some(updated));
                         }
+                        new_pwd_state.set(String::new());
                         save_success.set(true);
                     }
                     Ok(resp) => {