Fixed bug

You could set the password to be an empty string

backend/src/handlers/auth.rs

@@ -275,7 +275,7 @@ pub async fn get_current_user(
 /// - `404 Not Found` if user doesn't exist
 /// - `500 Internal Server Error` if database error occurs
 pub async fn delete_user(
-    Path(id): Path<i32>,
+    Path(id): Path<i16>,
     State(data): State<Arc<AppState>>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
     let query = sqlx::query(r#"DELETE FROM users WHERE id = $1"#)
@@ -414,10 +414,11 @@ pub async fn get_user_by_id(
 /// - Passwords are hashed using Argon2 before storage.
 /// - This endpoint typically requires admin privileges (enforced by middleware).
 pub async fn update_user(
-    Path(id): Path<i32>,
+    Path(id): Path<i16>,
     State(data): State<Arc<AppState>>,
     Json(body): Json<UserUpdateScheme>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
+    let update_result = if !body.new_pwd.is_empty() {
         let argon = Argon2::default();
         let salt = SaltString::generate(&mut OsRng);
         let hashed_pwd = match argon.hash_password(body.new_pwd.clone().as_bytes(), &salt) {
@@ -425,15 +426,25 @@ pub async fn update_user(
             Err(e) => panic!("Error hashing {:}", e),
         };
 
-    let update_result = sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, pwd = $4, is_admin = $5 WHERE id = $6"#)
+        sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, pwd = $4, is_admin = $5 WHERE id = $6"#)
             .bind(body.first_name.to_owned())
             .bind(body.last_name.to_owned())
             .bind(body.username.to_owned())
-        .bind(&hashed_pwd)
+            .bind(hashed_pwd)
             .bind(body.make_admin.to_owned())
             .bind(id)
             .execute(&data.db)
             .await
+    } else {
+        sqlx::query(r#"UPDATE users SET first_name = $1, last_name = $2, username = $3, is_admin = $4 WHERE id = $5"#)
+            .bind(body.first_name.to_owned())
+            .bind(body.last_name.to_owned())
+            .bind(body.username.to_owned())
+            .bind(body.make_admin.to_owned())
+            .bind(id)
+            .execute(&data.db)
+            .await
+    }
     .map_err(|e| {
         (
             StatusCode::INTERNAL_SERVER_ERROR,

frontend/src/pages/user.rs

@@ -566,6 +566,7 @@ pub fn user_by_id_component(props: &UserProps) -> Html {
             let last_name = (*last_name).clone();
             let username = (*username).clone();
             let make_admin = *make_admin;
+            let new_pwd_state = new_pwd.clone();
             let new_pwd = (*new_pwd).clone();
 
             saving.set(true);
@@ -600,6 +601,7 @@ pub fn user_by_id_component(props: &UserProps) -> Html {
                         if let Ok(updated) = resp.json::<FilteredUser>().await {
                             user_state.set(Some(updated));
                         }
+                        new_pwd_state.set(String::new());
                         save_success.set(true);
                     }
                     Ok(resp) => {