From 765465348e345eeb31a5369fa3fb04de79ec8e7b Mon Sep 17 00:00:00 2001
From: muken <jmendoza14@pm.me>
Date: Mon, 29 Jun 2026 18:07:24 -0500
Subject: [PATCH] feat: allow admins to change user passwords

---
 src/app/admin/page.tsx           |  1 +
 src/app/api/admin/users/route.ts | 16 +++++++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/app/admin/page.tsx b/src/app/admin/page.tsx
index 0145430..40cfa2c 100644
--- a/src/app/admin/page.tsx
+++ b/src/app/admin/page.tsx
@@ -1789,6 +1789,7 @@ function UsersSection({ onToast }: { onToast: (msg: string, type: string) => voi
             <div style={{ display: 'grid', gap: 12 }}>
               <I label="First Name" value={editing.first_name || ''} onChange={(v: string) => setEditing({ ...editing, first_name: v })} />
               <I label="Last Name" value={editing.last_name || ''} onChange={(v: string) => setEditing({ ...editing, last_name: v })} />
+              <I label="New Password (leave blank to keep current)" type="password" value={editing.password || ''} onChange={(v: string) => setEditing({ ...editing, password: v })} placeholder="Enter new password to change" />
               <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
                 <input type="checkbox" checked={editing.comments_disabled || false} onChange={(e) => setEditing({ ...editing, comments_disabled: e.target.checked })} />
                 <label style={{ fontSize: 13, color: C.text }}>Disable comments</label>
diff --git a/src/app/api/admin/users/route.ts b/src/app/api/admin/users/route.ts
index 3b2cc0c..47da683 100644
--- a/src/app/api/admin/users/route.ts
+++ b/src/app/api/admin/users/route.ts
@@ -37,7 +37,21 @@ export async function PUT(request: NextRequest) {
   try {
     await requireRole('admin');
     const body = await request.json();
-    const { id, first_name, last_name, comments_disabled } = body;
+    const { id, first_name, last_name, comments_disabled, password } = body;
+
+    // If password provided, hash and update it too
+    if (password) {
+      const { hashPassword } = await import('@/lib/auth');
+      const hash = await hashPassword(password);
+      const { rows } = await db.query(
+        'UPDATE users SET first_name = $1, last_name = $2, comments_disabled = $3, password_hash = $4 WHERE id = $5 RETURNING id, username, role, first_name, last_name, comments_disabled, created_at',
+        [first_name || null, last_name || null, comments_disabled === true, hash, id]
+      );
+      if (rows.length === 0) {
+        return NextResponse.json({ error: 'User not found' }, { status: 404 });
+      }
+      return NextResponse.json({ data: rows[0] });
+    }
 
     const { rows } = await db.query(
       'UPDATE users SET first_name = $1, last_name = $2, comments_disabled = $3 WHERE id = $4 RETURNING id, username, role, first_name, last_name, comments_disabled, created_at',