feat: change password now requires old/current password

internal/api/handler/user.go

@@ -61,6 +61,7 @@ func (h *UserHandler) CreateUser(w http.ResponseWriter, r *http.Request) {
 // @Param payload body request.ChangePasswordPayload true "Change password payload"
 // @Success 204
 // @Error 400 {object} response.ErrorResponse "failed to decode request body"
+// @Error 401 {object} response.ErrorResponse "could not authenticate with current password"
 // @Error 500 {object} response.ErrorResponse "could not get auth context"
 // @Error 500 {object} response.ErrorResponse "failed to change password"
 // @Router /users/password [post]
@@ -81,7 +82,14 @@ func (h *UserHandler) ChangePassword(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = h.UserService.ChangePassword(ctx, authContext.UserID, payload.Password)
+	_, err = h.AuthService.Authenticate(ctx, authContext.Email, payload.OldPassword)
+	if err != nil {
+		slog.ErrorContext(ctx, "failed to authenticate with current password", slog.Any("error", err))
+		response.Error(ctx, w, http.StatusUnauthorized, "could not authenticate with current password")
+		return
+	}
+
+	err = h.UserService.ChangePassword(ctx, authContext.UserID, payload.NewPassword)
 	if err != nil {
 		slog.ErrorContext(ctx, "failed to change password", slog.Any("error", err))
 		response.Error(ctx, w, http.StatusInternalServerError, "failed to change password")

internal/api/request/user.go

@@ -7,5 +7,6 @@ type CreateUserPayload struct {
 }
 
 type ChangePasswordPayload struct {
-	Password string `json:"password"`
+	OldPassword string `json:"old_password"`
+	NewPassword string `json:"new_password"`
 }

internal/domain/auth.go

@@ -62,7 +62,7 @@ func NewAuthService(r AuthRepository, jwtSecret []byte) *AuthService {
 	return &AuthService{repo: r, jwtSecret: jwtSecret}
 }
 
-func (s *AuthService) authenticate(ctx context.Context, email string, password string) (*AuthUser, error) {
+func (s *AuthService) Authenticate(ctx context.Context, email string, password string) (*AuthUser, error) {
 	user, err := s.repo.GetUserByEmail(ctx, email)
 	if err != nil {
 		return user, err
@@ -80,7 +80,7 @@ func (s *AuthService) authenticate(ctx context.Context, email string, password s
 }
 
 func (s *AuthService) Login(ctx context.Context, email string, password string) (TokenPair, error) {
-	user, err := s.authenticate(ctx, email, password)
+	user, err := s.Authenticate(ctx, email, password)
 	if err != nil {
 		return TokenPair{}, err
 	}