src/main/java/ru/soune/nocopy/adminpanel/dto/AdminUserRequest.java

@@ -22,6 +22,12 @@ public class AdminUserRequest {
     @JsonProperty("password")
     private String password;
 
+    @JsonProperty("new_password")
+    private String newPassword;
+
+    @JsonProperty("old_password")
+    private String oldPassword;
+
     @JsonProperty("is_super_admin")
     private Boolean isSuperAdmin;
 

src/main/java/ru/soune/nocopy/adminpanel/exceptions/WrongPassword.java

@@ -0,0 +1,7 @@
+package ru.soune.nocopy.adminpanel.exceptions;
+
+public class WrongPassword extends RuntimeException {
+    public WrongPassword(String message) {
+        super(message);
+    }
+}

src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java

@@ -10,6 +10,7 @@ import ru.soune.nocopy.adminpanel.entity.AdminUser;
 import ru.soune.nocopy.adminpanel.entity.PermissionType;
 import ru.soune.nocopy.adminpanel.exceptions.AdminUserNotFoundException;
 import ru.soune.nocopy.adminpanel.exceptions.EmailAlreadyExistsException;
+import ru.soune.nocopy.adminpanel.exceptions.WrongPassword;
 import ru.soune.nocopy.adminpanel.permission.AdminPermission;
 import ru.soune.nocopy.adminpanel.service.AdminSectionPermissionService;
 import ru.soune.nocopy.adminpanel.service.AdminUserService;
@@ -198,8 +199,8 @@ public class AdminUserHandler implements RequestHandler {
                     adminRequest.getAdminId(),
                     adminRequest.getFullName(),
                     adminRequest.getEmail(),
-                    adminRequest.getPassword()
+                    adminRequest.getOldPassword(),
-            );
+                    adminRequest.getNewPassword());
 
             return BaseResponse.builder()
                     .msgId(request.getMsgId())
@@ -219,6 +220,12 @@ public class AdminUserHandler implements RequestHandler {
                     .messageCode(MessageCode.EMAIL_ALREADY_EXISTS.getCode())
                     .messageDesc(MessageCode.EMAIL_ALREADY_EXISTS.getDescription())
                     .build();
+        } catch (WrongPassword e) {
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.WRONG_PASSWORD.getCode())
+                    .messageDesc(MessageCode.WRONG_PASSWORD.getDescription())
+                    .build();
         }
     }
 

src/main/java/ru/soune/nocopy/adminpanel/service/AdminUserService.java

@@ -7,6 +7,7 @@ import org.springframework.transaction.annotation.Transactional;
 import ru.soune.nocopy.adminpanel.entity.AdminUser;
 import ru.soune.nocopy.adminpanel.exceptions.AdminUserNotFoundException;
 import ru.soune.nocopy.adminpanel.exceptions.EmailAlreadyExistsException;
+import ru.soune.nocopy.adminpanel.exceptions.WrongPassword;
 import ru.soune.nocopy.adminpanel.permission.AdminPermission;
 import ru.soune.nocopy.adminpanel.repository.AdminUserRepository;
 
@@ -52,7 +53,7 @@ public class AdminUserService {
     }
 
     @Transactional
-    public AdminUser update(Long id, String fullName, String email, String password) {
+    public AdminUser update(Long id, String fullName, String email, String oldPassword, String newPassword) {
         AdminUser admin = findById(id);
 
         if (fullName != null) admin.setFullName(fullName);
@@ -64,8 +65,12 @@ public class AdminUserService {
             admin.setEmail(email);
         }
 
-        if (password != null && !password.isEmpty()) {
+        if (newPassword != null && oldPassword != null) {
-            admin.setPassword(passwordEncoder.encode(password));
+            if (passwordEncoder.matches(oldPassword, admin.getPassword())) {
+                admin.setPassword(passwordEncoder.encode(newPassword));
+            } else {
+                throw new WrongPassword("Old password not equal current");
+            }
         }
 
         return adminUserRepository.save(admin);

src/main/java/ru/soune/nocopy/adminpanel/util/MessageCode.java

@@ -8,6 +8,7 @@ public enum MessageCode {
     INVALID_ACTION(2, "Invalid action"),
     ADMIN_NOT_FOUND(4, "Admin not found"),
     EMAIL_ALREADY_EXISTS(2, "Email already exists"),
+    WRONG_PASSWORD(2, "Wrong password"),
     INVALID_CREDENTIALS(2, "Invalid credentials"),
     PERMISSION_DENIED(2, "Permission denied"),
     ADMIN_INACTIVE(2, "Admin is inactive");