feat: add password change settings

tests/test_app.py

@@ -130,6 +130,50 @@ def test_logout_revokes_current_session(client):
     assert client.get("/api/v1/me").status_code == 401
 
 
+def test_change_password_checks_current_password_and_revokes_other_sessions(client):
+    old_password = "correct horse battery staple"
+    new_password = "new correct horse battery staple"
+    client.post("/api/v1/setup/initialize", json={"username": "owner", "password": old_password})
+    other = type(client)(client.app)
+    try:
+        assert other.post("/api/v1/auth/login", json={"username": "owner", "password": old_password}).status_code == 200
+        wrong = client.post(
+            "/api/v1/auth/change-password",
+            json={"current_password": "wrong password", "new_password": new_password},
+        )
+        assert wrong.status_code == 400
+        assert wrong.json()["detail"] == "当前密码不正确"
+
+        changed = client.post(
+            "/api/v1/auth/change-password",
+            json={"current_password": old_password, "new_password": new_password},
+        )
+        assert changed.status_code == 204
+        assert client.get("/api/v1/me").status_code == 200
+        assert other.get("/api/v1/me").status_code == 401
+        assert other.post("/api/v1/auth/login", json={"username": "owner", "password": old_password}).status_code == 401
+        assert other.post("/api/v1/auth/login", json={"username": "owner", "password": new_password}).status_code == 200
+    finally:
+        other.close()
+
+
+def test_change_password_validates_new_password(client):
+    client.post(
+        "/api/v1/setup/initialize",
+        json={"username": "owner", "password": "correct horse battery staple"},
+    )
+    too_short = client.post(
+        "/api/v1/auth/change-password",
+        json={"current_password": "correct horse battery staple", "new_password": "short"},
+    )
+    assert too_short.status_code == 422
+    same = client.post(
+        "/api/v1/auth/change-password",
+        json={"current_password": "correct horse battery staple", "new_password": "correct horse battery staple"},
+    )
+    assert same.status_code == 422
+
+
 def initialized_client(client):
     client.post(
         "/api/v1/setup/initialize",