# Change Password

Change user password. Supports both self-service and admin modes.

**Endpoints**:

- Self-service: `PUT /api/auth/password`
- Admin reset: `PUT /api/auth/password/:id`

**Auth**: Required
**Content-Type**: `application/json`

## Self-Service Mode

Users can change their own password by providing current password verification.

### Request Body

| Field            | Type   | Required | Description                                     |
| ---------------- | ------ | -------- | ----------------------------------------------- |
| current_password | string | Yes      | Current password for verification               |
| new_password     | string | Yes      | New password (min 8 chars, complexity required) |
| confirm_password | string | Yes      | Must match new_password                         |

### Example Request

```json
{
  "current_password": "OldPassword123!",
  "new_password": "NewSecureP@ss123!",
  "confirm_password": "NewSecureP@ss123!"
}
```

## Admin Mode

Admins can reset any user's password without knowing the current password.

**URL Parameter**: `:id` - Target user's UUID

### Request Body (Admin Mode)

| Field            | Type   | Required | Description                                     |
| ---------------- | ------ | -------- | ----------------------------------------------- |
| new_password     | string | Yes      | New password (min 8 chars, complexity required) |
| confirm_password | string | Yes      | Must match new_password                         |

### Example Admin Request

```json
{
  "new_password": "NewSecureP@ss123!",
  "confirm_password": "NewSecureP@ss123!"
}
```

## Response (200 OK)

```json
{
  "message": "password updated"
}
```

## Error Responses

| Code | Description                                            |
| ---- | ------------------------------------------------------ |
| 400  | Invalid input, weak password, or passwords don't match |
| 401  | Current password is incorrect (self-service mode)      |
| 403  | Admin access required (admin mode only)                |
| 404  | User not found (admin mode only)                       |
