From e146b4a08acb0438e953989a2fe23d4450504d17 Mon Sep 17 00:00:00 2001
From: 9qeklajc <9qeklajc>
Date: Fri, 24 Oct 2025 15:20:01 +0200
Subject: [PATCH] better passwrod setting

---
 routstr/core/admin.py                     |  43 +++++-
 ui/app/favicon.ico                        | Bin 25931 -> 15406 bytes
 ui/components/settings/admin-settings.tsx | 173 +++++++++++++++++++---
 3 files changed, 191 insertions(+), 25 deletions(-)

diff --git a/routstr/core/admin.py b/routstr/core/admin.py
index f84fc8b9..fa2381b1 100644
--- a/routstr/core/admin.py
+++ b/routstr/core/admin.py
@@ -169,10 +169,22 @@ class SettingsUpdate(BaseModel):
     __root__: dict[str, object]
 
 
+class PasswordUpdate(BaseModel):
+    current_password: str
+    new_password: str
+
+
 @admin_router.patch("/api/settings", dependencies=[Depends(require_admin_api)])
 async def update_settings(request: Request, update: SettingsUpdate) -> dict:
+    # Remove sensitive fields from general settings update
+    settings_data = update.__root__.copy()
+    sensitive_fields = ["admin_password", "upstream_api_key", "nsec"]
+    for field in sensitive_fields:
+        if field in settings_data:
+            del settings_data[field]
+    
     async with create_session() as session:
-        new_settings = await SettingsService.update(update.__root__, session)
+        new_settings = await SettingsService.update(settings_data, session)
     data = new_settings.dict()
     if "upstream_api_key" in data:
         data["upstream_api_key"] = "[REDACTED]" if data["upstream_api_key"] else ""
@@ -183,6 +195,35 @@ async def update_settings(request: Request, update: SettingsUpdate) -> dict:
     return data
 
 
+@admin_router.patch("/api/password", dependencies=[Depends(require_admin_api)])
+async def update_password(request: Request, password_update: PasswordUpdate) -> dict:
+    # Verify current password
+    try:
+        current_settings = SettingsService.get()
+        current_password = current_settings.admin_password
+    except Exception:
+        current_password = os.getenv("ADMIN_PASSWORD", "")
+
+    if not current_password:
+        raise HTTPException(status_code=500, detail="Admin password not configured")
+
+    if password_update.current_password != current_password:
+        raise HTTPException(status_code=401, detail="Current password is incorrect")
+
+    # Validate new password
+    new_password = password_update.new_password.strip()
+    if len(new_password) < 6:
+        raise HTTPException(
+            status_code=400, detail="New password must be at least 6 characters"
+        )
+
+    # Update password
+    async with create_session() as session:
+        await SettingsService.update({"admin_password": new_password}, session)
+
+    return {"ok": True, "message": "Password updated successfully"}
+
+
 class SetupRequest(BaseModel):
     password: str
 
diff --git a/ui/app/favicon.ico b/ui/app/favicon.ico
index 718d6fea4835ec2d246af9800eddb7ffb276240c..c4591ac495f46b175370b9591e9e8aa4195424dd 100644
GIT binary patch
literal 15406
zcmeHO>5o-K7JrkO5B=T)29&1Rghm!oi6R8VIBFwd88DiR3py?_E(jrU%=ke;V8&hA
zxU`7Is3VBD#Sh513z{?rA}S&S20xkTgdqMAXX<yVPSvS;b?>{~#!q7>H&u1csk5KD
z^{Q^yYQL-fzBYV#&9vRMm4B$!=GJPp?ruAtKB89pmx0Zk>G0EPwY{CS+H^x>rkEKP
zZkp_0y`zIV%u}!1wxeFBj)v<u4V>`?hPK{doXoNFnr3d@Jf>wnrr)&m^$yn>e8b_G
zkAp*wos0SQX}VU%Xzd(FYj}e{<C!PqyT|aAc}?zj5cqX49=Il1xab_{>m3dzyqz8$
zW_;UiE9mme|KfSWN1{VR$%O2Uk3LFEmMn2P)v3F?n_k(zovy$BdOsh2VLc7+V6U}r
z{rdIv$RoWpbm$+M=79$upk~wR*61+)M<4S!9%epbWaN52W;}lUcv^G!-88>vK3#a>
zpXm0#-A?lt^w9IqKTqREj|+ORjfkt&hg-vY+O%nO=il$7bIv)3*4}duoq6V&G;`)m
z>NR?Gjp{P=E*8dTO_LL159Z&0|NZpfgAY=pVc^E!!-fr`b?esAxH04C<daWMWII0~
z_YfO1f5V0i)YH=w<<bztWBs}fbkCYKCKq5U<Xau=82+&HEnMOY9qKe<#0a|Mjyq`O
z%9X5B)5jP*8qRm1wfVxaVg5~)XUA68rqR>pJ@U%(2fksRW<$ln%on;k^4!JT=Q77H
z_+DxUKIEL08bpqx&pbM~j<}XE-{b?^%YD!o9Zi1N`n5R7YbstWUyZYi!T^9+XS&VP
zV;-zeMSt3d-Y>>hiKDmQ*#dg;Rj#%CY%H>P!$<Sb@}s_qOI9BzKkx|p2u!!Sulb2?
zz~>%K3%svmC7<UxdxS?iPvqD(<YhXR`MUKoeO*{xHBU{CKCh#W9ytqIUq8t87Qg20
zPx)3ETUiM|t-Gw{MlbtrNN5?}4kl|zo-V6HhOhWAZ<o!{JkH2<YeqY~kDr&{hOhRO
zo72jpf_yK}`iS2j3C!!Bvn2y#9?%c@Q^0HS;)OJO_H0#8&R)$gW24ulfNvfj`|{?S
zZ>FD5oS<XJj?s*>&QdxQ>zn6meI~f>Nt5Vq^Ugl^+;iRgEyjy4o_gvjI&tD>`st^i
zXwIBDUVb)yk)5#}B9~k9&Uovsw+!DC^xb#gxp#LgA9O2Lte~Acchag=tLV~8FZHrL
zuZ+({Z^YB;n6IlXTeh(LWB)xy<Hn_XlsfO9-hTV-l08JLzW&`}bhrDFK*M8~FHN&o
z898z!UA6oQy7ksu>7$Q6qA_E}c>6$m@4ffZefRy-!^CFnZ=|p5)!QA#AjtP~9G>-Y
z{=4$ZE9t`zKcvy4M|<8whYqC|Uwo0UKh$g5)~#FVy6dhpu#)(C9db1Jcr0JOoObWt
zO>5V#r8Q>Xb^iJ1n?0%3;koCYV>oadH*VxwxZ<iSTI#iZPNuShe%J?Y+qR9ax#k+W
z_S$Qyzkd%cUAmNp3>iX~U3MA$_3EqXYV+K6*Io4e_utb+7hPmxobrReg=dVj`5-tO
z7t!}0#>X$c^b*^PI5nCL-pBX%_tUav%Y00L+q`)*%l5I?YmoQ5io3z<+^~AoIp46h
zJpAy(k!+nO_$|@DXHTSq%xAi&{$hJIA1z<tuWf&g>+i=Of8;$o;Nf>u&>uSNVI7vT
zA10Y~OV^6<(``<k#Rvay+qRXCoAu|*FTZSwV>*A5*I^m0HEZS#H{9T364M6$ArGuA
zF<qTHM|N^P!5*!9Q6F^h!_J-mj^t<QB`&hw<nqG6qF5Htfd7=KQ>pLCKEGyb`?K;(
zcxn2o@`n!}PCfJI)5RBGO!G}^<FE3qT@84B+#IG?^F2P~9oJ@MzF}S(XKinq6Bd`z
zBbA$s@!L=HP4|ZBSkwBx<VeEH<2_vGw2|v{u`<+eQ}sKll}D^^Dc<le)<5WCY4DrW
zK5{<d$6o(Lc8lGHr-L!iM85C~ZO~6(u!rZm-|E~?VrKENF0%e(zQj~`3cYSMu3bOp
zW8tN70uz2>i;OF`I4^K#5W-XT4Pk8UFB%IREzTOy;_N}U78l}PG%h+9_<w=poWvZ_
z)^0RU)pHUZdz~Yp-&*fDn?no`Ya0v1EyUU4Tz$A$Mle@9c5eH)1|1#GsGjwCT3l<E
ze+&zDIk>C+7G2c&Rf^L*ig17z(P?<qzFs%dIU+07MUOE@=%gQwb9e(2SwbtVz>C^4
zI{m%`T}qpdMMjPmIHA{gfkksc%WGD!OYms5kJI^@PWQD;4bSx}(fW5tW{;q3_53}3
z-X>3H=Ei-?Uv#qPxvjB?=cGLBxSg*8KC!8y?mAzp=p!`IJk(>fZa7;i>L5JP>O9eK
z-_OZu@qgZzo<~A&eJK7jw&e8Ia+CE3e8ajuFxfme!>>qJhHG8Sdm``<8_IRCJ`S|9
zCkVMz62FXZqFnI5*MkmiW17UH%=TDTkb(Rw#0`LdnQV)T-#sb)Ky)a)%PiHmM1CeV
zseWbSf#?oC1EnvMJy;y>2B%D!!sk0UTk?E<i7#5_hFZzl-156Ss!x@pNnD{j&gS-*
zbE)^<dyg);<Pv{Z?CnVA0G`vKjJ_(auufb2VQrc*V+Q^3!w-D!g!62iLF4Y4<yG`S
zRo#l{aJPQiX{XV=dGl!Ml&P`*iga-HELgCBb;r3m^vC)1DW{wgawzhBN!>+s>K?m5
zzW5n&Jny{oXz$*=bo}^n`s9;OXztv(1@hxOnm&CxZGUAuef#aVgfqXxhY!<DH{IyZ
zJmqXeWEJ@@f*0s3zdIvZXY<qM{1pDf0~>G$(ozqRf9iDl>8JA<{l0zsXx6M*G<ou5
znmBQyKex=u`L$s9)&a3U@w3$*-#SF=NTNIP<Mr2Hr%ylql)tkWoL*IPDULbIN@4_G
zzWVB`^!ewX^BVH;#~+(-MlMuqL@W#E@n3)awaL4AmGW$$_GM#l>MaX5z6Bh2H&{0&
zOqf8MHf^FqhYoRFq_RPaHRr3ZzT$KC6fa}kbKs0q#)E0)H+Q?akzMBA8g{(=^2_wi
zH{bA`i+uYdd_a%88Pw}T4?V=TTU>|}auWAKr=EK1fNdy$H<<GuBOmhgx*#y@p#X;s
z&ph)Ceel5tYy<F~#^B*!*l^&$0sh{ntE-FgLO09Y?cxq@>lWBBx!4Ak%dEE=i@!qK
zjC2TaRU>LXbizH?(W6IMPw2Y;i!bQ$#~-Irqek(2;(`k<U>srvygaB6+(}_Qd;k6S
z`EDVW7h)B|oi6VE65*6?Rp4izeKzgdwTs?)=N;<p?d1n|#|IA{WE;kg9c#|=8hm$!
zZ?<}SAMtdLJ@y!V_St9rUg+z4lGjxozev7`XVq~#9)ia^4e`evT$;lR7cMk+f&FX)
zVx(nDPU4<$@7{fUXNx_OrD@~yHg-sEYI*!#OJaqbz*@Rv#}2Lou?h3gM?J#^<jfmy
zyg{iApu6RkTlky3lTJD*vM-ih-S6qVR43f&VO_-c1X%yyeDh7UuH@w`Uc8w8W7gRx
zo_NCE|ET=b{8QQKI9_kUJ~^c;8si(qci(-NjvP6{>-u){t>vUiX3bFg6wO_<Xc6Dx
z!3J4_if9J}uOM6a_4W1n{SWpLYu32^Pm)(cuUq&TaY%Cs-&x|09Bu61d@ME3mVVZj
zP)m3R@&3o`-|$V$>eZ|B>#XBrYc!6t*dV!t-(z@3V~^URPg<v<pR_5y&G?Kn&fq%S
zzkffy@WKm&-jl%w+y}!3>`5!@&-w*_mf2fWSDl@m{JW$0``WU&TiM{f<j+fZ?}YWW
zRsU)_mg!%HE3z#+C#enWsj)A`Bi|9>T^#4nud6@4A<F97CjT%8-#g>CBfhP&&klO_
z*=K3|gozPPK3_|0AFRxHUf9>kx+&|1yi;R(bB3VK9Pv)W`ibwA#+aw8vy0y!_*Ocd
zS7}^O%c4^y9>%XReR=$g?5rlMs-0EoT)qAZu}0i<?8@v*e|rcmd{yqRa$gId(zYlE
zSpU{q8;D({ax?W>Zfn`vYU{-MTkd16Z|t}Gp^koujDgydqlbLdOR9(WYZ4F1A;EK-
zIlFI>mGEi7XZ$ZTB2&iUj4G3Fu6FdCplh5z0iNO0qEAYbj*$<c&Qtk8_Yiw6KkW;>
zh69%J6}-^r+n`q-A97jpAe9s5seD$x7CofpymD)fz{=XdKj;D&<^-JX$8<4`wO8hf
zT%plp>D$(R>k`A_Zz1^quQGNCZ>c94OADUTmv^m<HBS1rwRY%xHil>91O7`M(M4)Y
zcm;S^BUp!)`mpOrjDyWiFL%c;e5D0{`Nl|K18%YYB<qXt(E3XsIO*$F;Cim~Q=Enm
Twy$%^d>-`M-)|lmv<LnNeM@AF

literal 25931
zcmeHv30#a{`}aL_*G&7qml|y<+KVaDM2m#dVr!KsA!#An?kSQM(q<_dDNCpjEux83
zLb9Z^XxbDl(w>%i@8hT6>)&Gu{h#Oeyszu?xtw#Zb1mO<?sK2}EE5RAKnxHU7lft+
zNRAPL3?T?25I&drAjl1ssi=G|D?(7bFsgtO(2o>{pgX9699l+Qppw7jXaYf~-84xW
z)w4x8?=youko|}Vr~(D$UX<xm7|19n6Hxvd5m6xx<*9a4%RmR{en}E&p$X-wy5A}T
zU0^dwXVA>IbiXABHh`p1?nn8Po~fxRJv}|0e(BPs|G`(TT%kKVJAdg5*Z|x0leQq0
zkdUBvb#>9F()jo|T~kx@OM8$9wzs~t2l;K=woNssA3l6|sx2r3+kdfVW@e^8e*E}v
zA1y5{bRi+3Z`uD3{F7LgFJDdvm;nJilkzDku>BwXH(8ItVCXk*-lSJnR?-2UN%<G)
zWdETe=&R39RaKR)udn|#TOgZ!e!yM=<=+`Uz{l^5UtkZ2fHDQ;UwMB}v%l$A-`~F-
z{Qr^x^CSUf63Sry{6y#+`<sMA?dPFvg)$lC_RkFRKnCi7&P<a6>hJ){&rlvg`CDTj
z)Bzo!3v7Ou#83zEDEFcKt(f1E0~=rqeEbTnMvWR#{+9pg%7G8y>u1OVRUSoox-ovF
z2Ydma(;=YuBY(eI|04{hXzZD6_f(v~H;C~y5=DhAC{MMS>2fm~1H_t2$56pc$NH8(
z5bH|<)71dV-_oCHIrzrT`2s-5w_+2CM0$95I6X8p^r!gHp+j_gd;9O<1~CEQQGS8)
zS9Qh3#p&JM-G8rHekNmKVewU;pJRcTAog68KYo^dRo}(M<!8cv(gkb9@A>>36U4Us
zfgYWSiHZL3;lpWT=<n~R&zm>zNAW>Dh#mB!_@Lg%$ms8N-;aPqMn+C2HqZgz&9~Eu
z4|Kp<`$q)Uw1R?y(~S>ePdonHxpV1#eSP1B;Ogo+-Pk}6#0GsZZ5!||ev2MGdh}_m
z{DeR7?0-1^zVs&`AV6<!ZvGbtU{7FdY&`9DeD(=q|M30$GCs(E?S0J1$e@G0#Z=wz
zl)*a>Vt;r3`I`OI_wgs*w=eO%_#7Kepl{B<UyBc9U%rn&@xFZ-e{%i>@xiyCANc(l
zzIyd4y|c6PXWq9-|KM8(zIk8LPk(>a)zyFWjhT!$HJ$qX1vo@d25W<<x-(q{Yn-pG
zKTz?fwGmh&&2-F3f57**)?Xk#p#S9h^DhK{VVKE&0KR^-_MMD9nf@pDACnmVll!kp
z3?Tha?LWW70P;AL{}cP~sW|?W|MbA09{7Kt2f!i(y>fvZQ2zUz5WRc(UnFMKHwe1|
zWmlB1qdbiA(C0jmnV<}GfbKtmcu^2*P^O?<jWWPHxu*D53Uq)j1!ZtH3Vi&#Nd^rV
zj`B>MBLZKt|As~ge8&AAO~2K@zbXelK|4T<{|y4`raF{=72kC2Kn(L4YyenWgrPiv
z@^mr$t{#X5VuIMeL!7Ab6_kG$&#&5p*Z{+?5U|TZ`B!7llpVmp@skYz&n^8QfPJzL
z0G6K_OJM9x+Wu2gfN45phANGt{7=C>i34CV{Xqlx(fWpeAoj^N0Biu`w+MVcCUyU*
zDZuzO0>4Z6fbu^T_arWW5n!E45vX8N=bxTVeFoep_G#VmNlQzAI_KTIc{6>c+04vr
zx@W}zE5JNSU>!THJ{J=cqjz+4{L4A{Ob9$ZJ*S1?Ggg3klFp!+Y1@K+pK1DqI|_gq
z5ZDXVpge8-cs!o|;K73#YXZ3AShj50wBvuq3NTOZ`M&qtjj#GOFfgExjg8Gn8>Vq5
z`85n+9|!iLCZF5$HJ$Iu($dm?8~-ofu}tEc+-pyke=3!im#6pk_Wo8IA|fJwD&~~F
zc16osQ)EBo58U7XDuMexaPRjU@h8tXe%S{fA0NH3vGJFhuyyO!Uyl2^&EOpX{9As0
zWj+P>{@}jxH)8|r;2HdupP!vie{sJ28b&bo!8`D^x}TE$%zXNb^X1p@0PJ86`dZyj
z%ce7*{^oo+6%&~I!8hQy-vQ7E)0t0ybH4l%KltWOo~8cO`T=157JqL(oq_rC%ea&4
z2NcTJe-HgFjNg-gZ$6!Y`SMHrlj}Etf7<Kk?_r;;``Uc^3+u}-v3@Q8<@$Nr`<F?K
z-%F>?r!zQTPPSv}{so2e>Fjs1{<qUF=hGRSFDG$<z3x<+@%{Vd%a`e+qodRP&D<om
zAEn>gzk~LGeesX%r(Lh6rbhSo_n)@@G-FTQy93;l#E)hgP@d_SGvyCp0~o(Y;Ee8{
zdVUDbHm5`2taPUOY^MAGOw*<R_VaVlPH<<CgYr!E->>=s7=Gst=D+p+2yON!0%Hk`
zz5mAhyT4lS*T3LS^WSxUy86q&GnoHxzQ6vm8)VS}_zuqG?+3td68_x;etQAdu@sc6
zQJ&5|4(I?~3d-QOAODHpZ=hlSg(lBZ!JZWCtHHSj`0Wh93-Uk)_S%zsJ~aD>{`A0~
z9{AG(e|q3g5B%wYKRxiL2Y$8(4w<boVrLOyLG9R$m+7N>6bzchKuloQW#e&S3n+P-
z8!ds-%f;TJ1>)v)##>gd{PdS2Oc3VaR`fr=`O8QIO(6(N!A?pr5C#6fc~Ge@N%Vvu
zaoAX2&(a6eWy_q&UwOhU)|P3J0Qc%OdhzW=F4D|pt0E4osw;%<%Dn58hAWD^XnZD=
z>9~H(3bmLtxpF?a7su6J7M*x1By7YSUbxGi)Ot0P77`}P<HJ;%@cvfCkvm6xcMjdY
zed_u6xK)F%|1Hy`)`e~K(f*MqTJ?92I+4lga{A5`-U@Cab35G6unNk<*dpB|Rtkp;
z?32o^yBlJsuA-^abQ~7;%<oa^k<DbKc{lOW2!yM#nEALvv)IhY7b|Wfg(UhtiurTM
zY-B6L26$JQo&Kt3nh3JTJ)garEgw^{uEM3__%b$U5{~+aMO*k)6R#grkER2`U6KS-
z=j1=QhCkuy%iiHWrqH8CeGNw*C?epTpl2Bo@ugUPKRFeiVHOpL7PHu-SAgX@qmTGH
z_%ePz1`io8XDfwLmip;Rn;1yo+3>3{)&5Un{KD?`-e?r21!4vTTnN(4Y6Lin?UkSM
z`MXCTC1@4A4~mvz%Rh2&EwY))LeoT=*`tMoqcEXI>TZU9WTP#l?uFv+@Dn~b(>xh2
z;>B?;Tz2SR&KVb>vGiBSB`@U7VIWFSo=LDSb9F{GF^DbmWAfpms8Sx9OX4CnBJca3
zlj9(x!dIjN?OG1X4l*imJNvRCk}F%!?SOfiOq5y^mZW)jFL@<gIi}tCXee1<sGV$i
z4r_`X#mEQbiDh!Efji0GjM9z-0bF}p0(*s(OzMJ|;K&OJBar<ARLp}T>a|r-@d#f7
z2gmU8L3IZq0ynIws=}~m^#@&C%J6QFo~Mo4V`>v7MI-_!EBMMtb%_M&kvAaN)@ZVw
z+`toz&WG#HkWDjnZE!6nk{e-oFdL^$YnbOCN}JC&{$#$O27@|Tn-skXr)2ml2~O!5
zX+gYoxhoc7qoU?C^3~&!U?kRFtnSEecWuH0B0OvLodgUAi}8p1<ZO0#U-k07ifx!>
zrO6RSXHH}D<I*>Mc$&|?D004<Y&c6)m74d`LOLU@ruR+Um4>DiOVMHV8kXCP@7NKB
zgaZq^^O<7PoKEp72kby@W0Z!Y*A<g|TlOeriuPP`vK2IntATvs?Iv|J14j&;NFSFo
zyJ+sca?G+8C%!b{Sq=6cJJqS>y{&vfg#C&gG@YVR9g?FEocMUi1gSN$+V+ayF45{a
zuDZDT<?u;)RfLQwg>N}mS|;BO%gEf}pjBfN2-gIrU#G5~cucA;dokXW89%>AyXJJI
z9X4Ul<x{xc_m~`mWBP0<g-{#wm}Vv~Ef3pKWC&N_<~88zSbEk;;+{DnJ9-u&Zc74s
zJ6TCQyl_^|5cY;wmDdrU@LTL-3v0H#Ui?8ICQV{imof1MHuM$`e*ux>IWA|ZYHgbI
z5?oFk@A=Ik7lrEQPDH!H+b`7_Y~aDb_qa=B2^Y&Ow41cU=4WDd40dp5(QS-WMN-=Y
z9g;6_-JdNU;|6cPwf$ak*aJIcwL@1n$#l~zi{c{EW?T;DaW*E8DYq?Umtz{nJ&w-M
zEMyT<MDk{HKbd#ckg5-pS_?QUVhZv?&Q-ioBS}$nvBd)nE7YO0deN~G(#zCJAbY$E
z!)g3Ytl=_NDUV%pykcE+Q<{EoZ_4FR@&#d<hqs%N>DrC&9K$d|kZe2#ws6)L=7K+{
zQw{XnV6UC$6-rW0emqm8wJoeZK)wJIcV?dST}Z;G0Arq{dVDu0&4kd%N!3F1*;*pW
zR&qUiFzK=@44#QGw7k1`3t_d8&*kBV->O##t|tonFc2YWrL7_eqg+=+k;!F-`^b8>
z#KWCE8%u4k@EprxqiV$VmmtiWxDLgnGu$Vs<8rppV5E<MCr+anDo)-{XRlCJ;D#M(
zT=3WgR02;Nm!54biUb^FtzPh8iGrf412epnki-k+G4mdkzC|lJqaRMbb0~Jjp-{}I
z5Do5afZi>ajBXL4nyyZM$SWVm!wnCj-B!Wjqj5-5dNXukI2$$|Bu3Lrw}z65Lc=1G
z^-#WuQOj$hwNGG?*CM_TO8Bg-1+qc>J7k5c51U8g?ZU5n?HYor;~JIjoWH-G>AoUP
ztrWWLbRNqIjW#RT*WqZgPJXU7C)VaW5}MiijYbABmzoru6EmQ*N8cVK7a3|aOB#O&
zBl8JY2WKfmj;h#Q!pN%9o@VNLv{OUL?rixHwOZuvX7{IJ{(EdPpuVFoQqIOa7gi<U
zTpbX&UCeYeNu>LVkBOKL@^smUA!tZ1CKRK}#SSM)iQHk)*R~?M!qkCruaS!#oIL1c
z<cK@1=jX>?J<BS8bpdt^R+}%A_DEhF^%o}8e!!lc`Y!qU>;U~&FfH#*98^G?i}pA{
z9Jg36t4=%6mhY(quYq*vSxptes9qy|7xSlH?G=S@>u>Ebe;|LVhs~@+06N<4CViBk
zUiY$thvX;>Tby6z9Y1e<Q<iIG*|o$r?OTFp`s)@_nHs4LeWbGvg7^}NK)>dAMQaiH
zm^r3v#$Q#2T=X>bsY#D%s!bhs^M9PMAcHbCc0FMHV{u-dwlL;a1eJ63v5U*?Q_8JO
zT#50!RD619#j_Uf))0ooADz~*9&lN!bBDRUgE>Vud-i5ck%vT=r^yD*^?Mp@Q^v+V
zG#-?gKlr}Eeqifb{|So?HM&g91<J5P5=Ly{?(NNY{6`O~L5r@sJe3rNZn06%SLk);
z9?hvE^Hr{!*G$<_doyzGn#*z*#}?)8dH=eYTgvc)T~}Jw!kCv68<+KL5{5?EXtDAZ
zWeNqp8%KIuBi&icn5s815Vho<+99VW1~m@L8l0=$c`t-L{q))~<!p*~vCdUcBcPz`
zyUi}!-k_`G{>P8|av8hQoCmQXkd?7wIJw<dY^{|7OQJUHKB~nksN_|Xy;DL?xjxU^
zbMa`WdfTBnr<wTd$mY&SgJ4U|X``k`#`gN@M+0x2W{YgC3kbLk<uYFJWglkx_)2#b
ztRiuA!EK9o)f`I2k)l;Of%E`ff91WlZh8yfRi6#N-mC`Ma(yr~U82SyAhc9B+ur!f
zP-3igg*KeYs9mGOAw@OaXYy9DnGjn0<m`JH&Q^h}^!h+uS9Ct*o-oEy(?iT6Yco>b
z_^v8bbg`<ZOL)a;i=IdfK0Zvw4nXsoC?eTOMpY)_ptiORm%J(1CD3dE0Z%Vy<2iHp
zcp>SAn{I*4bH$u(RZ6*x<DqKJ+5;a6Jq~=Y8V&c?Vsyq88!2nD?H?Eww58Mqt$7R8
z5BMjmKx>UhuA~hc=8czK8SHEKTzSxgbwi~9(OqJB&gwb^l4+m`k*Q;_?>Y-APi1{k
zAHQ)P)G)f|AyjSgcCFps)Fh6Bca*Xznq3<?y%xNvu0N78_R?~<RDFQx0ynlRG(E|j
zvEGN3bF<E_9p-I!UwQXFqcSGV#e^98tgFqLp+z9eP}y!jNA{)r*a+%M-_20xg?94<
zzmM{}syi0cd&P)zywMdS&Y_9k5JDtOM!L)b^2WP!+fHYGv>6!pV6Az&m{O8$wGFD?
zY&O*3*J0;_EqM#jh6^gMQKpXV?#1?>$ml1xvh8nSN>-?H=V;nJIwB07YX$e6vLxH(
zqYwQ>qxwR(i4f)DLd)-$P>T-no_c!LsN@)8`e;W@)-Hj0>nJ-}Kla4-ZdPJzI&Mce
zv)V_j;(3ERN3_@I$N<^|4Lf`B;8n+bX@bHbcZTopEmDI*Jfl)-pFDvo6svPRoo@(x
z);_{lY<;);XzT`dBFpRmGrr}z5u1=p<K1~3>C^<jVp}L(pzgMB_Vs-O?{Z?y$8M;)
zi@7zwpzV9#m72%En~(9@E)GWV^(~J*@^*K*TE0mynAnGJ5YSLCEnC42H-`tr4L=oW
zI}N{xQ$HT8Q6CVHf%RY&xw7!Zj(0xmg(K#UQ4u!ej95z7V4phlcTJ2&AR}$)zV-s!
zO7bqY6(=?1t+JCOW_z%HRE>S-{ce6iXQlLGcItwJ^mZx{m$&DA_oEZ)B{_bYPq-HA
zcH8WGoBG(aBU_j)vEy+_71T34@4dmSg!|M8Vf92Zj6WH7Q7t#OHQqWgFE3ARt+%!T
z?oLovLVlnf?2c7pTc)~cc^($_8nyKwsN`RA-23ed3sdj(ys%pjjM+9JrctL;dy8a(
z@en&CQmnV(()bu|Y%G1-4a(6x{aLytn$T-;(&{QIJB9vMox11U-1HpD@d(QkaJdEb
zG{)+6Dos_L+O3NpWo^=gR?evp|CqEG?L&Ut#D*KLaRFOgOEK(Kq1@!EGcTfo+%A&I
z=dLbB+d$u{sh?u)xP{PF8L%;YPPW53+@{>5W=Jt#wQpN;0_HYdw1{ksf_XhO4#2F=
zyPx6Lx2<92L-;L5PD`zn6zwIH`Jk(<gsVPionpJ-imI56$j4P0!br@ny3=!{x2TY^
zCD=)8_PgmN)E!^nczcDGc9Wm7oo5O3@fh=k=kh8J?_3KqEp7JHdv8z_iZ5#KmbiPt
z2Bt8Ro^p$7pS!xL3mtj<iN3f}#r6_&$Es0PnJTE?c;0#$%cGdu`T%~`gW;c^VD-S=
zrAatMf^%Lzr*wQ4kHSOb?WOUuEsJQ3xr{Imf1t{~iNmRwb_SP9!?FFN=b-E){!8P2
ztWCT~262O8`%?3<W4Wg+ovWY<re)?^kZ|Yi>$?Qw({erA$^bC;q33hv!d!>%wRhj#
zal^hk+WGNg;rJtb-EB(?czvOM=H7dl=vblBwAv>}%1@{}mnpUznfq1cE^sgsL0*4I
zJ##!*B?=vI_OEVis5o+_IwMIRrpQyT_Sq~ZU%oY7c5JMIADzpD!Upz9h@iWg_>>~j
zOLS;wp^i$-E?4<_cp?RiS%Rd?i;f*mOz=~(&3lo<=@(nR!_Rqiprh@weZlL!t#NCc
zO!QTcInq|%#>OVgobj{~ixEUec`E25zJ~*DofsQdzIa@5^nOXj2T;8O`l--(QyU<o
zeu8G~Z>^$t?TGY^7#&FQ+2SS3B#qK*k3`ye?8jUYSajE5iBbJls75CCc(m3dk{t?-
zopcER9{Z?TC)mk~gpi^kbbu>b-+a{m#8-y2^p$ka4n60w;Sc2}HMf<8JUvh<G@KZw
z+<GL!lpeahq2+nO{>CL0B&Btk)T`ctE$*qNW8L$`7!r^9T+>=<=2qaq-;ll2{`{Rg
zc5a0ZUI$oG&j-qVOuKa=*v4aY#IsoM+1|c4Z)<}lEDvy;5huB@1RJPquU2U*U-;gu
z=En2m+qjBzR#DEJDO`WU)hdd{Vj%^0V*KoyZ|5lzV87&g_j~NCjwv0uQVqXOb*QrQ
zy|Qn`hxx(58c<SELWpDAg~83oY-J_WoDiI6d7>70$E;L(X0uZZ72M1!6oeg)(cdKO
ze0gDaTz+ohR-#d)NbAH4x{I(21yjwvBQfmpLu$)|m{XolbgF!pmsqJ#D}(ylp6uC>
z{bqtcI#hT#HW=wl7>p!38sKsJ`r8}lt-q%Keqy%u(xk=yiIJiUw6|5IvkS+#?JTBl
z8H5(Q?l#wzazujH!8o>1xtn8#_w+397*<wp?Ryt$UFh41$qd}LyNJ7Oao(Aw2g|wy
zH_nZ+R#~EUME^#j4$@^5&>_cy8!pQGP%K(Ga3pAjsaTbbXJlQF_+m+-UpUUent@xM
zg%jqLUExj~o^vQ3Gl*>wh=_gOr2*|U64_iXb+-111a<qXXnUI&{l`dM&{4Gw)jZn;
zlj{VxW@#OcVE1Y%J*u^Z@H+XSqL6SwA|^jv2RU_+d;O!mk)dw7-m9B4{6*G1zRdR6
zQ}6v&Xt7R2h3Xp}EQk4nF2TULG{Ri=D|JC<a+K7dldN1}CY_f!vK#u}K3`g#TpO&W
z;!;64`0$d9raD!VbYP`kuFUasaMh!;&81y}LHS(SuGRxwEn4LZb4DS1j9iAq$MXd@
z(Ebka7_Gc(ljGaJqtI-OzmA@c@sYB$)Vg!RP4~``vaVyRq$rJXRjIPwtepN;(B%wy
zmU>H}$TjeajM+I20xw(((>fej-@CIz4S1pi$(#}P7`4({6QS2CaQS4NPENDp>sAqD
z$bH4KGzXGffkJ7R>V>)>tC)uax{UsN*dbeNC*v}#8Y#OWYwL4t$ePR?VTyIs!wea+
z5Urmc)X|^`MG~*dS6pGSbU+gPJoq*^a=_>$n4|P^w$sMBBy@f*Z^Jg6?n5?oId6f{
z$LW4M|4m502z0t7g<#Bx%X;9<=)smFolV&(V^(7Cv2-sxbxopQ!)*#ZRhTBpx1)Fc
zNm1T%bONzv6@#|dz(w02AH8OXe>kQ#1FMCzO}2J_mST)+ExmBr9cva-@?;wnmWMOk
z{3_~EX_xadgJGv&H@zK_8{(x84`}+c?oSBX*Ge3VdfTt&F}yCpFP?CpW+BE^cWY0^
zb&uBN!Ja3UzYHK-CTyA5=L<c0d<h!DNBIa<xax8W3(Ru8L0cVXQ18|Y^|*S%)R96z
zBT$(=zQ}2vmt6LzN~Oyf_Y92%P@QOx{7~}5!UIqCdfu?VwC0Nb!2@iiit8-5zUWFG
z*G&+GLIU#J;}hvowNJWnglvb^<2q~lS#?ixVtYT@(O3{TC|4kFJYLB*jni-4YZi0>
zEMW{l3Usky#ly=7px648W31UNV@K)&Ub&zP1c7%)`{);I4b0Q<)B}3;NMG2JH=X$U
zfIW4)4n9ZM`-yRj67I)YSLDK)qfUJ_ij}a#aZN~9EXrh8eZY2&=uY%2N0UFF7<~%M
zsB8=erOWZ>Ct_#^tHZ|*q`H;A)5;ycw*I<Cd*bZlOJ9YmRUK2<qXkpRR3nr6r~%Jz
z*(8tA&DYO)etdgVmoonqD{*<5Fog4ClIs-~_uhjuZOI}#Wy+ce${%#oyHloXelqfz
z8)?D3Y_>cmVxi8_0Xk}aJA^ath+E;xg!x+As(M#0=)3!NJR6H&9+zd#iP(m0PIW8$
z1Y^VX`>jm`W!=WpF*{ioM?C9`yOR>@0q=u7o>BP-eSHqCgMDj!2anwH?s%i2p+Q7D
zzszIf5XJpE)IG4;d_(La-xenmF(tgAxK`Y4sQ}BSJEPs6N_U2vI{8=0C_F?@7<(G;
zo$~G=8p+076G;`}>{MQ>t>7cm=zGtfbdDXm6||jUU|?X?CaE?(<6bKDYKeHlz}DA8
zXT={X=yp_R;HfJ9h%?eWvQ!dRgz&Su*JfNt!Wu>|XfU<MM~gB&J0gc}IH}?|B4WRK
zWPL0FhctFGdMucOFdhrVunIe5)4K^H9IjB#eA)p5w?c#v7kp8jx^~bxxJB{;hPFL9
zkR9Dbpj+T5ZMgHQg|oj*DS;x&jK}1rn&}Shp9sgOI*7puQD-w?3H*cg72;5H(_zW*
zApJBIM-p2~F;qWDj!n|Kd=5|T8OPkQ_G;ujgvKybr5@~eci2{8WAz+%NUSp-&eoG!
zOGLNLJewWl&1*NT467W3god~fYgX?!f0?NCFnjD$qE-fyQ)|Q_DLc*{olmXSVl$g_
z$vj}o?RatMy(o*j8?q1Mgw{OUOgVR6_qvS<Co*&!cR`ROi|*I`ajyG5s@L8agnX2J
zF=DLkMG`z{RP&996y0yAtvJcb<cba?TV#j4VYFPC>&68iRikRrHRW|ZxzRR^`eIGt
zIeiDgVS>IeExKVRWW8-=<xUfo0v~z=RA=cFWKXgcMECd}xHp7iqkBanH}TZ0h0rA=
zqxUZ>A=<k-RjTtwbJkkep{8z*173wY^e%-U0{Ue!n@wbg^2q)Vx5c(_RfvuR4}XXn
z+JE>yA`}`)ZkWBrZD`hpWIxBGkh&f#ijr449~m`j6{4jiJ*C!oVA8ZC?$1RM#K(_b
zL9TW)kN*Y4%^-qPpMP7d4)o?Nk#>aoYHT(*g)qmRUb?**F@pnNiy6Fv9rEiUqD(^O
zzyS?nBrX63BTRYduaG(0VVG2yJRe%o&rVrLjbxTaAFTd8s;<<@Qs>u(<193R8>}2_
zuwp{7;H2a*X7_jryzriZXMg?bTuegABb^87@SsKkr2)0Gyiax8KQWstw^v<oS3Xw7
zu51m`3~hoyxErcHymdFTZd#AO59{EkuFTcpAR33(3xc{zRnn1~1Ei(i*^HdCvM~;;
za&}Uip|u>#ix45EVrcEhr>!NMhprl<CqZuKa#zuI&@zymVzIicetS0bq#u?m(r_@S
zJ79bl%4EyHCQ3fK@en+A1@)e}HWLP|gr_zuoA{}Z<(-*53Zu@k+=^%~5F(z$EFLI;
z-TQTS8$W|GRbZq93Ha1?lu+`O;rn>$InQMzjSFH54x5k9qHc`@9uKQzvL4ihcq{^B
zPrVR=o_ic%Y>6&rMN)hTZsI7I<3&`#(nl+3y3ys9A~<Ao%ZuW})CJ)6^(aRV(gGxR
z89#(FDW;GZEAf;rI$+PU)rEV|rASrwP0_mr^Ldv)IuUf1M>&^=4?PL&nd8)`OfG#n
zwAMN$1&>K++c{^|7<<q5KGu)u(OEfEJJw2aEi(;x-i=Y=j3ram9H2n-Fuqv0dVlXJ
z&WgG5X({!vJFDrEbm+CWDca^zIe2@s1@a;;Y3!U9Q)&P0UXFmCP51_!wvTfAIyR^M
z7^R*O@yz1b-s4VC>4P=2y(B{jJsQ0a#U;HTo4ZmWZYvI{+s;Td{Yzem%0*k#)vjpB
zia;J&>}ICate44SFYY3vEelqStQWFihx%^vQ@Do(sOy7yR2@WNv7Y9I^yL=nZr3mb
zXKV5t@=?-Sk|b{XMhA7ZGB@2hqsx}4xwCW!in#C<kr{U&JG{9FhoZ<aTve_lLz39>
zI@}sc<h3gsW}hp-`WUywKA>Zlr3-NFJ@NFaJlhyfcw{k^vvtGl`N9xSo**rDW4S}i
zM9{fMPWo%4wYDG~BZ18BD+}h|GQKc-g^{++3MY>}W_uq7jGHx{mwE9fZiPCoxN$+7
zrODGGJrOkcPQUB(FD5aoS4g~7#6NR^ma7-!>mHuJfY5kTe6PpNNKC9GGRiu^L31uG
z$7v`*JknQHsYB!Tm_W{a32TM099djW%5e+j0Ve_ct}IM>XLF1Ap+YvcrLV=|CKo6S
zb+<Td{{5RWR}u2f(q<b(D$9JsF0OOzJ*+z0P5kc1t}CXlYgua%x*2lSgp|*WS3H-#
zdYr7?GQOL18zUS<2|;+vi4|4sQBM2Gs&WVS!D`q5Lz;XR@5rEfa{uG-!q?R8Ncz%(
z5K6~LQ@d2wp#)5q4u<ENlFbS)U4o1t9{-d>9Nl3_YdKP6%Cxy@6TxZ>;4&nTneadr
z_ES90ydCev)LV!dN=#(*f}|ZORFdvkYBni^aLbUk>BajeWIOcmHP#8S)*2U~QKI%S
zyrLmtPqb&TphJ;>yAxri#;{uyk`JJqODDw%(Z=2<VfJZemI(PFAD{6Sm|uE%BTbkl
zROsg*MOh20YgGs3H7?@pmQ>`1uc}br^V%>j!gS)D*q*f_-qf8&D;W1dJgQMlaH5er
zN2U<%Smb7==vE}dDI8K7cKz!vs^73o9f>2sgiTzWcwY|BMYHH5%Vn7#kiw&eItCqa
zIkR2~Q}>X=Ar8W|^Ms41Fm8o6IB2_j60eOeBB1Br!boW7JnoeX6Gs)?7rW0^5psc-
zjS16yb>dFn>KPOF;imD}e!enuIniFzv}n$m2#gCCv4jM#ArwlzZ$7@9&XkFxZ4n!V
zj3dyiwW4Ki2QG{@i>yuZXQizw_OkZI^-3otXC{!(lUpJF33gI60ak;Uqitp74|B6I
zgg{b=Iz}WkhCGj1M<xTd?60J5qsr1Cg7F~~U2N!(@lC<>=hu4#Aw173YxIVbISaoc
z-nLZC*6Tgivd5V`K%GxhBsp@SUU60-rfc$=wb>zdJzXS&-5(NRRodFk;Kxk!S(<ov
z$YXcI9;^grAyiJ4dWTv3b}K~Ww09(;mLY4+kj|$A?IMr}`7q?mIS1>O(a0e7oY=E(
zAyS;Ow?6Q&XA+cnkCb{28_1N8H#?J!*$MmIwLq^*T_9-z^&UE@A(z9oGYtFy6EZef
LrJugUA?W`A8`#=m

diff --git a/ui/components/settings/admin-settings.tsx b/ui/components/settings/admin-settings.tsx
index b56f45ed..256ddb24 100644
--- a/ui/components/settings/admin-settings.tsx
+++ b/ui/components/settings/admin-settings.tsx
@@ -24,7 +24,6 @@ interface SettingsData {
   description?: string;
   npub?: string;
   nsec?: string;
-  admin_password?: string;
   upstream_api_key?: string;
   http_url?: string;
   onion_url?: string;
@@ -32,6 +31,12 @@ interface SettingsData {
   [key: string]: unknown;
 }
 
+interface PasswordData {
+  current_password: string;
+  new_password: string;
+  confirm_password: string;
+}
+
 export function AdminSettings() {
   const [settings, setSettings] = useState<SettingsData>({});
   const [loading, setLoading] = useState(true);
@@ -39,6 +44,13 @@ export function AdminSettings() {
   const [error, setError] = useState<string>('');
   const [showSecrets, setShowSecrets] = useState(false);
   const [newMint, setNewMint] = useState('');
+  const [passwordData, setPasswordData] = useState<PasswordData>({
+    current_password: '',
+    new_password: '',
+    confirm_password: '',
+  });
+  const [passwordError, setPasswordError] = useState<string>('');
+  const [passwordSaving, setPasswordSaving] = useState(false);
 
   useEffect(() => {
     loadSettings();
@@ -78,6 +90,45 @@ export function AdminSettings() {
     }
   };
 
+  const handlePasswordUpdate = async () => {
+    try {
+      setPasswordSaving(true);
+      setPasswordError('');
+
+      if (passwordData.new_password !== passwordData.confirm_password) {
+        setPasswordError('New passwords do not match');
+        return;
+      }
+
+      if (passwordData.new_password.length < 6) {
+        setPasswordError('New password must be at least 6 characters');
+        return;
+      }
+
+      const { apiClient } = await import('@/lib/api/client');
+
+      await apiClient.patch('/admin/api/password', {
+        current_password: passwordData.current_password,
+        new_password: passwordData.new_password,
+      });
+
+      setPasswordData({
+        current_password: '',
+        new_password: '',
+        confirm_password: '',
+      });
+
+      toast.success('Password updated successfully');
+    } catch (err) {
+      const message =
+        err instanceof Error ? err.message : 'Failed to update password';
+      setPasswordError(message);
+      toast.error(message);
+    } finally {
+      setPasswordSaving(false);
+    }
+  };
+
   const handleInputChange = (field: string, value: string | boolean) => {
     setSettings((prev) => ({
       ...prev,
@@ -246,11 +297,6 @@ export function AdminSettings() {
             </CardDescription>
           </CardHeader>
           <CardContent className='space-y-4'>
-            {renderSecretField(
-              'admin_password',
-              'Admin Password',
-              'Enter admin password'
-            )}
             {renderSecretField(
               'upstream_api_key',
               'Upstream API Key',
@@ -258,7 +304,6 @@ export function AdminSettings() {
             )}
           </CardContent>
         </Card>
-
         {/* Cashu Mints */}
         <Card>
           <CardHeader>
@@ -307,24 +352,104 @@ export function AdminSettings() {
             )}
           </CardContent>
         </Card>
-      </div>
 
-      <Card className='mt-6'>
-        <CardFooter className='flex justify-between'>
-          <Button
-            variant='outline'
-            onClick={loadSettings}
-            disabled={loading || saving}
-          >
-            <RefreshCw className='mr-2 h-4 w-4' />
-            Reload
-          </Button>
-          <Button onClick={handleSave} disabled={loading || saving}>
-            <Save className='mr-2 h-4 w-4' />
-            {saving ? 'Saving...' : 'Save Settings'}
-          </Button>
-        </CardFooter>
-      </Card>
+        <Card className='mt-6'>
+          <CardFooter className='flex justify-between'>
+            <Button
+              variant='outline'
+              onClick={loadSettings}
+              disabled={loading || saving}
+            >
+              <RefreshCw className='mr-2 h-4 w-4' />
+              Reload
+            </Button>
+            <Button onClick={handleSave} disabled={loading || saving}>
+              <Save className='mr-2 h-4 w-4' />
+              {saving ? 'Saving...' : 'Save Settings'}
+            </Button>
+          </CardFooter>
+        </Card>
+
+        {/* Password Change */}
+        <Card>
+          <CardHeader>
+            <CardTitle>Change Admin Password</CardTitle>
+            <CardDescription>
+              Update your admin password for enhanced security
+            </CardDescription>
+          </CardHeader>
+          <CardContent className='space-y-4'>
+            {passwordError && (
+              <Alert variant='destructive'>
+                <AlertCircle className='h-4 w-4' />
+                <AlertDescription>{passwordError}</AlertDescription>
+              </Alert>
+            )}
+
+            <div className='space-y-2'>
+              <Label htmlFor='current_password'>Current Password</Label>
+              <Input
+                id='current_password'
+                type='password'
+                value={passwordData.current_password}
+                onChange={(e) =>
+                  setPasswordData((prev) => ({
+                    ...prev,
+                    current_password: e.target.value,
+                  }))
+                }
+                placeholder='Enter current password'
+              />
+            </div>
+
+            <div className='space-y-2'>
+              <Label htmlFor='new_password'>New Password</Label>
+              <Input
+                id='new_password'
+                type='password'
+                value={passwordData.new_password}
+                onChange={(e) =>
+                  setPasswordData((prev) => ({
+                    ...prev,
+                    new_password: e.target.value,
+                  }))
+                }
+                placeholder='Enter new password (min 6 characters)'
+              />
+            </div>
+
+            <div className='space-y-2'>
+              <Label htmlFor='confirm_password'>Confirm New Password</Label>
+              <Input
+                id='confirm_password'
+                type='password'
+                value={passwordData.confirm_password}
+                onChange={(e) =>
+                  setPasswordData((prev) => ({
+                    ...prev,
+                    confirm_password: e.target.value,
+                  }))
+                }
+                placeholder='Confirm new password'
+              />
+            </div>
+          </CardContent>
+          <CardFooter>
+            <Button
+              onClick={handlePasswordUpdate}
+              disabled={
+                passwordSaving ||
+                !passwordData.current_password ||
+                !passwordData.new_password ||
+                !passwordData.confirm_password
+              }
+            >
+              <Save className='mr-2 h-4 w-4' />
+              {passwordSaving ? 'Updating...' : 'Update Password'}
+            </Button>
+          </CardFooter>
+        </Card>
+      </div>
     </>
   );
 }