diff --git a/DB/database.db b/DB/database.db index ae1b133..176409a 100644 Binary files a/DB/database.db and b/DB/database.db differ diff --git a/src/service/crud_actions/crud.py b/src/service/crud_actions/crud.py index f4d5a55..67f0eda 100644 --- a/src/service/crud_actions/crud.py +++ b/src/service/crud_actions/crud.py @@ -103,13 +103,6 @@ class CrudActions: if not is_admin and "admin" in permission_names: #check for escalating permissions raise errors.forbidden_error(detail="You can't update user with admin permissions") - if self.DB.get_user_by_email(email=user_info["email"]): - raise errors.forbidden_error(detail="You can't use this email") - - plain_password = user_info.pop("plain_password", None) - if plain_password is not None: - user_info["hashed_password"] = self.hashes.plain_to_hash(plain_password) #re-hash password - target_id = user_info.pop("target_id", None) if target_id is None: current_user_info = self.DB.get_user_by_email(email=current_user.email) @@ -119,6 +112,15 @@ class CrudActions: user_info["id"] = target_id + if "email" in user_info: + existing = self.DB.get_user_by_email(email=user_info["email"]) + if existing and existing.id != target_id: + raise errors.forbidden_error(detail="You can't use this email") + + plain_password = user_info.pop("plain_password", None) + if plain_password is not None: + user_info["hashed_password"] = self.hashes.plain_to_hash(plain_password) #re-hash password + user = self.DB.update_user(data=user_info, permission_names=permission_names) if user is None: