From eeb634bbae0ea627f67b6ba178bd4af9ac744859 Mon Sep 17 00:00:00 2001
From: "MH.Dmitrii" <MH.Dmitrii@homyk.space>
Date: Mon, 13 Jul 2026 09:25:34 +0300
Subject: [PATCH] fix self email check bug

---
 DB/database.db                   | Bin 53248 -> 53248 bytes
 src/service/crud_actions/crud.py |  16 +++++++++-------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/DB/database.db b/DB/database.db
index ae1b13315970d5aedf6531eba7dc3f735e8a8631..176409a3f07744e9ea92e5cd78b2daaa33fe3bb2 100644
GIT binary patch
delta 281
zcmZozz}&Ead4e=!(L@<%)*=SIsi!ukERJVn-prBE!lw|=$QctI#mLDZE-op~*~prh
zlAD<aCW=dnGV{_W@6UIf{5Efgco<NPsHiANO=)pz5e$RmnJOzc|Ife1&%@0u%bAi`
zn&*(BmooWby&5CqW{!r7{Q8{ClAI9ZIGM#6L0XNNVJt%?c4kpdkXRlU0|Nsy|6`!0
U3FK&6aFJh)IGZ;AU(cuj00BBs!T<mO

delta 286
zcmZozz}&Ead4e=!`a~IL)^rBF-d`J27RNI(Z01O4;p3`E%q_@C)l1ILoxCy6Mmm|9
zlR;cuT${6zwX`_3$Ou7{On#fULn@LHEH4g}PfW?p%tH{9*W@{FD!9teQ<7R-!py+H
zAOvJgeps&tvZ>)Bzdle%y@Z2Vl(B@9S)37UFf)v0$i%@c&IvY*3#g8n|1nV01gIvE
dqQqjDQX~AD7F^_4<6{GwLC~hn|JO4r001gZOoadd

diff --git a/src/service/crud_actions/crud.py b/src/service/crud_actions/crud.py
index f4d5a55..67f0eda 100644
--- a/src/service/crud_actions/crud.py
+++ b/src/service/crud_actions/crud.py
@@ -103,13 +103,6 @@ class CrudActions:
         if not is_admin and "admin" in permission_names:                            #check for escalating permissions
             raise errors.forbidden_error(detail="You can't update user with admin permissions")
         
-        if self.DB.get_user_by_email(email=user_info["email"]):
-            raise errors.forbidden_error(detail="You can't use this email")
-
-        plain_password = user_info.pop("plain_password", None)
-        if plain_password is not None:
-            user_info["hashed_password"] = self.hashes.plain_to_hash(plain_password) #re-hash password
-        
         target_id = user_info.pop("target_id", None)
         if target_id is None:
             current_user_info = self.DB.get_user_by_email(email=current_user.email)
@@ -119,6 +112,15 @@ class CrudActions:
 
         user_info["id"] = target_id
                     
+        if "email" in user_info:
+            existing = self.DB.get_user_by_email(email=user_info["email"])
+            if existing and existing.id != target_id:
+                raise errors.forbidden_error(detail="You can't use this email")
+
+        plain_password = user_info.pop("plain_password", None)
+        if plain_password is not None:
+            user_info["hashed_password"] = self.hashes.plain_to_hash(plain_password) #re-hash password
+        
         user = self.DB.update_user(data=user_info, permission_names=permission_names)
         
         if user is None: