update

backend/main.py

@@ -27,6 +27,7 @@ from backend.auth import (  # noqa: E402
     create_access_token,
     get_current_user,
     hash_password,
+    password_needs_update,
     verify_password,
 )
 from backend.db import engine, get_db  # noqa: E402
@@ -130,6 +131,11 @@ def login(req: LoginRequest, db: Session = Depends(get_db)):
         if not user.is_active:
             raise HTTPException(status_code=403, detail="User is inactive")
 
+        if password_needs_update(user.password_hash):
+            user.password_hash = hash_password(req.password)
+            db.add(user)
+            db.commit()
+
         token = create_access_token(user_id=str(user.id))
         return {"access_token": token, "token_type": "bearer"}
     except HTTPException: