Adds previous password check for password updating

cmd/web/handlers.go

@@ -284,6 +284,7 @@ func (app *application) accountPasswordUpdatePost(w http.ResponseWriter, r *http
 	form.CheckField(validator.NotBlank(form.NewPassword), "newPassword", "This field cannot be blank.")
 	form.CheckField(validator.MinChars(form.NewPassword, PASSWORD_LENGTH), "newPassword", "This field must be at least 8 characters long.")
 
+	form.CheckField(validator.NotBlank(form.NewPasswordConfirmation), "newPasswordConfirmation", "This field cannot be blank.")
 	form.CheckField(validator.Compare(form.NewPassword, form.NewPasswordConfirmation), "newPasswordConfirmation", "Passwords do not match.")
 
 	if !form.Valid() {
@@ -301,6 +302,11 @@ func (app *application) accountPasswordUpdatePost(w http.ResponseWriter, r *http
 			data := app.newTemplateData(r)
 			data.Form = form
 			app.render(w, http.StatusUnprocessableEntity, "password.tmpl.html", data)
+		case errors.Is(err, models.ErrSamePassword):
+			form.AddFieldError("newPassword", "New password cannot be the same as the current password.")
+			data := app.newTemplateData(r)
+			data.Form = form
+			app.render(w, http.StatusUnprocessableEntity, "password.tmpl.html", data)
 		default:
 			app.serverError(w, err)
 		}

internal/models/errors.go

@@ -5,3 +5,4 @@ import "errors"
 var ErrNoRecord = errors.New("models: no matching record found")
 var ErrInvalidCredentials = errors.New("models: invalid credentials")
 var ErrDuplicateEmail = errors.New("models: duplicate email")
+var ErrSamePassword = errors.New("models: same password")

internal/models/users.go

@@ -123,6 +123,10 @@ func (m *UserModel) UpdatePassword(id int, currentPassword, newPassword string)
 		}
 	}
 
+	if err := bcrypt.CompareHashAndPassword(hashedCurrentPassword, []byte(newPassword)); err == nil {
+		return ErrSamePassword
+	}
+
 	hashedNewPassword, err := bcrypt.GenerateFromPassword([]byte(newPassword), COST)
 	if err != nil {
 		return err