add users

backend/app/routers/auth.py

@@ -14,7 +14,13 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import get_settings
 from app.database import get_postgres_session
 from app.models import Account
-from app.schemas import AccountRegister, AccountRead, AuthResponse, LoginRequest
+from app.schemas import (
+    AccountRegister,
+    AccountRead,
+    AuthResponse,
+    LoginRequest,
+    PasswordChangeRequest,
+)
 from app.services.domain_policy import assert_company_domain_allowed
 from app.services.domain_provisioning import account_is_domain_owner
 from app.services.domain_provisioning import (
@@ -223,12 +229,35 @@ async def login(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Incorrect email or password.",
         )
+    if account.member_status == "invited":
+        account.member_status = "active"
+        await session.commit()
     return AuthResponse(
         access_token=create_access_token(account),
         account=await account_read(session, account),
     )
 
 
+@router.post("/change-password", response_model=AccountRead)
+async def change_password(
+    payload: PasswordChangeRequest,
+    account: Account = Depends(get_current_account),
+    session: AsyncSession = Depends(get_postgres_session),
+) -> AccountRead:
+    validate_password(payload.new_password)
+    if not password_hash.verify(payload.current_password, account.password_hash):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Current password is incorrect.",
+        )
+    account.password_hash = password_hash.hash(payload.new_password)
+    account.must_change_password = False
+    if account.member_status == "invited":
+        account.member_status = "active"
+    await session.commit()
+    return await account_read(session, account)
+
+
 @router.get("/me", response_model=AccountRead)
 async def get_me(
     account: Account = Depends(get_current_account),

backend/app/routers/people.py

@@ -39,8 +39,7 @@ async def add_person(
     manager: Account = Depends(require_org_manager),
     session: AsyncSession = Depends(get_postgres_session),
 ) -> OrgMemberRead:
-    if not payload.send_invitation:
-        validate_password(payload.password or "")
+    validate_password(payload.password)
 
     try:
         member = await create_org_member(