From 7d9ba527a3c3beb2c4cf38da39741796d65e611d Mon Sep 17 00:00:00 2001
From: antv <antv@runsystem.net>
Date: Wed, 8 Jul 2026 13:45:23 +0700
Subject: [PATCH] feature: remove change password for admin

---
 app/Http/Controllers/AuthController.php       |  2 +-
 .../ForceChangePasswordMiddleware.php         |  2 +-
 app/Services/Admin/AdminService.php           |  2 +-
 app/Services/Auth/AuthService.php             |  8 +++---
 tests/Feature/LoginNotificationTest.php       | 25 +++++++++++++++++++
 5 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/app/Http/Controllers/AuthController.php b/app/Http/Controllers/AuthController.php
index 9aca739..7f1cac0 100644
--- a/app/Http/Controllers/AuthController.php
+++ b/app/Http/Controllers/AuthController.php
@@ -62,7 +62,7 @@ class AuthController extends Controller
         \Illuminate\Support\Facades\RateLimiter::clear($throttleKey);
 
         $user = $result['user'];
-        if ($user->first_login == \App\Models\User::FIRST_LOGIN_TRUE) {
+        if ($user->role != \App\Models\User::ROLE_ADMIN && $user->first_login == \App\Models\User::FIRST_LOGIN_TRUE) {
             return redirect()->route('login')->with('dialog_first_login', true);
         }
 
diff --git a/app/Http/Middleware/ForceChangePasswordMiddleware.php b/app/Http/Middleware/ForceChangePasswordMiddleware.php
index f8996ab..7e71d1b 100644
--- a/app/Http/Middleware/ForceChangePasswordMiddleware.php
+++ b/app/Http/Middleware/ForceChangePasswordMiddleware.php
@@ -12,7 +12,7 @@ class ForceChangePasswordMiddleware
 {
     public function handle(Request $request, Closure $next): Response
     {
-        if (Auth::check() && Auth::user()->first_login == User::FIRST_LOGIN_TRUE) {
+        if (Auth::check() && Auth::user()->role != User::ROLE_ADMIN && Auth::user()->first_login == User::FIRST_LOGIN_TRUE) {
             if (!$request->routeIs('user.change_password') && !$request->routeIs('user.update_password') && !$request->routeIs('logout')) {
                 return redirect()->route('user.change_password');
             }
diff --git a/app/Services/Admin/AdminService.php b/app/Services/Admin/AdminService.php
index e66a75b..ee53128 100644
--- a/app/Services/Admin/AdminService.php
+++ b/app/Services/Admin/AdminService.php
@@ -92,7 +92,7 @@ class AdminService implements AdminServiceInterface
             'status'      => User::STATUS_ACTIVE,
             'card'        => 0,
             'flag_send'   => User::FLAG_SEND_DISABLED,
-            'first_login' => User::FIRST_LOGIN_TRUE,
+            'first_login' => $data['role'] == User::ROLE_ADMIN ? User::FIRST_LOGIN_FALSE : User::FIRST_LOGIN_TRUE,
         ]);
     }
 
diff --git a/app/Services/Auth/AuthService.php b/app/Services/Auth/AuthService.php
index 75f9b65..67df2b9 100644
--- a/app/Services/Auth/AuthService.php
+++ b/app/Services/Auth/AuthService.php
@@ -37,14 +37,14 @@ class AuthService implements AuthServiceInterface
 
     public function getRedirectRouteForUser(User $user): string
     {
-        if ($user->first_login == User::FIRST_LOGIN_TRUE) {
-            return route('user.change_password');
-        }
-
         if ($user->role == User::ROLE_ADMIN) {
             return route('admin.dashboard');
         }
 
+        if ($user->first_login == User::FIRST_LOGIN_TRUE) {
+            return route('user.change_password');
+        }
+
         return route('user.dashboard');
     }
 }
\ No newline at end of file
diff --git a/tests/Feature/LoginNotificationTest.php b/tests/Feature/LoginNotificationTest.php
index bbd41f3..c299aae 100644
--- a/tests/Feature/LoginNotificationTest.php
+++ b/tests/Feature/LoginNotificationTest.php
@@ -197,6 +197,31 @@ class LoginNotificationTest extends TestCase
         $this->assertTrue(\Illuminate\Support\Facades\Auth::check());
     }
 
+    public function test_admin_first_login_does_not_redirect_to_change_password(): void
+    {
+        $admin = User::create([
+            'msnv'        => 5007,
+            'name'        => 'First Login Admin',
+            'mail'        => 'first_admin@example.com',
+            'pass'        => md5('password123'),
+            'departments' => 1,
+            'role'        => User::ROLE_ADMIN,
+            'status'      => User::STATUS_ACTIVE,
+            'card'        => 10,
+            'flag_send'   => User::FLAG_SEND_ENABLED,
+            'first_login' => User::FIRST_LOGIN_TRUE,
+        ]);
+
+        $response = $this->post('/login', [
+            'mail'     => 'first_admin@example.com',
+            'password' => 'password123',
+        ]);
+
+        $response->assertRedirect(route('admin.dashboard'));
+        $response->assertSessionMissing('dialog_first_login');
+        $this->assertTrue(\Illuminate\Support\Facades\Auth::check());
+    }
+
     /**
      * Test Case 6: Brute-force protection
      */