feat: add password change functionality and dependencies

src/app/api/settings/route.js

@@ -1,10 +1,13 @@
 import { NextResponse } from "next/server";
 import { getSettings, updateSettings } from "@/lib/localDb";
+import bcrypt from "bcryptjs";
 
 export async function GET() {
   try {
     const settings = await getSettings();
-    return NextResponse.json(settings);
+    // Don't return the password hash to the client
+    const { password, ...safeSettings } = settings;
+    return NextResponse.json(safeSettings);
   } catch (error) {
     console.log("Error getting settings:", error);
     return NextResponse.json({ error: error.message }, { status: 500 });
@@ -14,8 +17,37 @@ export async function GET() {
 export async function PATCH(request) {
   try {
     const body = await request.json();
+
+    // If updating password, hash it
+    if (body.newPassword) {
+      const settings = await getSettings();
+      const currentHash = settings.password;
+
+      // Verify current password if it exists
+      if (currentHash) {
+        if (!body.currentPassword) {
+          return NextResponse.json({ error: "Current password required" }, { status: 400 });
+        }
+        const isValid = await bcrypt.compare(body.currentPassword, currentHash);
+        if (!isValid) {
+          return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+        }
+      } else {
+        // First time setting password, check if it matches default 123456
+        if (body.currentPassword !== "123456") {
+           return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+        }
+      }
+
+      const salt = await bcrypt.genSalt(10);
+      body.password = await bcrypt.hash(body.newPassword, salt);
+      delete body.newPassword;
+      delete body.currentPassword;
+    }
+
     const settings = await updateSettings(body);
-    return NextResponse.json(settings);
+    const { password, ...safeSettings } = settings;
+    return NextResponse.json(safeSettings);
   } catch (error) {
     console.log("Error updating settings:", error);
     return NextResponse.json({ error: error.message }, { status: 500 });