fix: require password only for adult visibility changes

internal/handler/profile.go

@@ -2,6 +2,7 @@
 package handler
 
 import (
+	"context"
 	"errors"
 	"net/http"
 
@@ -20,7 +21,12 @@ func updateProfileHandler(svc *service.Container) gin.HandlerFunc {
 		}
 		uid, _ := c.Get(middleware.CtxUserID)
 		userID := uid.(string)
-		if patch.HideAdult != nil {
+		hideAdultChanged, err := profileHideAdultChanged(c.Request.Context(), svc, userID, patch)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if hideAdultChanged {
 			if err := svc.Auth.VerifyPassword(c.Request.Context(), userID, patch.Password); err != nil {
 				c.JSON(http.StatusUnauthorized, gin.H{"error": "需要输入当前账号密码确认"})
 				return
@@ -39,6 +45,20 @@ func updateProfileHandler(svc *service.Container) gin.HandlerFunc {
 	}
 }
 
+func profileHideAdultChanged(ctx context.Context, svc *service.Container, userID string, patch service.ProfileUpdate) (bool, error) {
+	if patch.HideAdult == nil {
+		return false, nil
+	}
+	user, err := svc.Repo.User.FindByID(ctx, userID)
+	if err != nil {
+		return false, err
+	}
+	if user == nil {
+		return false, errors.New("user not found")
+	}
+	return user.HideAdult != *patch.HideAdult, nil
+}
+
 type adminUpdateRoleReq struct {
 	Role string `json:"role" binding:"required"`
 }