Jul 2nd - Optimized code 2

app/routes/admin.py

@@ -354,7 +354,7 @@ def edit_user(user_id):
         new_pw         = request.form.get('new_password', '')
         if new_pw:
             confirm_pw = request.form.get('confirm_password', '')
-            pw_error   = validate_password(new_pw, confirm_pw)
+            pw_error   = validate_password(new_pw, confirm_pw, user.password_hash)
             if pw_error:
                 flash(pw_error, 'danger')
                 return render_template('admin/edit_user.html', user=user, roles=_roles())

app/routes/auth.py

@@ -173,7 +173,7 @@ def profile():
                     logger.info(f'[AUTH AVATAR UPLOAD] user_id={current_user.id} file={stored_name}')
 
         if new_pw:
-            pw_error = validate_password(new_pw, confirm_pw)
+            pw_error = validate_password(new_pw, confirm_pw, current_user.password_hash)
             if pw_error:
                 flash(pw_error, 'danger')
                 return render_template('auth/profile.html')
@@ -236,12 +236,12 @@ def reset_password(token):
     if request.method == 'POST':
         password = request.form.get('password', '')
         confirm  = request.form.get('confirm_password', '')
-        pw_error = validate_password(password, confirm)
+        user     = token_row.user
+        pw_error = validate_password(password, confirm, user.password_hash)
         if pw_error:
             flash(pw_error, 'danger')
             return render_template('auth/reset_password.html', token=token)
 
-        user = token_row.user
         user.set_password(password)
         db.session.delete(token_row)   # single-use — delete immediately
         log_action(user.id, 'password_reset', 'user', user.id)