fix(admin): keep must_change_password unless it is passed to user edit

--must-change-password defaulted to true on admin user edit as well, so
changing a password with --password silently forced the user to change
it again at the next sign-in. On edit the flag now defaults to unset and
is sent only when passed; create keeps requiring a change by default.

Signed-off-by: bircni <bircni@icloud.com>

internal/app/admin_users_test.go

@@ -38,3 +38,25 @@ func TestAdminPromptAndFlagsReachEquivalentPayloads(t *testing.T) {
 	require.Len(t, prompt.secrets, 2)
 	require.NotContains(t, out.String(), "password")
 }
+
+func TestAdminUserEditSetsMustChangePasswordOnlyWhenPassed(t *testing.T) {
+	var edits []map[string]any
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPatch {
+			var payload map[string]any
+			require.NoError(t, json.NewDecoder(r.Body).Decode(&payload))
+			edits = append(edits, payload)
+		}
+		_, _ = w.Write([]byte(`{"id":2,"login":"bob"}`))
+	}))
+	defer server.Close()
+	deps, _, _ := serverDeps(t, server.URL)
+	for _, flags := range [][]string{{"--password", "new password"}, {"--password", "new password", "--must-change-password"}, {"--must-change-password=false"}} {
+		require.NoError(t, Execute(context.Background(), deps, append([]string{"admin", "user", "edit", "bob", "--no-input"}, flags...)))
+	}
+	require.Len(t, edits, 3)
+	require.Equal(t, "new password", edits[0]["password"])
+	require.Nil(t, edits[0]["must_change_password"])
+	require.Equal(t, true, edits[1]["must_change_password"])
+	require.Equal(t, false, edits[2]["must_change_password"])
+}