The password inserted into the database when adding a user is a hash value, but it is plaintext when updating a user.

[karec]

The password inserted into the database when adding a user is a hash value, but it is plaintext when updating a user.

[karec]

Hello @LANVNAL and thanks for reporting this.

This is indeed a bug and you pin-pointed precisely the issue: __init__ is never called by marshmallow-sqlalchemy when updating and I've hadn't added necessary logic to handle that case.

To fix this and avoid future issues with this, I've put the password hashing logic in an hybrid_property with an associated setter instead of putting the logic inside the endpoint itself.

I've also added a check inside the test_put_user

Related commit

[karec]

Issue fixed on master, I'm closing this issue. Thanks again for reporting !