ui and bug fixers 29/09

Backend/ERPCore/Controllers/AuthController.cs

@@ -28,14 +28,20 @@ public sealed class AuthController : ControllerBase
     private readonly IAuthAltService _alt;
     private readonly IRoleService _roles;
     private readonly IAuditService _audit;
+    private readonly IUserManagementService _userManagement;
+    private readonly ICurrentUser _currentUser;
 
-    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles, IAuditService audit)
+    public AuthController(
+        IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles, IAuditService audit,
+        IUserManagementService userManagement, ICurrentUser currentUser)
     {
         _users = users;
         _recovery = recovery;
         _alt = alt;
         _roles = roles;
         _audit = audit;
+        _userManagement = userManagement;
+        _currentUser = currentUser;
     }
 
     /// <summary>
@@ -139,6 +145,8 @@ public sealed class AuthController : ControllerBase
     public async Task<IActionResult> ChangePassword([FromBody] ChangeUserPasswordRequest request, CancellationToken ct)
     {
         await _users.ChangeUserPasswordAsync(request, RequireBearerToken(), ct);
+        // AuthHex accepted the new password — release the first-login forced change.
+        await _userManagement.ClearMustChangePasswordAsync(_currentUser.AuditUserId, ct);
         AuthCookieWriter.ClearSession(Response);
         return NoContent();
     }