feat: prevent forced password reset for passwordless users

Signed-off-by: miguel456 <me@nogueira.codes>

app/Http/Controllers/UserController.php

@@ -358,20 +358,27 @@ class UserController extends Controller
     public function forcePasswordReset(User $user) {
 
         $this->authorize('adminEdit', $user);
-        $user->notify(new PasswordAdminResetNotification());
 
-        $user->password = null;
-        $user->save();
+        if (!$user->hasPassword()) {
+            $user->notify(new PasswordAdminResetNotification());
+
+            $user->password = null;
+            $user->save();
 
 
-        Log::alert("Removed account password", [
-            'target' => $user,
-            'actor' => Auth::user()
-        ]);
+            Log::alert("Removed account password", [
+                'target' => $user,
+                'actor' => Auth::user()
+            ]);
+
+            return redirect()
+                ->back()
+                ->with('success', __('Account password removed.'));
+        }
 
         return redirect()
             ->back()
-            ->with('success', 'Account password removed.');
+            ->with('error', __('This user doesn\'t have a password to reset.'));
     }