fix(admin-api): reject explicit empty passwords

test/pleroma/web/admin_api/controllers/user_controller_test.exs

@@ -208,6 +208,21 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
       refute Map.has_key?(account2["data"], "password_reset_link")
     end
 
+    test "Explicit empty passwords return a conflict", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("accept", "application/json")
+        |> put_req_header("content-type", "application/json")
+        |> post("/api/pleroma/admin/users", %{
+          "users" => [
+            %{"nickname" => "lain", "email" => "lain@example.org", "password" => ""}
+          ]
+        })
+
+      assert [%{"error" => "password can't be blank"}] = json_response(conn, 409)
+      refute User.get_by_nickname("lain")
+    end
+
     test "Password reset token failures roll back the user batch", %{conn: conn} do
       with_mock Pleroma.PasswordResetToken, [:passthrough],
         create_token: fn user ->