Add support for encrypted second password hashes

src/api/schema.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2021 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -44,18 +44,33 @@ export interface NewDeviceInfo {
   model: string
 }
 
-export interface ParentPassword {
+export interface PlaintextParentPassword {
   hash: string
   secondHash: string
   secondSalt: string
 }
 
-export const assertParentPasswordValid = (password: ParentPassword) => {
+export interface EncryptableParentPassword {
+  hash: string
+  secondHash: string
+  secondSalt: string
+  encrypted?: boolean
+}
+
+export const assertPlaintextParentPasswordValid = (password: PlaintextParentPassword) => {
+  assertParentPasswordValid({ ...password, encrypted: false })
+}
+
+export const assertParentPasswordValid = (password: EncryptableParentPassword) => {
   if (password.hash === '' || password.secondHash === '' || password.secondSalt === '') {
     throw new ParentPasswordValidationException('missing fields at parent password')
   }
 
-  if (!(optionalPasswordRegex.test(password.hash) && optionalPasswordRegex.test(password.secondHash) && optionalSaltRegex.test(password.secondSalt))) {
+  if (!(optionalPasswordRegex.test(password.hash) && optionalSaltRegex.test(password.secondSalt))) {
+    throw new ParentPasswordValidationException('invalid parent password')
+  }
+
+  if (!password.encrypted && !optionalPasswordRegex.test(password.secondHash)) {
     throw new ParentPasswordValidationException('invalid parent password')
   }
 }
@@ -64,7 +79,7 @@ export class ParentPasswordValidationException extends Error {}
 
 export interface CreateFamilyByMailTokenRequest {
   mailAuthToken: string
-  parentPassword: ParentPassword
+  parentPassword: PlaintextParentPassword
   parentDevice: NewDeviceInfo
   deviceName: string
   timeZone: string
@@ -79,7 +94,7 @@ export interface SignIntoFamilyRequest {
 
 export interface RecoverParentPasswordRequest {
   mailAuthToken: string
-  password: ParentPassword
+  password: PlaintextParentPassword
 }
 
 export interface RegisterChildDeviceRequest {

src/api/validator.ts

@@ -124,7 +124,7 @@ const definitions = {
     },
     "additionalProperties": false
   },
-  "ParentPassword": {
+  "PlaintextParentPassword": {
     "type": "object",
     "properties": {
       "hash": {
@@ -232,7 +232,7 @@ const definitions = {
         "type": "string"
       },
       "password": {
-        "$ref": "#/definitions/ParentPassword"
+        "$ref": "#/definitions/EncryptableParentPassword"
       },
       "timeZone": {
         "type": "string"
@@ -247,6 +247,29 @@ const definitions = {
       "userType"
     ]
   },
+  "EncryptableParentPassword": {
+    "type": "object",
+    "properties": {
+      "hash": {
+        "type": "string"
+      },
+      "secondHash": {
+        "type": "string"
+      },
+      "secondSalt": {
+        "type": "string"
+      },
+      "encrypted": {
+        "type": "boolean"
+      }
+    },
+    "additionalProperties": false,
+    "required": [
+      "hash",
+      "secondHash",
+      "secondSalt"
+    ]
+  },
   "SerializedChangeParentPasswordAction": {
     "type": "object",
     "properties": {
@@ -694,7 +717,7 @@ const definitions = {
         "type": "string"
       },
       "newPassword": {
-        "$ref": "#/definitions/ParentPassword"
+        "$ref": "#/definitions/EncryptableParentPassword"
       }
     },
     "additionalProperties": false,
@@ -1931,7 +1954,7 @@ const definitions = {
         ]
       },
       "password": {
-        "$ref": "#/definitions/ParentPassword"
+        "$ref": "#/definitions/EncryptableParentPassword"
       }
     },
     "additionalProperties": false,
@@ -2787,7 +2810,7 @@ export const isCreateFamilyByMailTokenRequest: (value: unknown) => value is Crea
       "type": "string"
     },
     "parentPassword": {
-      "$ref": "#/definitions/ParentPassword"
+      "$ref": "#/definitions/PlaintextParentPassword"
     },
     "parentDevice": {
       "$ref": "#/definitions/NewDeviceInfo"
@@ -2843,7 +2866,7 @@ export const isRecoverParentPasswordRequest: (value: unknown) => value is Recove
       "type": "string"
     },
     "password": {
-      "$ref": "#/definitions/ParentPassword"
+      "$ref": "#/definitions/PlaintextParentPassword"
     }
   },
   "additionalProperties": false,