Add support for encrypted second password hashes

src/function/parent/create-family.ts

@@ -16,7 +16,7 @@
  */
 
 import { Conflict } from 'http-errors'
-import { NewDeviceInfo, ParentPassword } from '../../api/schema'
+import { NewDeviceInfo, PlaintextParentPassword, assertPlaintextParentPasswordValid } from '../../api/schema'
 import { Database } from '../../database'
 import { maxMailNotificationFlags } from '../../database/user'
 import {
@@ -29,12 +29,14 @@ export const createFamily = async ({ database, mailAuthToken, firstParentDevice,
   database: Database,
   mailAuthToken: string,
   firstParentDevice: NewDeviceInfo,
-  password: ParentPassword,
+  password: PlaintextParentPassword,
   timeZone: string,
   parentName: string,
   deviceName: string
   // no transaction here because this is directly called from an API endpoint
 }) => {
+  assertPlaintextParentPasswordValid(password)
+
   return database.transaction(async (transaction) => {
     const now = Date.now().toString(10)
     const mailInfo = await requireMailAndLocaleByAuthToken({ database, mailAuthToken, transaction, invalidate: true })

src/function/parent/recover-parent-password.ts

@@ -16,7 +16,7 @@
  */
 
 import { Conflict } from 'http-errors'
-import { ParentPassword } from '../../api/schema'
+import { PlaintextParentPassword, assertPlaintextParentPasswordValid } from '../../api/schema'
 import { Database } from '../../database'
 import { sendPasswordRecoveryUsedMail } from '../../util/mail'
 import { generateVersionId } from '../../util/token'
@@ -27,10 +27,12 @@ import { notifyClientsAboutChangesDelayed } from '../websocket'
 export const recoverParentPassword = async ({ database, websocket, password, mailAuthToken }: {
   database: Database
   websocket: WebsocketApi
-  password: ParentPassword
+  password: PlaintextParentPassword
   mailAuthToken: string
   // no transaction here because this is directly called from an API endpoint
 }) => {
+  assertPlaintextParentPasswordValid(password)
+
   await database.transaction(async (transaction) => {
     const mailInfo = await requireMailAndLocaleByAuthToken({ mailAuthToken, database, transaction, invalidate: true })