feat: integrate passwap for human user password hashing (#6196)

* feat: use passwap for human user passwords

* fix tests

* passwap config

* add the event mapper

* cleanup query side and api

* solve linting errors

* regression test

* try to fix linter errors again

* pass systemdefaults into externalConfigChange migration

* fix: user password set in auth view

* pin passwap v0.2.0

* v2: validate hashed password hash based on prefix

* resolve remaining comments

* add error tag and translation for unsupported hash encoding

* fix unit test

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>

internal/repository/user/human.go

@@ -48,7 +48,10 @@ type HumanAddedEvent struct {
 	Region        string `json:"region,omitempty"`
 	StreetAddress string `json:"streetAddress,omitempty"`
 
+	// New events only use EncodedHash. However, the secret field
+	// is preserved to handle events older than the switch to Passwap.
 	Secret         *crypto.CryptoValue `json:"secret,omitempty"`
+	EncodedHash    string              `json:"encodedHash,omitempty"`
 	ChangeRequired bool                `json:"changeRequired,omitempty"`
 }
 
@@ -81,10 +84,10 @@ func (e *HumanAddedEvent) AddPhoneData(
 }
 
 func (e *HumanAddedEvent) AddPasswordData(
-	secret *crypto.CryptoValue,
+	encoded string,
 	changeRequired bool,
 ) {
-	e.Secret = secret
+	e.EncodedHash = encoded
 	e.ChangeRequired = changeRequired
 }
 
@@ -149,8 +152,12 @@ type HumanRegisteredEvent struct {
 	PostalCode            string              `json:"postalCode,omitempty"`
 	Region                string              `json:"region,omitempty"`
 	StreetAddress         string              `json:"streetAddress,omitempty"`
-	Secret                *crypto.CryptoValue `json:"secret,omitempty"`
-	ChangeRequired        bool                `json:"changeRequired,omitempty"`
+
+	// New events only use EncodedHash. However, the secret field
+	// is preserved to handle events older than the switch to Passwap.
+	Secret         *crypto.CryptoValue `json:"secret,omitempty"` // legacy
+	EncodedHash    string              `json:"encodedHash,omitempty"`
+	ChangeRequired bool                `json:"changeRequired,omitempty"`
 }
 
 func (e *HumanRegisteredEvent) Data() interface{} {
@@ -182,10 +189,10 @@ func (e *HumanRegisteredEvent) AddPhoneData(
 }
 
 func (e *HumanRegisteredEvent) AddPasswordData(
-	secret *crypto.CryptoValue,
+	encoded string,
 	changeRequired bool,
 ) {
-	e.Secret = secret
+	e.EncodedHash = encoded
 	e.ChangeRequired = changeRequired
 }