feat(auth): harden authentication with argon2 passwords and rotating hashed refresh tokens

ts/reception/classes.user.ts

@@ -17,7 +17,7 @@ export class User extends plugins.smartdata.SmartDataDbDoc<
     const newUser = new User();
     newUser.id = plugins.smartunique.shortId();
     newUser.data = {
-      connectedOrgs: null,
+      connectedOrgs: [],
       status: 'new',
       name: userDataArg.name,
       username: userDataArg.username,
@@ -31,8 +31,26 @@ export class User extends plugins.smartdata.SmartDataDbDoc<
     return newUser;
   }
 
-  public static hashPassword(passwordArg: string) {
-    return plugins.smarthash.sha256FromString(passwordArg);
+  public static async hashPassword(passwordArg: string) {
+    return plugins.argon2.hash(passwordArg);
+  }
+
+  public static isLegacyPasswordHash(passwordHashArg?: string) {
+    return !!passwordHashArg && !passwordHashArg.startsWith('$argon2');
+  }
+
+  public static shouldUpgradePasswordHash(passwordHashArg?: string) {
+    return this.isLegacyPasswordHash(passwordHashArg);
+  }
+
+  public static async verifyPassword(passwordArg: string, passwordHashArg?: string) {
+    if (!passwordHashArg) {
+      return false;
+    }
+    if (this.isLegacyPasswordHash(passwordHashArg)) {
+      return passwordHashArg === (await plugins.smarthash.sha256FromString(passwordArg));
+    }
+    return plugins.argon2.verify(passwordHashArg, passwordArg);
   }
 
   // INSTANCE