Merge pull request #885 from ragnarbull/ragnarbull-auth-pwd-fixes

Password fixes - enforce max length, add checks (pwd breach, PII, low entropy), improved UX, deprecate common-passwords api

backend/src/routes/v1/auth.ts

@@ -8,7 +8,8 @@ import { AuthMode } from "../../variables";
 
 router.post("/token", validateRequest, authController.getNewToken);
 
-router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login1)
+router.post(
+  // TODO endpoint: deprecate (moved to api/v3/auth/login1)
   "/login1",
   authLimiter,
   body("email").exists().trim().notEmpty().toLowerCase(),
@@ -17,7 +18,8 @@ router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login1)
   authController.login1
 );
 
-router.post( // TODO endpoint: deprecate (moved to api/v3/auth/login2)
+router.post(
+  // TODO endpoint: deprecate (moved to api/v3/auth/login2)
   "/login2",
   authLimiter,
   body("email").exists().trim().notEmpty().toLowerCase(),
@@ -30,7 +32,7 @@ router.post(
   "/logout",
   authLimiter,
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   authController.logout
 );
@@ -38,24 +40,19 @@ router.post(
 router.post(
   "/checkAuth",
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
+    acceptedAuthModes: [AuthMode.JWT]
   }),
   authController.checkAuth
 );
 
-router.get(
-  "/common-passwords",
-  authLimiter,
-  authController.getCommonPasswords
-);
-
-router.delete( // TODO endpoint: deprecate (moved to DELETE v2/users/me/sessions)
+router.delete(
+  // TODO endpoint: deprecate (moved to DELETE v2/users/me/sessions)
   "/sessions",
   authLimiter,
   requireAuth({
-    acceptedAuthModes: [AuthMode.JWT],
-  }), 
+    acceptedAuthModes: [AuthMode.JWT]
+  }),
   authController.revokeAllSessions
 );
 
-export default router;
+export default router;