feat(security): RN-1303: Update password storage to use argon2

[tcaiger]

Issue #: feat(security): RN-1303: Update password storage

Changes:

• Install @node-rs/argon2 in auth package
• Update encryptPassword and hashAndSaltPassword helper functions to use argon2 hashing
• Refactor encryptPassword through out the mono repo to be async
• Add verifyPassword helper to verify argon2 password hashes
• Refactor authentication code throughout the mono repo to use verifyPassword instead of checking sha256 hashes
• Add migration to hash all existing passwords with argon2
• Update User checkPassword method to first check for argon2 hashes and then check for migrated passwords that are hashed with both sha256 and argon2

[rohan-bes]

I think this all checks out, nice work @tcaiger 🙏

[tcaiger]

@rohan and @passcod thanks for the reviews. One more small question, do you think there is any value or need to keep track of which users have been migrated to the new algorithm on login? In case we ever wanted to remove the sha256EncryptPassword step on login. We could add a isMigrated flag or something?!

[passcod]

oh because you try sha256 by fallback.

standard password hashes look like this:

$argon2id$v=19$m=16,t=2,p=1$V2dGZlpObzNGUmdGQ1RjWA$CP3pnsx4wqpWWIs6gUH20g

instead of using a fallback, we could do the migration such that it goes

(await hash(old)).replace("$argon2id$", "$argon2id+sha$")

then that both provides an early switch instead of a fallback logic, and keeps track of remaining oldhashed users

[passcod]

Alternatively, set a new field sure