fix(auth): reject a weak claim password before sending the code (#1648)

fluxer_api/src/api/openapi/openapi.json

@@ -35114,7 +35114,8 @@
 				"properties": {
 					"ticket": {"type": "string", "description": "Email change ticket identifier"},
 					"new_email": {"$ref": "#/components/schemas/EmailType"},
-					"original_proof": {"type": "string", "description": "Proof token obtained from verifying the original email"}
+					"original_proof": {"type": "string", "description": "Proof token obtained from verifying the original email"},
+					"new_password": {"$ref": "#/components/schemas/PasswordType"}
 				},
 				"required": ["ticket", "new_email", "original_proof"]
 			},

fluxer_api/src/api/user/controllers/UserAccountController.ts

@@ -224,7 +224,7 @@ export function UserAccountController(app: HonoApp) {
 			const body = ctx.req.valid('json');
 			const result = await ctx
 				.get('emailChangeService')
-				.requestNewEmail(user, body.ticket, body.new_email, body.original_proof);
+				.requestNewEmail(user, body.ticket, body.new_email, body.original_proof, body.new_password);
 			return ctx.json(result);
 		},
 	);

fluxer_api/src/api/user/services/EmailChangeService.ts

@@ -13,6 +13,7 @@ import {InputValidationError} from '@fluxer/errors/src/domains/core/InputValidat
 import {ms} from 'itty-time';
 import type {ApiContext} from '../../ApiContext';
 import {EMAIL_CLEARABLE_SUSPICIOUS_ACTIVITY_FLAGS} from '../../auth/AuthEmail';
+import * as AuthPassword from '../../auth/AuthPassword';
 import type {User} from '../../models/User';
 import type {EmailChangeRepository} from '../repositories/auth/EmailChangeRepository';
 
@@ -158,6 +159,7 @@ export class EmailChangeService {
 		ticket: string,
 		newEmail: string,
 		originalProof: string,
+		newPassword?: string,
 	): Promise<RequestNewEmailResult> {
 		const {email, emailDnsValidation, users, rateLimit} = this.apiContext.services;
 		const row = await getActiveChangeTicketForUser(this.repo, ticket, user.id);
@@ -182,6 +184,9 @@ export class EmailChangeService {
 		if (existing && existing.id !== user.id) {
 			throw InputValidationError.fromCode('new_email', ValidationErrorCodes.EMAIL_ALREADY_IN_USE);
 		}
+		if (newPassword != null && (await AuthPassword.isPasswordPwned(this.apiContext, newPassword))) {
+			throw InputValidationError.fromCode('new_password', ValidationErrorCodes.PASSWORD_IS_TOO_COMMON);
+		}
 		assertChangeCooldown(row.new_code_sent_at, this.RESEND_COOLDOWN_MS);
 		await checkChangeRateLimit(rateLimit, {
 			identifier: `email_change:new:${user.id}`,