Make passwordPolicy validatorCallback asynchronous

[dalyaidan1]

New Feature / Enhancement Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Current Limitation

Custom validation on passwords may include asynchronous operations, such as hitting an special endpoint. The current validator only runs synchronously.

Feature / Enhancement Description

RestWrite.js should wrap the validatorCallback invocation with await Promise.resolve(...) so that both synchronous (boolean) and asynchronous (Promise) callbacks are supported. The type declaration for validatorCallback in PasswordPolicyOptions should be updated accordingly to (password: string) => boolean | Promise<boolean>.

Also worth mentioning the typing issue in #10471

// Before
if (
  this.config.passwordPolicy.validatorCallback &&
  !this.config.passwordPolicy.validatorCallback(this.data.password)
) { ... }

// After
if (this.config.passwordPolicy.validatorCallback) {
  const isValid = await Promise.resolve(
    this.config.passwordPolicy.validatorCallback(this.data.password)
  );
  if (!isValid) {
    return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, policyError));
  }
}

Example Use Case

1. Send a login/sign up request with a password
2. Expect an asynchronous operation to happen inside the validation

Alternatives / Workarounds

Custom logic in beforePasswordResetRequest, beforeLogin and beforeSave for _User

3rd Party References

[parse-github-assistant]

🚀 Thanks for opening this issue! We are excited about your ideas for improvement!