feat: allow other password hashing algorithms

[juanpicado]

⚠️ TLDR: Use bcrypt is much more secure, verdaccio 5 uses crypt by default to avoid breaking changes, the next major (v6) will switch to bcrypt by default and invalidate your current passwords. This does not apply if you are using your own authentication plugin.
⚠️ Switching to bcrypt will invalidate all your current passwords, it's recommended to remove the htpassw file and start from scratch.

Type: feat
Scope: plugin

The following has been addressed in the PR:

• There is a related issue?
• Unit or Functional tests are included in the PR

Description:

copied from v6 plugins by @greshilov verdaccio/verdaccio#2072

To avoid a breaking change, the default algorithm is crypt.

Context

The current implementation of the htpasswd module supports multiple hash formats on verify, but only crypt on sign in.
crypt is an insecure old format, so to improve the security of the new verdaccio release we introduce the support of multiple hash algorithms on sign in step.

New hashing algorithms

The new possible hash algorithms to use are bcrypt, md5, sha1. bcrypt is chosen as a default, because of its customizable complexity and overall reliability. You can read more about them here.

Two new properties are added to auth section in the configuration file:

• algorithm to choose the way you want to hash passwords.
• rounds is used to determine bcrypt complexity. So one can improve security according to increasing computational power.

Example of the new auth config file section:

auth:
htpasswd:
  file: ./htpasswd
  max_users: 1000
  # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
  algorithm: bcrypt
  # Rounds number for "bcrypt", will be ignored for other algorithms.
  rounds: 10

[greshilov]

generateHtpasswdLine is used in asynchronous changePasswordToHTPasswd, so I think it would be great to use asynchronous bcrypt.hash instead of bcrypt.hashSync to prevent blocking and make this function async.

I can try to do this in a separate PR :)

[juanpicado]

Does bcrypt.hash worked out last time? I barely remember there were few issues with it. Doens't? In anyway, LGTM for a separated PR, I think won't break any API.

[greshilov]

I tried, and it seemed to work according to tests. Please, take a look here:
#589

[greshilov]

LGTM

[juanpicado]

Thanks @greshilov for the review, really appreciated 💯