user service: initial implementation (#17668)

* conceptual user service: initial commit

* reflect review comments

* fix i18n issues and some tests

* implement get user methods

* add license

* reflect review comments

app/authentication.go

@@ -4,13 +4,14 @@
 package app
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 
 	"github.com/mattermost/mattermost-server/v5/app/request"
 	"github.com/mattermost/mattermost-server/v5/model"
+	"github.com/mattermost/mattermost-server/v5/services/users"
 	"github.com/mattermost/mattermost-server/v5/shared/mfa"
-	"github.com/mattermost/mattermost-server/v5/utils"
 )
 
 type TokenLocation int
@@ -49,7 +50,17 @@ func (a *App) IsPasswordValid(password string) *model.AppError {
 		return nil
 	}
 
-	return utils.IsPasswordValidWithSettings(password, &a.Config().PasswordSettings)
+	if err := users.IsPasswordValidWithSettings(password, &a.Config().PasswordSettings); err != nil {
+		var invErr *users.ErrInvalidPassword
+		switch {
+		case errors.As(err, &invErr):
+			return model.NewAppError("User.IsValid", invErr.Id(), map[string]interface{}{"Min": *a.Config().PasswordSettings.MinimumLength}, "", http.StatusBadRequest)
+		default:
+			return model.NewAppError("User.IsValid", "app.valid_password_generic.app_error", nil, err.Error(), http.StatusInternalServerError)
+		}
+	}
+
+	return nil
 }
 
 func (a *App) CheckPasswordAndAllCriteria(user *model.User, password string, mfaToken string) *model.AppError {
@@ -57,14 +68,20 @@ func (a *App) CheckPasswordAndAllCriteria(user *model.User, password string, mfa
 		return err
 	}
 
-	if err := a.checkUserPassword(user, password); err != nil {
+	if err := users.CheckUserPassword(user, password); err != nil {
 		if passErr := a.Srv().Store.User().UpdateFailedPasswordAttempts(user.Id, user.FailedAttempts+1); passErr != nil {
 			return model.NewAppError("CheckPasswordAndAllCriteria", "app.user.update_failed_pwd_attempts.app_error", nil, passErr.Error(), http.StatusInternalServerError)
 		}
 
 		a.InvalidateCacheForUser(user.Id)
 
-		return err
+		var invErr *users.ErrInvalidPassword
+		switch {
+		case errors.As(err, &invErr):
+			return model.NewAppError("checkUserPassword", "api.user.check_user_password.invalid.app_error", nil, "user_id="+user.Id, http.StatusUnauthorized)
+		default:
+			return model.NewAppError("checkUserPassword", "app.valid_password_generic.app_error", nil, err.Error(), http.StatusInternalServerError)
+		}
 	}
 
 	if err := a.CheckUserMfa(user, mfaToken); err != nil {
@@ -100,14 +117,20 @@ func (a *App) DoubleCheckPassword(user *model.User, password string) *model.AppE
 		return err
 	}
 
-	if err := a.checkUserPassword(user, password); err != nil {
+	if err := users.CheckUserPassword(user, password); err != nil {
 		if passErr := a.Srv().Store.User().UpdateFailedPasswordAttempts(user.Id, user.FailedAttempts+1); passErr != nil {
 			return model.NewAppError("DoubleCheckPassword", "app.user.update_failed_pwd_attempts.app_error", nil, passErr.Error(), http.StatusInternalServerError)
 		}
 
 		a.InvalidateCacheForUser(user.Id)
 
-		return err
+		var invErr *users.ErrInvalidPassword
+		switch {
+		case errors.As(err, &invErr):
+			return model.NewAppError("DoubleCheckPassword", "api.user.check_user_password.invalid.app_error", nil, "user_id="+user.Id, http.StatusUnauthorized)
+		default:
+			return model.NewAppError("DoubleCheckPassword", "app.valid_password_generic.app_error", nil, err.Error(), http.StatusInternalServerError)
+		}
 	}
 
 	if passErr := a.Srv().Store.User().UpdateFailedPasswordAttempts(user.Id, 0); passErr != nil {
@@ -119,14 +142,6 @@ func (a *App) DoubleCheckPassword(user *model.User, password string) *model.AppE
 	return nil
 }
 
-func (a *App) checkUserPassword(user *model.User, password string) *model.AppError {
-	if !model.ComparePassword(user.Password, password) {
-		return model.NewAppError("checkUserPassword", "api.user.check_user_password.invalid.app_error", nil, "user_id="+user.Id, http.StatusUnauthorized)
-	}
-
-	return nil
-}
-
 func (a *App) checkLdapUserPasswordAndAllCriteria(c *request.Context, ldapId *string, password string, mfaToken string) (*model.User, *model.AppError) {
 	if a.Ldap() == nil || ldapId == nil {
 		err := model.NewAppError("doLdapAuthentication", "api.user.login_ldap.not_available.app_error", nil, "", http.StatusNotImplemented)