Also auth against mailPasswords in ldapserver.js

src/users.js

@@ -11,6 +11,7 @@ import externalLdap from './externalldap.js';
 import hat from './hat.js';
 import mail from './mail.js';
 import mailer from './mailer.js';
+import mailPasswords from './mailpasswords.js';
 import mysql from 'mysql2';
 import notifications from './notifications.js';
 import oidcClients from './oidcclients.js';
@@ -572,6 +573,17 @@ async function verifyAppPassword(userId, password, identifier) {
     throw new BoxError(BoxError.INVALID_CREDENTIALS, 'Password is not valid');
 }
 
+async function verifyMailPassword(userId, password) {
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof password, 'string');
+
+    const result = await mailPasswords.getByUserId(userId);
+
+    if (result.find(r => r.password === password)) return;
+
+    throw new BoxError(BoxError.INVALID_CREDENTIALS, 'Password is not valid');
+}
+
 // identifier is only used to check if password is valid for a specific app
 async function verify(user, password, identifier, options) {
     assert.strictEqual(typeof user, 'object');
@@ -602,6 +614,13 @@ async function verify(user, password, identifier, options) {
         return user;
     }
 
+    const [mailPasswordError] = await safe(verifyMailPassword(user.id, password));
+    if (!mailPasswordError) { // matched app password
+        debug(`verify: ${user.username || user.id} matched mail password`);
+        user.mailPassword = true;
+        return user;
+    }
+
     let localTotpCheck; // does 2fa need to be verified with local database 2fa creds
     if (user.source === 'ldap') {
         await externalLdap.verifyPassword(user.username, password, options);