fix: harden login for MLPS requirements

server/internal/tenant/app/auth_service.go

@@ -21,6 +21,7 @@ type AuthService struct {
 	jwt         *auth.Manager
 	sessions    *auth.SessionStore
 	loginGuard  *auth.LoginGuard
+	cipher      *auth.PasswordCipher
 }
 
 func NewAuthService(
@@ -45,11 +46,18 @@ func NewAuthService(
 	}
 }
 
+func (s *AuthService) WithPasswordCipher(cipher *auth.PasswordCipher) *AuthService {
+	s.cipher = cipher
+	return s
+}
+
 type LoginRequest struct {
-	Identifier string `json:"identifier"`
-	Email      string `json:"email"`
-	Password   string `json:"password" binding:"required"`
-	IP         string `json:"-"`
+	Identifier        string `json:"identifier"`
+	Email             string `json:"email"`
+	Password          string `json:"password"`
+	EncryptedPassword string `json:"encrypted_password"`
+	PasswordKeyID     string `json:"password_key_id"`
+	IP                string `json:"-"`
 }
 
 type LoginResponse struct {
@@ -107,6 +115,10 @@ func (s *AuthService) Login(ctx context.Context, req LoginRequest) (*LoginRespon
 	if identifier == "" {
 		return nil, response.ErrBadRequest(40001, "invalid_params", "login identifier is required")
 	}
+	password, err := s.loginPassword(req)
+	if err != nil {
+		return nil, err
+	}
 
 	permit, err := s.acquireLoginPermit(ctx, identifier, req.IP)
 	if err != nil {
@@ -114,6 +126,9 @@ func (s *AuthService) Login(ctx context.Context, req LoginRequest) (*LoginRespon
 	}
 	credentialsVerified := false
 	defer func() {
+		if permit == nil {
+			return
+		}
 		if credentialsVerified {
 			permit.RecordSuccess(ctx)
 			return
@@ -127,7 +142,7 @@ func (s *AuthService) Login(ctx context.Context, req LoginRequest) (*LoginRespon
 		return nil, response.ErrUnauthorized(40110, "invalid_credentials", "email or password is incorrect")
 	}
 
-	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
 		permit.RecordFailure(ctx)
 		return nil, response.ErrUnauthorized(40110, "invalid_credentials", "email or password is incorrect")
 	}
@@ -178,6 +193,34 @@ func (s *AuthService) Login(ctx context.Context, req LoginRequest) (*LoginRespon
 	}, nil
 }
 
+func (s *AuthService) PasswordPublicKey() *auth.PasswordCipherPublicKey {
+	if s == nil || s.cipher == nil {
+		return nil
+	}
+	publicKey := s.cipher.PublicKey()
+	return &publicKey
+}
+
+func (s *AuthService) loginPassword(req LoginRequest) (string, error) {
+	if strings.TrimSpace(req.EncryptedPassword) != "" {
+		if s.cipher == nil {
+			return "", response.ErrBadRequest(40002, "password_cipher_unavailable", "encrypted password is not supported by this server")
+		}
+		password, err := s.cipher.Decrypt(req.EncryptedPassword, req.PasswordKeyID)
+		if err != nil {
+			return "", response.ErrBadRequest(40003, "invalid_encrypted_password", "encrypted password is invalid")
+		}
+		if password == "" {
+			return "", response.ErrBadRequest(40001, "invalid_params", "password is required")
+		}
+		return password, nil
+	}
+	if req.Password == "" {
+		return "", response.ErrBadRequest(40001, "invalid_params", "password is required")
+	}
+	return req.Password, nil
+}
+
 func (s *AuthService) acquireLoginPermit(ctx context.Context, identifier, ip string) (*auth.LoginPermit, error) {
 	if s.loginGuard == nil {
 		return nil, nil