fix: remove panic() and relay password hashing errors to UI

[eternal-flame-AD]

Fixes #1013

[codecov]

Codecov Report

❌ Patch coverage is 60.97561% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.30%. Comparing base (d543a8a) to head (726c34b).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
api/user.go	50.00%	8 Missing and 4 partials ⚠️
auth/password/password.go	80.00%	1 Missing and 1 partial ⚠️
database/database.go	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1014      +/-   ##
==========================================
- Coverage   74.53%   74.30%   -0.24%     
==========================================
  Files          66       66              
  Lines        3483     3514      +31     
==========================================
+ Hits         2596     2611      +15     
- Misses        688      698      +10     
- Partials      199      205       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jmattheis]

If we mask the error here, we don't get the initial error anywhere, meaning if a user misconfigures the passstrength, it will always return unexpected error without any log about the actual error. I think we can pass the full error without masking into the 500 internal server error, and with the extra validation the length check is done before and results in a 400.

[jmattheis]

This is already checked by the binding on the property (binding:"required"). Please add the 72 char validation there too. Then we don't need this method.

[eternal-flame-AD]

• I actually didn't figure out how to make sure it's no more than 72 bytes long using validator.. do you know how?

[jmattheis]

Ahh true, it bytes and not len on string. Then nevermind about the validation on the binding.

Can we do this as extra check for the create password method in the

		pw, err := password.CreatePassword(user.Pass, a.PasswordStrength)
		if err != nil {
			status := http.StatusInternalServerError
			if errors.Is(err, bcrypt.ErrPasswordTooLong) {
				status = http.StatusBadRequest
			}
			ctx.AbortWithError(status, fmt.Errorf("failed to prepare password: %s", err))
			return
		}

and remove the masking described in https://github.com/gotify/server/pull/1014/changes#r3666911979.