API for setting password

[hughns]

GraphQL mutation to set/change password.

For a regular user require existing password to be provided (as well as new password).

For an admin no existing password is needed.

[hughns]

Assume for now that we don't need to offer the capability to sign out all sessions/devices as part of calling this mutation.

i.e. no need for a replacement for the logout_devices option of POST /_matrix/client/v3/account/password

[sandhose]

API should look like this:

mutation {
  setPassword(input: { userId: "ID", currentPassword: "pwd", newPassword: "pwd" }) {
    status,
    user { .. }
  }
}

Where currentPassword is needed when the requested doesn't have admin capabilities.

To implement this, one would need to:

• put the PasswordManager in the mas_graphql::State. This is particularly annoying, as this currently lives in the mas_handler crate, which isn't accessible from the mas_graphql crate because else there would be a dependency loop
• add a mutation in crates/graphql/src/user.rs
• it should check if the requester is admin or is accessing their own user
• if the requester is not admin:
  • it should check that the SiteConfig allows password change
  • it should check that the currentPassword was provided and validate it