Make passwordPolicy validatorCallback asynchronous

New Feature / Enhancement Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Current Limitation

Custom validation on passwords may include asynchronous operations, such as hitting an special endpoint. The current validator only runs synchronously.

Feature / Enhancement Description

RestWrite.js should wrap the validatorCallback invocation with await Promise.resolve(...) so that both synchronous (boolean) and asynchronous (Promise) callbacks are supported. The type declaration for validatorCallback in PasswordPolicyOptions should be updated accordingly to (password: string) => boolean | Promise<boolean>.

Also worth mentioning the typing issue in https://github.com/parse-community/parse-server/issues/10471

// Before
if (
  this.config.passwordPolicy.validatorCallback &&
  !this.config.passwordPolicy.validatorCallback(this.data.password)
) { ... }

// After
if (this.config.passwordPolicy.validatorCallback) {
  const isValid = await Promise.resolve(
    this.config.passwordPolicy.validatorCallback(this.data.password)
  );
  if (!isValid) {
    return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, policyError));
  }
}

Example Use Case

1. Send a login/sign up request with a password
2. Expect an asynchronous operation to happen inside the validation

Alternatives / Workarounds

Custom logic in beforePasswordResetRequest, beforeLogin and beforeSave for _User

3rd Party References

Start by reading RestWrite.js and the PasswordPolicyOptions type declaration to trace the validatorCallback invocation and its typing. Verify that synchronous and asynchronous callbacks are both supported and that the declaration accepts Promise; check the related password-policy behavior before considering the work done.