fix(users): Add force rotate password on first login for non-email flow

[ThisIsMani]

Type of Change

• Bugfix
• New feature
• Enhancement
• Refactoring
• Dependency updates
• Documentation
• CI/CD

Description

Currently in non-email flow, users who are invited are not forced to change their password. This PR will add that.

Additional Changes

• This PR modifies the API contract
• This PR modifies the database schema
• This PR modifies application configuration/environment variables

Motivation and Context

Closes #6482.

How did you test it?

1. Invite a new user in non-email flow

   curl --location 'http://localhost:8080/user/user/invite_multiple?token_only=true' \
   --header 'Content-Type: application/json' \
   --header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiN2I2NTA1NGQtNjgzNC00NzU2LTgyNDYtN2RkOWM1ZmQzMzRmIiwibWVyY2hhbnRfaWQiOiJtZXJjaGFudF8xNzI5MTc4MDgzIiwicm9sZV9pZCI6Im9yZ19hZG1pbiIsImV4cCI6MTczMDk4MzEyOSwib3JnX2lkIjoib3JnXzRiYWFjbHZxUklJTEl2a25NdnZQIiwicHJvZmlsZV9pZCI6InByb18yOUFWY0ltVnFDYTV1UHdMMzlQWCJ9.E5ZfkG5y0tqGa_vzGXe5LTJlyljqP8tKs1T2qokRtr0' \
   --data-raw '[
       {
           "email": "new email",
           "name": "name",
           "role_id": "merchant_view_only"
       }
   ]'
   

   [
       {
           "email": "email from request",
           "is_email_sent": false,
           "password": "4724b955-bc1d-4565-bbb6-1a09b2372bfaA"
       }
   ]

2. Sign in as the new user

   curl --location 'http://localhost:8080/user/v2/signin' \
   --header 'Content-Type: application/json' \
   --data-raw '{
       "email": "email used in invite",
       "password": "password from invite API response"
   }'
   

   {
       "token": "TOTP SPT",
       "token_type": "totp"
   }

3. Terminate 2FA (This API should give reset password SPT)

   curl --location 'http://localhost:8080/user/2fa/terminate?skip_two_factor_auth=true' \
   --header 'Authorization: TOTP SPT' \
   

   {
       "token": "Force set password SPT",
       "token_type": "force_set_password"
   }

Checklist

• I formatted the code cargo +nightly fmt --all
• I addressed lints thrown by cargo clippy
• I reviewed the submitted code
• I added unit tests for my changes where possible

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
crates/router/src/types/domain/user.rs	44% smaller