From 7a4a8ee50b59ff5419bc2f2fd75ce4eab15e8e75 Mon Sep 17 00:00:00 2001
From: Dominic Ferrando <mail@dominicferrando.com>
Date: Fri, 21 Aug 2026 10:27:55 -0400
Subject: [PATCH] Replace auth verification with bun password api

---
 apps/api/src/server.ts | 10 +++-------
 apps/api/src/util.ts   |  1 +
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 11b9e30..aa6cd8a 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -10,7 +10,7 @@ import {
     Printful,
     Webflow,
 } from "@blade-and-brawn/commerce";
-import { DEFAULT_NAME, env, log, sha256Sum } from "./util";
+import { DEFAULT_NAME, DUMMY_PASSWORD_HASH, env, log, sha256Sum } from "./util";
 import serverTiming from "@elysia/server-timing";
 import jwt from "@elysia/jwt";
 import { CommerceService, WOrderStatusSchema } from "./services/commerce";
@@ -139,12 +139,8 @@ export const app = new Elysia()
     // AUTHENTICATION
     .post("/auth/login", async ({ jwt, body: { password, email }, cookie: { auth } }) => {
         const account = await s.Accounts.getByEmail(email);
-        const password_match = crypto.timingSafeEqual(
-            sha256Sum(password),
-            account?.password_hash ? Buffer.from(account?.password_hash, "hex") : sha256Sum("Dummy")
-        );
-
-        if (!account?.password_hash || !password_match) throw status(401, "Invalid credentials");
+        const password_match = await Bun.password.verify(password, account?.password_hash ?? DUMMY_PASSWORD_HASH);
+        if (!account || !password_match) throw status(401, "Invalid credentials");
 
         auth.set({
             value: await jwt.sign({ role: account.role, sessionId: randomUUIDv7(), accountId: account.id, exp: JWT_EXP }),
diff --git a/apps/api/src/util.ts b/apps/api/src/util.ts
index 7f7538d..db66c0e 100644
--- a/apps/api/src/util.ts
+++ b/apps/api/src/util.ts
@@ -35,6 +35,7 @@ export const env = {
 
 export const WORKER_COUNT = Math.min(os.availableParallelism(), +env.MAX_WORKER_COUNT);
 export const DEFAULT_NAME = "Default";
+export const DUMMY_PASSWORD_HASH = await Bun.password.hash("Dummy");
 
 function requireEnv(key: string): string {
     const val = Bun.env[key];