Replace auth verification with bun password api

apps/api/src/server.ts

@@ -10,7 +10,7 @@ import {
     Printful,
     Webflow,
 } from "@blade-and-brawn/commerce";
-import { DEFAULT_NAME, env, log, sha256Sum } from "./util";
+import { DEFAULT_NAME, DUMMY_PASSWORD_HASH, env, log, sha256Sum } from "./util";
 import serverTiming from "@elysia/server-timing";
 import jwt from "@elysia/jwt";
 import { CommerceService, WOrderStatusSchema } from "./services/commerce";
@@ -139,12 +139,8 @@ export const app = new Elysia()
     // AUTHENTICATION
     .post("/auth/login", async ({ jwt, body: { password, email }, cookie: { auth } }) => {
         const account = await s.Accounts.getByEmail(email);
-        const password_match = crypto.timingSafeEqual(
-            sha256Sum(password),
-            account?.password_hash ? Buffer.from(account?.password_hash, "hex") : sha256Sum("Dummy")
-        );
-
-        if (!account?.password_hash || !password_match) throw status(401, "Invalid credentials");
+        const password_match = await Bun.password.verify(password, account?.password_hash ?? DUMMY_PASSWORD_HASH);
+        if (!account || !password_match) throw status(401, "Invalid credentials");
 
         auth.set({
             value: await jwt.sign({ role: account.role, sessionId: randomUUIDv7(), accountId: account.id, exp: JWT_EXP }),

apps/api/src/util.ts

@@ -35,6 +35,7 @@ export const env = {
 
 export const WORKER_COUNT = Math.min(os.availableParallelism(), +env.MAX_WORKER_COUNT);
 export const DEFAULT_NAME = "Default";
+export const DUMMY_PASSWORD_HASH = await Bun.password.hash("Dummy");
 
 function requireEnv(key: string): string {
     const val = Bun.env[key];